Manage your Apple ID/password/security questions here: https://appleid.apple.com
Apple Developer Website Update
101–110 of 223 posts
Re: Apple Developer Website Update
#102> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it. Apparently our intelligence, which cannot be insulted, has been in…
By "sensitive personal information" they probably just mean passwords and credit card information, not names, email addresses and mailing addresses.
I'm imagining bank account numbers over CC info/passwords was the sensitive part.
Re: Apple Developer Website Update
#103> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it. Apparently our intelligence, which cannot be insulted, has been in…
Alternately, inside the reality distortion field developers’ names, mailing addresses, and/or email addresses is not sensitive personal information.
How are names, mailing addresses, and email addresses sensitive personal information?
I would imagine that for most of the people signed up, it wouldn't be that hard to track down their name and email just from knowing the name of their app.
Re: Apple Developer Website Update
#104A little more info from TC:
http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev...
Update — Just got off the phone with an Apple rep, who confirmed a bit more:
- The hack only affected developer accounts; standard iTunes accounts were not compromised
- Credit card data was not compromised
- They waited three days to alert developers because they were trying to figure out exactly what data was exposed
- There is no time table yet for when the Dev Center will return
Re: Apple Developer Website Update
#105> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it. Apparently our intelligence, which cannot be insulted, has been in…
"The intruder had good intent with trying to "secure" our personal information. But despite nothing being hacked, as it was only a 'threat', we still need to tear down and build up the system from scratch again. In the spirit of transparency we've waited 72 hours before giving you this nonsense bullshit. Please note that some (that is all) of you will from now on get regular viagra offerings in cyrillic. Good for you!"
Re: Apple Developer Website Update
#106Earlier quoted context omitted.
> ...but credit-cards are the big one you have to keep in plaintext. If you want to bill the card without asking for the number to be reentered, there's no way to avoid storing the number and expiration date. Not necessarily, if you're using a payment gateway that supports token billing...
Yes, but then you're going to start running into the "don't keep all your eggs in one basket" situation. Sure there are companies out there that will store that information for you, so you don't have to worry about living up to the standards of storing it, but what if that company is compromised? You can't just say "oh they should just let someone else deal with storing that information..." SOMEONE is going to have s…
When it's the bank that issues you the token, the buck stops there. The bank has the card details anyway.
Re: Apple Developer Website Update
#107Imagine what you could do here: - break into facebook or twitter or any other high profile dev account - reissue new code signing keys - crack the latest public app and patch in a backdoor - code sign with new keys and submit as an app update
How? They took it offline.
Re: Apple Developer Website Update
#108Earlier quoted context omitted.
It's a strange world we live in when every time we're told by a big corp that our personal info was compromised, we're grateful for being told. This is the worlds most cashed-up corporation. They could buy entire countries, yet they made a conscious choice not to update their server software or hire more competent sys-admins. There shouldn't be a way for them to gain marketing wins out of this. There should be a law…
This isn't about marketing. It's about a security breach. And security breaches take time (> 2 days) to properly investigate and report. It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies. It's equally possible that there's some bug (that either you or I could easily have made the mistake of introducing) that's resulted in this being possib…
> And security breaches take time (> 2 days) to properly investigate and report.
We can see that they did their job correctly by the overwhelming amount of details they provided us with.
Re: Apple Developer Website Update
#109Earlier quoted context omitted.
It can take more than a day to know what happened to your data.
Yes, but it doesn't take more than a day to know that an intruder had accessed the system in a way that may have compromised your personal information. Basically, once the problem was serious enough that they felt like they needed to take the site down, I'm pretty sure they knew which machines had been accessed (or at least may have been accessed). They knew that some of those machines had developer's personal inform…
"I'm pretty sure."
No, they likely took the portal down as soon as they knew there was a breach. Highly unlikely they left it up while they investigated, and it takes time to figure out what happened and how much information was taken.
What motivation would there be to wait anyways?
Re: Apple Developer Website Update
#110Earlier quoted context omitted.
Passwords could be hashed, but credit-cards are the big one you have to keep in plaintext. If you want to bill the card without asking for the number to be reentered, there's no way to avoid storing the number and expiration date. PCI does mandate that you keep less than necessary to initiate a new charge, though: you are not allowed to store the 3-digit verification code from the back of the card. Future charges fro…
Purchases of developer memberships are handled through Apple's online store. And that is still up.
There also is the bank account information for apple created payments to the developers... that could be part of the compromised items.