Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

marco.org

Post reply on HN
Print view View original

21–30 of 110 posts

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#21

Post by nathancahill »

objclxt wrote: post #18
way66 wrote: post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

The one rather glaring fly in your ointment is that if your system was as secure as you make it out to be you wouldn't have been asking users to change their iCloud passwords after your database was compromised a few months ago. http://www.theverge.com/2013/11/3/5061136/sunrise-calendar-a...

Ouch.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#22

Post by lockmovdwordptr »

objclxt wrote: post #18
way66 wrote: post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

The one rather glaring fly in your ointment is that if your system was as secure as you make it out to be you wouldn't have been asking users to change their iCloud passwords after your database was compromised a few months ago. http://www.theverge.com/2013/11/3/5061136/sunrise-calendar-a...

I guess they have done that for triggering a reset of the validity of the "apple token" that was compromised.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#23

Post by coldtea »

runjake wrote: post #8
0x0 wrote: post #6

Earlier quoted context omitted.

It's pretty crazy that you need to use the same credentials to "buy" a $0 app as you have to remotely lock and wipe your iphone and mac.

You don't need to at all. I use two separate Apple IDs on my iOS devices. Apple ID accounts are individually configurable for most, if not all iCloud/App Store services.

To quote JWZ: "You have invoked the "Oh, but there's a preference to turn off that stupid behavior" defense. I am showering you with negativity."

(Yes, it's not a preference pedantically, it's an option to create multiple accounts. Still the default and most used is using one account).

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#24

Post by po »

zw wrote: post #9

They can't win, can they? I'm sure if they did exactly what he suggests a long, long time ago we'd be hearing how evil they are for not allowing calendar apps to work properly on the store.

Nobody is calling anybody evil. Developers may complain that there is no server-side API for an iOS user's calendar but it's still crazy that Apple allows and promotes an app that normalises an extremely dangerous practice.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#25

Post by xerophtye »

cmelbye wrote: post #13
FigBug wrote: post #11

On a related note, when did it become OK for an App to ask for your credit card number to do in-app purchase? I thought that wasn't allowed.

IAP is required for virtual goods used within the app. It's fine to ask for a credit card number to purchase physical goods and services. That's why Apple hasn't shut down Uber and Square.

I am guessing you can trust the app with ur credit Card because of AppStore's rigorous entry tests?

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#26

Post by smithereens »

cmelbye wrote: post #13
FigBug wrote: post #11

On a related note, when did it become OK for an App to ask for your credit card number to do in-app purchase? I thought that wasn't allowed.

IAP is required for virtual goods used within the app. It's fine to ask for a credit card number to purchase physical goods and services. That's why Apple hasn't shut down Uber and Square.

There are plenty of examples of apps that take credit cards for non-physical goods: http://stackoverflow.com/questions/19458610/how-do-i-take-a-...

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#27

Post by koudi »

way66 wrote: post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

Why not generate token on client and only submit that?

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#29

Post by obsim »

way66 wrote: post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

Can you explain how it is possible to generate secure tokens? I can't find anything related to it from the iCloud documentations.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#30

Post by Xylakant »

fhars wrote: post #16
way66 wrote: post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

Submitting credentials "only once to our server" is a classical fishing attack. There is no way for the user to verify what happen with them.

Seriously, there's no way for the user to verify what happens with them even if they don't send them to the server and generate the token in the app. They could still just encrypt them and hide them in the requests they send to their servers to retrieve calendar data. It's fundamentally a matter of trust, made worse by the fact that apple obviously doesn't offer oauth or a similar mechanism.
Post reply on HN