21–30 of 280 posts
Wow, I'm so glad that apple forced me to implement this broken garbage into my apps! For those not aware, some time ago apple decided it would be a good idea to develop their own sing in system, and then force all apps on their store (that already support e.g. Google Account login) to implement it. So they brought a huge amount of additional complexity in a large amount of apps, and then they fucked up security. Than…
> similarly
I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move.
> $100,000
That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore (e.g. "Any submissions related to new feature X will automatically be considered High severity for the next two weeks"). Getting some eyeballs on it while we're wrapping up QA means we're better prepared for public launch.
This particular bug is fairly run-of-the-mill for an experienced researcher to find. The vast majority of bug bounty submissions I see are simple "replay requests but change IDs/emails/etc". This absolutely would have been caught in a pre-release bounty program.
> The Sign in with Apple works similarly to OAuth 2.0. > similarly I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. > $100,000 That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore…
Wow, I'm so glad that apple forced me to implement this broken garbage into my apps! For those not aware, some time ago apple decided it would be a good idea to develop their own sing in system, and then force all apps on their store (that already support e.g. Google Account login) to implement it. So they brought a huge amount of additional complexity in a large amount of apps, and then they fucked up security. Than…
I still trust Apple over a rando site or SaaS app. No system is flawless.
my brain mis-parsed as: (sign in) with (apple zero day) which is kind of appealing
Earlier quoted context omitted.
I still trust Apple over a rando site or SaaS app. No system is flawless.
Fortunately some rando site or SaaS app doesn't have the leverage to force me to implement additional garbage! Apple does, and did. I'm still surprised that this didn't trigger an antitrust investigation like when Microsoft abused their monopoly to push internet explorer. This is exactly the same thing, if not worse.
Wow, I'm so glad that apple forced me to implement this broken garbage into my apps! For those not aware, some time ago apple decided it would be a good idea to develop their own sing in system, and then force all apps on their store (that already support e.g. Google Account login) to implement it. So they brought a huge amount of additional complexity in a large amount of apps, and then they fucked up security. Than…
I still trust Apple over a rando site or SaaS app. No system is flawless.
my brain mis-parsed as: (sign in) with (apple zero day) which is kind of appealing
> I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account. Great writeup there. Looks like a Apple JWT bug and the verification went through despite it being 'signed' and 'tamperproof'. Clearly its footgun…
I think we can wrap up the security and anonymous part that Apple has been claiming for their overpriced devices.