Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Developer Website Update

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 223 posts

Re: Apple Developer Website Update

#121

Post by smegel »

kristofferR wrote: post #39
jpdoctor wrote: post #29

> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it. Apparently our intelligence, which cannot be insulted, has been in…

By "sensitive personal information" they probably just mean passwords and credit card information, not names, email addresses and mailing addresses.

I think I would rather someone have my CC number than my home address (which would be the same as my mailing address).

Re: Apple Developer Website Update

#122

Post by nwh »

fleitz wrote: post #88
nwh wrote: post #7

Uh, how does this "encryption" work? For the website to show these details (and it does, in part, use these details in the interface) it must be able to decrypt these on the web applications side. Ergo the keys for decryption must also be on the server or derived from the users passwords, both of which make the use of encryption a fairly worthless venture. ED: As another commenter mentioned in an earlier thread, lots…

Maybe they phoned for a ransom after breaking in? Your post is pure speculation and depends heavily on what Apple means by 'sensitive'. I'm guessing that Apple means your CC numbers, certs, shared keys, etc. Possibly also your support tickets, your bank numbers, etc. As for how encryption works, I'd suggest Applied Cryptography by Scheiner. I think there's a problem in that book about Bob keeping speculative posts to…

I am aware how crypto works. I was commenting on there being no source for a key in this situation, rendering it a fairly useless venture.

Re: Apple Developer Website Update

#124

Post by ptwiggens »

num3ric wrote: post #92
tlongren wrote: post #10

Earlier quoted context omitted.

As I interpreted it, yes, the intruder does have your encrypted data.

I hope you were using good encryption Apple. This guy cracked 400,000 md5 hashed passwords: http://www.youtube.com/watch?v=0WPny7wk960 He says even with password salts, it could be done.

Unsalted MD5 has been extremely easy to crack for years. Not sure why the claim would be impressive at this point.

Re: Apple Developer Website Update

#128

Post by tcas »

I downloaded the CRL for developer certificates [1] and quickly looked at it using grep:

  grep -E "Revocation Date: Jul 17 .{8} 2013" wwdrccrl.txt | wc -l
      3065
  grep -E "Revocation Date: Jul 18 .{8} 2013" wwdrccrl.txt | wc -l
      2289
  grep -E "Revocation Date: Jul 19 .{8} 2013" wwdrccrl.txt | wc -l
         2
  grep -E "Revocation Date: Jul 20 .{8} 2013" wwdrccrl.txt | wc -l
         0
  grep -E "Revocation Date: Jul 21 .{8} 2013" wwdrccrl.txt | wc -l
         0
These are the two certificates that were revoked on the 19th

  grep -A 3 -B 1 -E "Revocation Date: Jul 19 .{8} 2013" wwdrccrl.txt
      Serial Number: 2628C7F90970D227
          Revocation Date: Jul 19 03:14:04 2013 GMT
          CRL entry extensions:
              X509v3 CRL Reason Code: 
                  Key Compromise
  --
      Serial Number: 1A51ABFA4844BD45
          Revocation Date: Jul 19 03:24:03 2013 GMT
          CRL entry extensions:
              X509v3 CRL Reason Code: 
                  Key Compromise
To generate the wwdrccrl.txt file I used:

  openssl crl -inform DER -text -noout -in wwdrca.crl > wwdrccrl.txt
Just to be clear -- every entry there I see lists the reason as Key Compromise, just interesting that they usually seem to revoke at least 2000 certificates a day but suddenly stopped on the 19th with just revoking 2.

[1]http://www.apple.com/certificateauthority/

Re: Apple Developer Website Update

#129

Post by ptwiggens »

markdown wrote: post #113
peterkelly wrote: post #86

Earlier quoted context omitted.

This isn't about marketing. It's about a security breach. And security breaches take time (> 2 days) to properly investigate and report. It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies. It's equally possible that there's some bug (that either you or I could easily have made the mistake of introducing) that's resulted in this being possib…

My argument was that you were impressed by the press-release. Your opinion of Apple was improved such that you made a post in public expressing your admiration of them for telling you that they'd lost some data that you'd entrusted to them. This shouldn't happen. When my 4yr old tells me he did something "wrong" without any prompting (eg. "Dad, I broke your phone"), I'm impressed because he didn't have to out himself…

Your post basically amounts to a conspiracy theory.

"It took them 3 days to tell us something happened. Obviously this means they would have kept it secret if it were at all possible."

It takes time to figure out what happened in a breach. That doesn't mean that Apple is some evil company trying to hide the fact that there was a breach.

Re: Apple Developer Website Update

#130

Post by ptwiggens »

vmarsy wrote: post #31

If the intruder is a patent troll-er, getting developers’ names and mailing addresses can be pretty harmful.

How exactly would that be harmful?

If a patent troller wants to find out who is behind an app, they would go through the legal system and use a subpoena.

Literally no reason whatsoever for them to hack a website to get it.

Post reply on HN