Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boffins reveal password-killer 0days for iOS and OS X

theregister.co.uk

Post reply on HN
Print view View original

61–70 of 144 posts

Re: Boffins reveal password-killer 0days for iOS and OS X

#61

Post by opcvx »

w8rbt wrote: post #59
opcvx wrote: post #47

Earlier quoted context omitted.

Where should the state be kept, on a server?

No where electronically. A simple word or phrase in the user's mind would do. Rather than being stored for later retrieval, complex passwords could be generated on-the-fly (when needed) using this word/phrase as input combined with other input such as URLs, hostnames, service names, etc.

You method would require that pass everytime a password is fetched or generated. Similar to the UAC confimation on Windows. Remember how annoying that was, everyone turned it off.

Re: Boffins reveal password-killer 0days for iOS and OS X

#62

Post by bennyg »

cinquemb wrote: post #27
hhsnopek wrote: post #19

Earlier quoted context omitted.

You know this was bound to happen sooner or later. That goes for any encryption technology. Last pass was recently "hacked" as well. You can't trust any crypto tech ;)

In the age of crypto-peddling-as-a-service by large, small companies and individuals alike, as an end all be all to general opsec and the tradeoffs inherit in any decision making (as it is so often common to ignore such elephants in the room with one wave of the "trust the math" wands), It might just be more socially acceptable to just feign surprise :P

Which is why "open source all the things" is the way to go for trusting crypto implementations - or at least it's step 1.

Re: Boffins reveal password-killer 0days for iOS and OS X

#63

Post by userbinator »

romanovcode wrote: post #49
josteink wrote: post #45

Once again goes to show that Apple is mostly interested in the security of its iStore, platform lock down and DRM. I'm not exactly shocked. Just for kicks... Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Turns out, with marketshare they can! Just like Windows. Strange thing eh?

>Just like Windows. Strange thing eh? Not strange if you grasp the fact that malware is just a program that has elevated access. For me it was strange how can Apple market their system as virus-free. Now that's ridiculous.

Not strange if you grasp the fact that malware is just a program that has elevated access

I would define malware more simply as a program that does something the user doesn't want.

Re: Boffins reveal password-killer 0days for iOS and OS X

#64

Post by obituary_latte »

pilsetnieks wrote: post #42
andor wrote: post #16

Quick summary of the keychain "crack": Keychain items have access control lists, where they can whitelist applications, usually only themselves. If my banking app creates a keychain item, malware will not have access. But malware can delete and recreate keychain items, and add both itself and the banking app to the ACL. Next time the banking app needs credentials, it will ask me to reenter them, and then store them i…

If this is how it works, you can check it on OS X by clicking each item in Keychain Access and looking at the Access Control tab or you can run `security dump-keychain -a` in terminal - it lists all keychain items and their access control lists. It's still a big and unwieldy list but not as bad as clicking each keychain item. Someone better at this stuff could probably think of a way to make it easier. (This would on…

>This would only show if you've been exploited already

What would indicate a compromise?

Re: Boffins reveal password-killer 0days for iOS and OS X

#65

Post by CPLX »

josteink wrote: post #45

Once again goes to show that Apple is mostly interested in the security of its iStore, platform lock down and DRM. I'm not exactly shocked. Just for kicks... Does anyone remember the I'm a PC ads, where macs were magically "secure", couldn't get viruses or hacked or anything? Turns out, with marketshare they can! Just like Windows. Strange thing eh?

In fairness, for most of the 2000's in my experience at least -- which included defacto admin duties for a decent size office fill of Macs -- dealing with malware and viruses really just wasn't much of a problem to worry about.

By contrast, it seemed like owning a Wintel machine pretty much guaranteed you'd have issues unless you were utterly ruthless and/or didn't have any layman users browsing the internet to worry about.

Has that in fact changed since? I am no longer as familiar with the Windows side of things as I used to be, but I do know from experience that there's a very solid reason why this stereotype took root in the first place.

Re: Boffins reveal password-killer 0days for iOS and OS X

#66

Post by taeric »

w8rbt wrote: post #35

The fundamental design flaw of all of these compromised password managers, keychains, etc. is that they keep state in a file. That causes all sorts of problems (syncing among devices, file corruption, unauthorized access, tampering, backups, etc.). Edit - I seldom downvote others and the few times I do, I comment as to why I think the post was inappropriate. What is inappropriate about my post? Few people stop and th…

The fundamental problem with this idea is that the computer has to store your password somewhere, for it to be able to check it. Now, these particular passwords could be kept only on the server, but they are still kept. In a file. On a computer.

Your comment comes across as somewhat silly and akin to saying that the problem is we have to transmit the passwords (or some derivative data) across the internet to do business with someone. Yes... that is a facet of the problem. It is also a facet of how work gets done.

Re: Boffins reveal password-killer 0days for iOS and OS X

#68

Post by soylentcola »

skrowl wrote: post #28
therealmarv wrote: post #3

So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?

I'm surprised that you're surprised! After The Fappening and the SMS of doom (amongst many others), you can't still believe that Apple gives a sh*t about security, can you? I mean, I understand that there are still a lot of Apple fans here at HN, but Apple's security has been a laughing stock of the industry for a while now.

I'm far from an Apple apologist (I probably complain about them more than I praise them) but "failing to be flawless" about security is not the same thing as "not giving a shit" about security.

I've yet to see any massive platform that is both flexible and open to millions of users that has zero security flaws or exploits developed for them. Not saying it's a good thing, but it's certainly a common thing, even among companies that give several shits about security.

Re: Boffins reveal password-killer 0days for iOS and OS X

#69

Post by alimbada »

obituary_latte wrote: post #64
pilsetnieks wrote: post #42

Earlier quoted context omitted.

If this is how it works, you can check it on OS X by clicking each item in Keychain Access and looking at the Access Control tab or you can run `security dump-keychain -a` in terminal - it lists all keychain items and their access control lists. It's still a big and unwieldy list but not as bad as clicking each keychain item. Someone better at this stuff could probably think of a way to make it easier. (This would on…

>This would only show if you've been exploited already What would indicate a compromise?

If the ACL of a keychain item contains an app that isn't supposed to have access to that keychain item then that would indicate a compromise.

Re: Boffins reveal password-killer 0days for iOS and OS X

#70

Post by whoiskevin »

sigzero wrote: post #58
romanovcode wrote: post #49

Earlier quoted context omitted.

>Just like Windows. Strange thing eh? Not strange if you grasp the fact that malware is just a program that has elevated access. For me it was strange how can Apple market their system as virus-free. Now that's ridiculous.

I have never seen Apple market their system as "virus free". Can you point me to that one?

Easy. https://m.youtube.com/watch?v=GQb_Q8WRL_g
Post reply on HN