Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day in Sign in with Apple

bhavukjain.com

Post reply on HN
Print view View original

261–270 of 280 posts

Re: Zero-day in Sign in with Apple

#261

Post by IncRnd »

emn13 wrote: post #249
IncRnd wrote: post #232

Earlier quoted context omitted.

Exactly. Lack of evidence is not evidence of lack.

Well, depending on how hard you look and what the false negative rate is like, bayesian reasoning would like to differ. You know what I love about the internet? You think something like this, and you just know somebody's looked into it in some details :D - https://cocosci.princeton.edu/papers/absentData.pdf

Inference isn't evidence. Inference is drawn from evidence and is an educated guess. A guess is not evidence. You fell for the clickbait headline of a pdf.

Re: Zero-day in Sign in with Apple

#262

Post by neop1x »

VMisTheWay wrote: post #130
Jaxkr wrote: post #79

Earlier quoted context omitted.

Apple has really lost their touch, software quality has declined dramatically

I'm not sure if Apple ever had quality. They are the Nintendo of Computing. They have some novelties, but in general they are average at their best. Notice that both Nintendo and Apple are big advertisers.

It is more fashion than technology. Like ordinary clothes from famous brands. Expensive, praised yet nothing special.

Re: Zero-day in Sign in with Apple

#264

Post by solveit »

IncRnd wrote: post #261
emn13 wrote: post #249

Earlier quoted context omitted.

Well, depending on how hard you look and what the false negative rate is like, bayesian reasoning would like to differ. You know what I love about the internet? You think something like this, and you just know somebody's looked into it in some details :D - https://cocosci.princeton.edu/papers/absentData.pdf

Inference isn't evidence. Inference is drawn from evidence and is an educated guess. A guess is not evidence. You fell for the clickbait headline of a pdf.

Evidence isn't absolute proof and there are degrees of evidence. See: Weak evidence, strong evidence.

Re: Zero-day in Sign in with Apple

#265

Post by derangedHorse »

zemnmez wrote: post #32
phamilton wrote: post #22

> The Sign in with Apple works similarly to OAuth 2.0. > similarly I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. > $100,000 That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore…

> I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. The token described in this disclosure is an OpenID Connect 1.0 Token. OIDC is a state of the art AuthN protocol that supersets OAuth with additional security controls. It's used by Google, Facebook and Twitch amongst others. I'd do more analysis, but the author leaves off the most important part here (not sure why) ht…

There is no endpoint in the OIDC spec that allows token creation aside from the redirect after login (implicit flow) and the token endpoint though. I don't imagine this vulnerability could've happened at either endpoint, but I could be wrong. I'll definitely be looking into how Apple implements things before I use their login for any of my own applications

Re: Zero-day in Sign in with Apple

#266

Post by [deleted] »

solveit wrote: post #264
IncRnd wrote: post #261

Earlier quoted context omitted.

Inference isn't evidence. Inference is drawn from evidence and is an educated guess. A guess is not evidence. You fell for the clickbait headline of a pdf.

Evidence isn't absolute proof and there are degrees of evidence. See: Weak evidence, strong evidence.

[deleted]

Re: Zero-day in Sign in with Apple

#267

Post by [deleted] »

solveit wrote: post #264
IncRnd wrote: post #261

Earlier quoted context omitted.

Inference isn't evidence. Inference is drawn from evidence and is an educated guess. A guess is not evidence. You fell for the clickbait headline of a pdf.

Evidence isn't absolute proof and there are degrees of evidence. See: Weak evidence, strong evidence.

[deleted]

Re: Zero-day in Sign in with Apple

#268

Post by IncRnd »

solveit wrote: post #264
IncRnd wrote: post #261

Earlier quoted context omitted.

Inference isn't evidence. Inference is drawn from evidence and is an educated guess. A guess is not evidence. You fell for the clickbait headline of a pdf.

Evidence isn't absolute proof and there are degrees of evidence. See: Weak evidence, strong evidence.

The idiom that I mentioned is still true, whether you discuss circumstantial or direct evidence. Lack of Evidence isn't Evidence of Lack.

Re: Zero-day in Sign in with Apple

#269

Post by solveit »

IncRnd wrote: post #268
solveit wrote: post #264

Earlier quoted context omitted.

Evidence isn't absolute proof and there are degrees of evidence. See: Weak evidence, strong evidence.

The idiom that I mentioned is still true, whether you discuss circumstantial or direct evidence. Lack of Evidence isn't Evidence of Lack.

Lack of evidence is always weak evidence for evidence of lack, and pretty strong evidence if you've looked hard enough. If you've trawled through loch Ness with a fine toothed comb for decades and haven't seen Nessie, well then that's pretty good evidence for lack of monster.

Re: Zero-day in Sign in with Apple

#270

Post by NightlyDev »

I'm still dreaming about a world where OpenID is the norm. Just think if Apple forced all apps to use that instead, that would be a great move for privacy and security.

But no. Instead they make more proprietary shit without having the basic skills to do so. Then they force that shit on their users.

Post reply on HN