Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day in Sign in with Apple

bhavukjain.com

Post reply on HN
Print view View original

271–280 of 280 posts

Re: Zero-day in Sign in with Apple

#271

Post by NightlyDev »

summerlight wrote: post #244

After observing its endless flow of security and reliability bugs, I begin to think that the recent decline of Apple's overall software quality over the several years is probably a more of systematic problem. https://www.bloomberg.com/news/articles/2019-11-21/apple-ios... Looks like Federighi agrees with this diagnosis and tries to improve the overall development process but not sure if it can be really improved with…

"At the level of Apple's software complexity"

This defenitly wasn't complex in any shape or form. This was very basic.

Re: Zero-day in Sign in with Apple

#272

Post by IncRnd »

solveit wrote: post #269
IncRnd wrote: post #268

Earlier quoted context omitted.

The idiom that I mentioned is still true, whether you discuss circumstantial or direct evidence. Lack of Evidence isn't Evidence of Lack.

Lack of evidence is always weak evidence for evidence of lack, and pretty strong evidence if you've looked hard enough. If you've trawled through loch Ness with a fine toothed comb for decades and haven't seen Nessie, well then that's pretty good evidence for lack of monster.

You're confusing correlation with causation. Regarding your point about searching - Have you ever lost your keys, searched for a long time without finding them, then found them by happenstance at a later point when not looking? Lack of evidence is not evidence of lack.

Re: Zero-day in Sign in with Apple

#273

Post by danans »

capableweb wrote: post #248
danans wrote: post #166

Earlier quoted context omitted.

There's no reason that a fuzzer couldn't draw sample email addresses from a large pool of test valid email addresses to add as input. That would just require a fuzzer that allowed you to provide the sample population for a particular data type.

My point still stands. If the one setting up the fuzzer is thinking about the condition that A) you're using a valid email that B) already existing in the system and C) cannot be used to authenticate with another system, you can easily check the code for this directly. The fuzzer won't add anything over a simple integration/E2E test here.

Fair point! The question I have then is whether it's possible to create a tool that automatically detects bugs like this without needing to write an integration test for this specific cases.

Re: Zero-day in Sign in with Apple

#274

Post by solveit »

IncRnd wrote: post #272
solveit wrote: post #269

Earlier quoted context omitted.

Lack of evidence is always weak evidence for evidence of lack, and pretty strong evidence if you've looked hard enough. If you've trawled through loch Ness with a fine toothed comb for decades and haven't seen Nessie, well then that's pretty good evidence for lack of monster.

You're confusing correlation with causation. Regarding your point about searching - Have you ever lost your keys, searched for a long time without finding them, then found them by happenstance at a later point when not looking? Lack of evidence is not evidence of lack.

I am saying your definition of evidence is overly strict and at odds with both how we use the term in common speech and with what is useful. My definition of evidence for A is an observation B such that P(A|B)>P(A), and with this definition, lack of evidence most certainly is evidence of lack.

Re: Zero-day in Sign in with Apple

#275

Post by IncRnd »

solveit wrote: post #274
IncRnd wrote: post #272

Earlier quoted context omitted.

You're confusing correlation with causation. Regarding your point about searching - Have you ever lost your keys, searched for a long time without finding them, then found them by happenstance at a later point when not looking? Lack of evidence is not evidence of lack.

I am saying your definition of evidence is overly strict and at odds with both how we use the term in common speech and with what is useful. My definition of evidence for A is an observation B such that P(A|B)>P(A), and with this definition, lack of evidence most certainly is evidence of lack.

Yes, I understand what you mean. You are confusing your particular experiences with the common speech of everyone, which is a logical fallacy.

You can read about the cultural and traditional idiom I wrote at the wikipedia page for "Evidence of Absence" where the first paragraph mentions, "Per the traditional aphorism, 'Absence of evidence is not evidence of absence,' positive evidence of this kind is distinct from a lack of evidence or ignorance[1] of that which should have been found already, had it existed."

There is further information in the wikipedia page for "Argument from ignorance" that shows why your use of evidence is also a logical fallacy. You can infer from indirect evidence, but that doesn't prove a fact.

While indirect evidence may lead one to to believe a fact has been proven, that is not what happens. You can read some of the legal ramifications of using indirect, inferential, or circumstantial evidence to convict beyond a reasonable doubt at https://www.legalzoom.com/articles/why-cant-some-juries-conv....

Re: Zero-day in Sign in with Apple

#276

Post by geekit »

There are few other issues with how websites implemented it. For example, at work, appleid or few apple domains are banned (they wanted to ban iTunes streaming etc.) when I tried to login into Pocket (Read It Later) [Web Version], due to this blocking, the whole login form get hidden once page load complete, and I cannot even login with my username and password.

Re: Zero-day in Sign in with Apple

#277

Post by jiveturkey »

mlthoughts2018 wrote: post #116
drivebycomment wrote: post #80

Earlier quoted context omitted.

The one case (and about the only case) I can think of where they can claim above is: If they have a log of all JWTs issued that records which user requested and which email in JWT, then they can retroactively check if they issued any (user, email) pair that they shouldn't have. Then they can assert that there was no misuse, if they only found this researcher's attempt.

How could you prove the user was the correct user in any given case?

They are the issuer. it's trivial.

Re: Zero-day in Sign in with Apple

#278

Post by homakov »

Does it rely on a service to log you in with same email that you provide? Because normally services don’t do that. They suggest you to attach new apple account to old account with that email, but allowing outright logging in would be very bad practice.

Re: Zero-day in Sign in with Apple

#279

Post by homakov »

Ronnie76er wrote: post #158

Just want to mention something about the id_token provided. I'm on my phone, so I don't have apples implementation handy, but in OIDC, the relying party (Spotify for example) is supposed to use the id_token to verify the user that is authenticated, specifically the sub claim in the jwt id_token. https://openid.net/specs/openid-connect-core-1_0-final.html#... It's likely (although like others have noted, this is scant…

true, email shouldnt be used when you can identify by unique id. I doubt the bug was even exploitable with most apps. Apple just paid magnitudes more than its severity.

Re: Zero-day in Sign in with Apple

#280

Post by [deleted] »

Ronnie76er wrote: post #158

Just want to mention something about the id_token provided. I'm on my phone, so I don't have apples implementation handy, but in OIDC, the relying party (Spotify for example) is supposed to use the id_token to verify the user that is authenticated, specifically the sub claim in the jwt id_token. https://openid.net/specs/openid-connect-core-1_0-final.html#... It's likely (although like others have noted, this is scant…

[deleted]
Post reply on HN