Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

311–320 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#311

Post by AstralStorm »

caf wrote: post #284
michrassena wrote: post #29

Earlier quoted context omitted.

I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-…

The Linux console does support a secure attention key that can't be trapped and will kill any process which has /dev/console open. root can configure it with /sbin/loadkeys. Not sure how distributions tend to configure it by default.

If magic sysrq is enabled, this is alt+sysrq+k. (Usually sysrq is same key as printscreen)

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#312

Post by sametmax »

ryanlol wrote: post #299
sametmax wrote: post #247

Earlier quoted context omitted.

Not trusting apple with keeping their promise they won't share the finger print in the future is a good reason.

So you're saying you're worried about apple pushing a malicious iOS update because they want your fingerprint? If yes, this feels utterly nonsensical. They would be able to grab your fingerprint from the sensor anyway, whether you are actively using it or not... Alternatively you might be spreading some weird conspiracy theory that instead of securely storing a "hash" of the fingerprint on a HSM, current touchid impl…

How anybody can still use this argument after prism is beyong my understanding. Literally. I do mean i can't grasp it.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#313

Post by olegkikin »

amq wrote: post #117
olegkikin wrote: post #56

Earlier quoted context omitted.

One solution that seems obvious to me is - the OS itself can detect fake popups such as this. It can even be a fast neural net that checks the screen, say, once a second.

A neural net for what could be a simple string comparison?

It must be an image comparison, and it's can be a simple 1-to-1, because all it takes is one modified pixel to break that. That's why it has to be some sort of an image recognition technology.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#314

Post by jsjohnst »

emmelaich wrote: post #300
jsjohnst wrote: post #294

Earlier quoted context omitted.

Dude. Stop and think for a moment. If I am able to render anything on the screen at all, it means I’m the foreground app on iOS. I don’t need to fake being a keyboard, because I can use the real thing Apple provides. So no, I’m not saying it’s impossible if I can render anything at all, what I’m saying is that outside being the foreground app, rendering anything on screen is impossible outside very tightly controlled…

I am only talking about what the app does when it is the foreground app. I should have addressed that in the previous comment. It's not a sidetrack, because that's what the actual article is about.

So if you really were talking about the foreground app and not just covering now, then why does one need to make a fake keyboard!? That makes no sense at all.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#315

Post by ballenf »

yardie wrote: post #242
ballenf wrote: post #93

Earlier quoted context omitted.

There's one annoying omission from family sharing: no IAP are included. And almost every kids game has one. Not talking freemium but just ones with one free level that gets kids hooked.

That doesn't appear to be the case for us. We have sharing and my spouse and son make IAPs frequently. For him, I'm alerted to authorize the payment.

You can share the payment method, but family members can't benefit from the "unlock" of the IAP and must each purchase it separately.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#316

Post by skav »

tolmasky wrote: post #212

When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…

I worked in dumb phone standards 12 years ago (GlobalPlatform) and it was actually in the standards to tell the user "you are in the secure zone". Well, OEMS in the western world were not really willing to implement it, funny it comes back now.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#317

Post by yardie »

ballenf wrote: post #315
yardie wrote: post #242

Earlier quoted context omitted.

That doesn't appear to be the case for us. We have sharing and my spouse and son make IAPs frequently. For him, I'm alerted to authorize the payment.

You can share the payment method, but family members can't benefit from the "unlock" of the IAP and must each purchase it separately.

I believe that is set by the app creator so that users wouldn't try to load the same subscription under multiple accounts. I'm speaking of the general app purchases, and family subscriptions we haven't had an issue with.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#318

Post by ryanlol »

sametmax wrote: post #312
ryanlol wrote: post #299

Earlier quoted context omitted.

So you're saying you're worried about apple pushing a malicious iOS update because they want your fingerprint? If yes, this feels utterly nonsensical. They would be able to grab your fingerprint from the sensor anyway, whether you are actively using it or not... Alternatively you might be spreading some weird conspiracy theory that instead of securely storing a "hash" of the fingerprint on a HSM, current touchid impl…

How anybody can still use this argument after prism is beyong my understanding. Literally. I do mean i can't grasp it.

What argument? It’s utterly ridiculous that you would assume Apple to be incapable of collecting your fingerprint data simply because you didn’t enable TouchID in their software.

Do you just not use the home button?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#319

Post by gruez »

jaclaz wrote: post #303
gruez wrote: post #218

Earlier quoted context omitted.

but does it suppress the real thing? otherwise the user is going to see the (real) windows security dialog, followed by your fake one after they exited the real one.

Really cannot remember how the mentioned little program worked with the "real" Winlogon, i.e. if it managed to hook "before" it the key sequence. Anyway there are other ways, here is one: http://www.oblita.com/interception.html about midpage there is a sample to "intercept and block" the sequence.

but that requires a kernel mode component, and if you have kernel access all bets are off. for instance, you can directly patch out the login screen (which is in userspace) to steal the password for you.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#320

Post by jaclaz »

gruez wrote: post #319
jaclaz wrote: post #303

Earlier quoted context omitted.

Really cannot remember how the mentioned little program worked with the "real" Winlogon, i.e. if it managed to hook "before" it the key sequence. Anyway there are other ways, here is one: http://www.oblita.com/interception.html about midpage there is a sample to "intercept and block" the sequence.

but that requires a kernel mode component, and if you have kernel access all bets are off. for instance, you can directly patch out the login screen (which is in userspace) to steal the password for you.

Sure, but I bet that some clever folks may well "disguise" such a kernel component into (say) an update or a new install in such a way that the user is tricked as well to allow it.

No idea anyway (since the topic is on iOS) how that OS would behave and what could be the equivalent of a Ctrl+Alt+Del key sequence on a keyboardless device such as a iPhone or iPad.

Post reply on HN