Live data from Hacker News

AppleID password brute force proof-of-concept

github.com

81–83 of 83 posts

Re: AppleID password brute force proof-of-concept

#81
post #48
post #44

Earlier quoted context omitted.

Simple: it is Apples problem if their servers aren't secure. You don't owe apple free work. Delayed disclosure is a nicety, not something you are obligated to do.

So there is no ethical responsibility to protect the users who will be left vulnerable to this exploit? Remember the danger here is screwing people who have iCloud accounts. It's not like Julie the housewife in Minnesota, had any say in the security of Apple's products.

One problem is that if the exploit is given silently to the company, they often don't change any of their practices (even if they fix that particular exploit), and more exploits soon surface, and maybe this time by people who plan to abuse them instead of telling the company.

By going loud and public, you ensure that the company has to do something to save face. It can't just be forgotten on some manager's desk.

And the fact is, you, as part of the public, would only know about the times when somebody goes loud about an exploit. For all you know, there might have been hundreds upon hundreds of times when security researches have gone to the company and been outright ignored, and when one finally goes loud with what he has found, you say "He really should have done this more quietly, it would have been much more responsible"

Re: AppleID password brute force proof-of-concept

#83

The bomb on Apple iOS security is here. My friend bypass the iCloud activation screen lock whit the hack tool from this page http://bypassicloudactivationlock.blogspot.com/ Look it if you have this problem - you can solve it here

The bomb on Apple iOS security is here. My friend bypass the iCloud activation screen lock whit the hack tool from this page http://bypassicloudactivationlock.blogspot.com/ Look it if you have this problem
Post reply on HN