Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

291–300 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#291

Post by emmelaich »

jsjohnst wrote: post #286
emmelaich wrote: post #206

Earlier quoted context omitted.

What's stopping an app from imitating the keyboard? Fundamentally, we're talking about imbuing meaning to patterns of light on a screen. And apps can write on any part of the screen. I suspect the only way to battle this is to have a separate screen which is controllable only from the system. And even many people will fall for password prompts in the main screen.

> What's stopping an app from imitating the keyboard? What is the end goal of that? If you have control of the screen (aka are the foreground app), why would you need to emulate the keyboard? If you aren't the foreground app, then you aren't going to be able to render a keyboard on the screen (on iOS anyway).

> why would you need to emulate the keyboard?

to avoid the OS restrictions on which keyboard app is used for passwords.

> you aren't going to be able to render a keyboard on the screen (on iOS anyway).

Are you saying it is impossible to render the pixels and accept screen touches in a way that it acts and looks like a "real" keyboard app?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#292

Post by jondwillis »

altern8tif wrote: post #289
tolmasky wrote: post #212

When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…

Am I missing something here? Isn't the notch already taken up by FaceID sensors/front-facing camera? It isn't really "extra screen real estate". I do like the idea of a separate indicator for system-wide security events though. Perhaps an LED indicator although that doesn't seem very Apple-like.

I believe OP is referring to the screen real estate next to the notch on both sides.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#293

Post by earenndil »

perryprog wrote: post #187
earenndil wrote: post #131

Earlier quoted context omitted.

Couldn't an app screenshot the screen after asking you to authenticate, and thus capture the phrase?

AFAIK, it's not possible for a sandboxed app to take a screenshot without user consent.

There are apps (obviously they're banned in the app store) that can record the screen (not just within the app, but in general).

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#294

Post by jsjohnst »

emmelaich wrote: post #291
jsjohnst wrote: post #286

Earlier quoted context omitted.

> What's stopping an app from imitating the keyboard? What is the end goal of that? If you have control of the screen (aka are the foreground app), why would you need to emulate the keyboard? If you aren't the foreground app, then you aren't going to be able to render a keyboard on the screen (on iOS anyway).

> why would you need to emulate the keyboard? to avoid the OS restrictions on which keyboard app is used for passwords. > you aren't going to be able to render a keyboard on the screen (on iOS anyway). Are you saying it is impossible to render the pixels and accept screen touches in a way that it acts and looks like a "real" keyboard app?

Dude. Stop and think for a moment. If I am able to render anything on the screen at all, it means I’m the foreground app on iOS. I don’t need to fake being a keyboard, because I can use the real thing Apple provides. So no, I’m not saying it’s impossible if I can render anything at all, what I’m saying is that outside being the foreground app, rendering anything on screen is impossible outside very tightly controlled interfaces (like custom keyboards that this thread was about before you side tracked it).

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#295

Post by yorwba »

caf wrote: post #284
michrassena wrote: post #29

Earlier quoted context omitted.

I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-…

The Linux console does support a secure attention key that can't be trapped and will kill any process which has /dev/console open. root can configure it with /sbin/loadkeys. Not sure how distributions tend to configure it by default.

I just looked at the table with dumpkeys, but I'm not sure what I'd have to look for to identify that key.

  sudo dumpkeys | rg --only-matching '=.*' | sort | uniq
doesn't show anything that stands out, except maybe for Boot and Break. (But I guess that's a line break?) What would the key do when pressed?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#296

Post by caf »

yorwba wrote: post #295
caf wrote: post #284

Earlier quoted context omitted.

The Linux console does support a secure attention key that can't be trapped and will kill any process which has /dev/console open. root can configure it with /sbin/loadkeys. Not sure how distributions tend to configure it by default.

I just looked at the table with dumpkeys , but I'm not sure what I'd have to look for to identify that key. sudo dumpkeys | rg --only-matching '=.*' | sort | uniq doesn't show anything that stands out, except maybe for Boot and Break. (But I guess that's a line break?) What would the key do when pressed?

The key will kill any process with the console open (which should then cause login to respawn) and log the killed processes.

If you want to test it then this will set Ctrl-Alt-Esc as your SAK:

  echo "control alt keycode 1 = SAK" | loadkeys

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#297

Post by marksomnian »

ksk wrote: post #176
vortico wrote: post #102

Earlier quoted context omitted.

That's interesting. I haven't used Windows since UAC came out. Is a Windows password useless to an application then?

UAC came out over 10 years ago! In any case, NT is structured quite differently than the typical UNIX variants. When you log in, NT creates two access tokens for you. One with all your privileges, and one with admin rights masked out. When a process is launched it uses the non-admin one by default, even if you are the admin user. When a thread requires admin privileges, NT will first check if your unmasked token alre…

For all of Microsoft's faults, I can't count how many feats of engineering they've pulled off to maintain backwards compatibility.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#298

Post by Someone »

dboreham wrote: post #288
acomjean wrote: post #271

Earlier quoted context omitted.

> DEC published the source code for the OS, albeit as Microfiche. Wait.... What? Nice job decoding that.

It was written in Bliss so not so hard if you understand BCPL or C. Also I was 17 and had a lot of time on my hands...

I think (s)he wonders how you read that.

My guess would be that you did using the microfiche reader at your university or at a library. Before digitization, such devices were fairly common wherever people had a lot of text to archive.

(Aside: https://en.wikipedia.org/wiki/Microform even has a photo of a “DuKane brand microfiche reader with source code printed on the films.”. I couldn’t read enough of the text on the envelope to decide whether that is true from the photograph

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#299

Post by ryanlol »

sametmax wrote: post #247
ryanlol wrote: post #220

Earlier quoted context omitted.

Do you not have fingers? Or is there some other good reason not to use TouchID outside of the lock screen?

Not trusting apple with keeping their promise they won't share the finger print in the future is a good reason.

So you're saying you're worried about apple pushing a malicious iOS update because they want your fingerprint?

If yes, this feels utterly nonsensical. They would be able to grab your fingerprint from the sensor anyway, whether you are actively using it or not...

Alternatively you might be spreading some weird conspiracy theory that instead of securely storing a "hash" of the fingerprint on a HSM, current touchid implementations are secretly sharing your fingerprints with Apple.

That's not really any less nonsensical.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#300

Post by emmelaich »

jsjohnst wrote: post #294
emmelaich wrote: post #291

Earlier quoted context omitted.

> why would you need to emulate the keyboard? to avoid the OS restrictions on which keyboard app is used for passwords. > you aren't going to be able to render a keyboard on the screen (on iOS anyway). Are you saying it is impossible to render the pixels and accept screen touches in a way that it acts and looks like a "real" keyboard app?

Dude. Stop and think for a moment. If I am able to render anything on the screen at all, it means I’m the foreground app on iOS. I don’t need to fake being a keyboard, because I can use the real thing Apple provides. So no, I’m not saying it’s impossible if I can render anything at all, what I’m saying is that outside being the foreground app, rendering anything on screen is impossible outside very tightly controlled…

I am only talking about what the app does when it is the foreground app. I should have addressed that in the previous comment.

It's not a sidetrack, because that's what the actual article is about.

Post reply on HN