On a related note, when did it become OK for an App to ask for your credit card number to do in-app purchase? I thought that wasn't allowed.
Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
11–20 of 110 posts
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#12I would guess that most iOS users think that the confirmation message for in-app purchases (prompting you for your iCloud credentials) is from the app from which they initiated the purchase, rather than from a system service. This probably conditions them to trust all iOS apps with their password if prompted to enter it.
Which is precisely why the thing this article is pointing out is extremely terrible - Apple should have made it a rule a long time ago that no 3rd party app can ask for Apple ID credentials. But they dug themselves in a ditch by unifying extremely sensitive things (App Store access) & very sensitive things (email, calendar) under a single account. A few ways to get out of that ditch: - not allowing any iOS/Mac app s…
use two step verification for app store purchases
That's actually a great idea, and it wouldn't be hard at all, as long as they were to use TFA for all iCloud access. The second factor (e.g. a 6-digit number) could be displayed in the dialogue box asking for your password.
If it's a genuine dialogue box, no problem. If it's _not_ a genuine dialogue box, then the captured username/password is of no use, as you don't have the second factor. Replay and MITM attacks could be avoided by using a session identifier; the app wouldn't be able to get at it due to the sandbox.
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#13On a related note, when did it become OK for an App to ask for your credit card number to do in-app purchase? I thought that wasn't allowed.
IAP is required for virtual goods used within the app. It's fine to ask for a credit card number to purchase physical goods and services. That's why Apple hasn't shut down Uber and Square.
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#14Earlier quoted context omitted.
It's pretty crazy that you need to use the same credentials to "buy" a $0 app as you have to remotely lock and wipe your iphone and mac.
You don't need to at all. I use two separate Apple IDs on my iOS devices. Apple ID accounts are individually configurable for most, if not all iCloud/App Store services.
If no one uses a feature the feature might as well not exist.
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#15Hey everybody, Pierre from @sunrise.
This is the blog post we've just published to give more context:
"Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that.
The two reasons why we are doing this are: - one, to provide a better user-experience - two, to offer a Sunrise experience everywhere, on all platforms (including web and Android)
Providing a better user-experience
Being able to access the data from our servers, instead of just client-side, has enabled us to write a better calendar app. We are working hard to make synchronization faster and more reliable, and it enables us to send push notifications or alerts to users without them having to open the app.
And this is just the beginning, a lot of new features that we are working on at Sunrise for the future will rely on our server-side infrastructure.
Sunrise everywhere
The two biggest feature requests we get from users are: “when is Sunrise going to launch on desktop” and “what about Android?”.
We understand our users, they want a unified Sunrise experience everywhere, and so we can’t use a local API for that.
How does it work? Is this secure?
When you type in your iCloud credentials, they are sent to our server only once in a secured way over SSL. We use them to generate a secure token from Apple. This secure token is the only thing we store on our servers, we never store your actual iCloud credentials.
What’s next?
In the future, we are thinking about ways to take advantage of the local Calendar API for users who don’t want to share their credentials, we understand their point of view.
We are also hoping that Apple will leverage OAuth to authenticate their calendar API, which will make things easier for everyone. We already support OAuth with Facebook, Google, Twitter, LinkedIn, Foursquare and Producteev. We support OAuth where we can.
We are a team of 7 people building a calendar with love & passion, and unfortunately we can’t always move as fast as we want, but as always, we want to address users’ issues with transparency and openness. We’re listening on @sunrise or support@sunrise.am"
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#16Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…
Submitting credentials "only once to our server" is a classical fishing attack. There is no way for the user to verify what happen with them.
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#17Earlier quoted context omitted.
It's pretty crazy that you need to use the same credentials to "buy" a $0 app as you have to remotely lock and wipe your iphone and mac.
You don't need to at all. I use two separate Apple IDs on my iOS devices. Apple ID accounts are individually configurable for most, if not all iCloud/App Store services.
I’m glad that you are able to understand that abstraction, but if I'm being honest, how Apple handles accounts gets way over my head — and anyone around me is baffled by it too.
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#18Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…
The one rather glaring fly in your ointment is that if your system was as secure as you make it out to be you wouldn't have been asking users to change their iCloud passwords after your database was compromised a few months ago.
http://www.theverge.com/2013/11/3/5061136/sunrise-calendar-a...
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#19Admittedly, Android does it much better by providing oAuth, an easy way to get the users sign in, and of course APIs for almost all the popular features. And also, for installing $0 apps you don't need any credit card details at all. Even the buttons are different "Install" v/s "Buy".
Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
#20I would guess that if they had another way to access your iCloud calendar from their servers they would. Apple unfortunately has everything linked to a single account without any sort of Oauth. This is more an issue with iCloud than it is with iTunes or the App Store.
iClouds PIM stuff uses DAV for syncing. In theory they could issue separate credentials to handle PIM syncing, and keep it all transparent to the user: have an API that devs can use to request a token, or something, from Apple to access DAV, when a request is authenticated through an OS native dialog (only going through apples servers and your device) -- keeping actual iCloud credentials away from the app itself.