Zero-day in Sign in with Apple • Hacker News Board

Re: Zero-day in Sign in with Apple

#31

Post by cdubzzz » Sat, May 30, 2020, 4:56 PM UTC

oauea wrote: post #24

toomuchtodo wrote: post #21

Earlier quoted context omitted.

I still trust Apple over a rando site or SaaS app. No system is flawless.

Fortunately some rando site or SaaS app doesn't have the leverage to force me to implement additional garbage! Apple does, and did. I'm still surprised that this didn't trigger an antitrust investigation like when Microsoft abused their monopoly to push internet explorer. This is exactly the same thing, if not worse.

I agree that the requirement from Apple here is kind of dumb, but I don’t see how it would not be in the best interest of a user of an app on an iOS device to have the option to sign in with an Apple ID. It also seems silly to consider it “garbage” when you already using a Google Account solution that is essentially the same thing.

Re: Zero-day in Sign in with Apple

#32

Post by zemnmez » Sat, May 30, 2020, 4:58 PM UTC

phamilton wrote: post #22

> The Sign in with Apple works similarly to OAuth 2.0. > similarly I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. > $100,000 That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore…

> I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move.

The token described in this disclosure is an OpenID Connect 1.0 Token. OIDC is a state of the art AuthN protocol that supersets OAuth with additional security controls. It's used by Google, Facebook and Twitch amongst others.

I'd do more analysis, but the author leaves off the most important part here (not sure why)

https://openid.net/specs/openid-connect-core-1_0.html#IDToke...

Re: Zero-day in Sign in with Apple

#33

Post by xkcd-sucks » Sat, May 30, 2020, 5:00 PM UTC

awinter-py wrote: post #15

my brain mis-parsed as: (sign in) with (apple zero day) which is kind of appealing

If Apple launched a product called Apple Zero Day - like haveibeenpwned maybe - Then the top search results for apple exploits would be an advertisement :)

Re: Zero-day in Sign in with Apple

#34

Post by kennywinker » Sat, May 30, 2020, 5:01 PM UTC

j4yav wrote: post #27

toomuchtodo wrote: post #21

Earlier quoted context omitted.

I still trust Apple over a rando site or SaaS app. No system is flawless.

I think I trust Apple over a random website too, but was adding an additional kind of sign in and forcing everyone to use it even needed in the first place?

Almost like apple and google have dangerously monopolistic positions in the mobile sphere and we need meaningful anti-trust action to claw back user freedom and choice?

Re: Zero-day in Sign in with Apple

#35

Post by xwes » Sat, May 30, 2020, 5:03 PM UTC

awinter-py wrote: post #15

my brain mis-parsed as: (sign in) with (apple zero day) which is kind of appealing

I'm not sure that's a mis-parse. Anyone could sign in with the Apple zero day.

Re: Zero-day in Sign in with Apple

#36

Post by alwillis » Sat, May 30, 2020, 5:04 PM UTC

oauea wrote: post #24

toomuchtodo wrote: post #21

Earlier quoted context omitted.

I still trust Apple over a rando site or SaaS app. No system is flawless.

Fortunately some rando site or SaaS app doesn't have the leverage to force me to implement additional garbage! Apple does, and did. I'm still surprised that this didn't trigger an antitrust investigation like when Microsoft abused their monopoly to push internet explorer. This is exactly the same thing, if not worse.

I'm still surprised that this didn't trigger an antitrust investigation like when Microsoft abused their monopoly to push internet explorer. This is exactly the same thing, if not worse.

Um… no.

Microsoft gave Internet Explorer away for free when Netscape was selling their browser to businesses, an obvious attempt to undermine Netscape.

They also threatened to cancel the Windows 95 licenses for companies like HP that shipped Netscape with their computers instead of Internet Explorer. That would have essentially put them out of business.

Because Microsoft had 95% of the operating system market share, it had signed a decent decree with the federal government that they wouldn’t use their monopoly in operating systems to their advantage in web browsers, which were a new software category then.

So of course, they bundled Internet Explorer with Windows 95 and claim they couldn't be separated, an obvious lie, claiming Internet Explorer was a critical part of the operating system.

All of this orchestrated by future humanitarian Bill Gates, who was quoted as saying then Microsoft needed to “cut off Netscape’s air supply.”

Even in the United States, Apple isn’t a monopoly with about 40% market share. Everything Apple mandates is with companies who've contractually agreed to be part of Apple's developer program and abide by its rules.

Nobody agreed to not ship a competing web browser back in the day.

Re: Zero-day in Sign in with Apple

#37

Post by buboard » Sat, May 30, 2020, 5:04 PM UTC

toomuchtodo wrote: post #21

oauea wrote: post #17

Wow, I'm so glad that apple forced me to implement this broken garbage into my apps! For those not aware, some time ago apple decided it would be a good idea to develop their own sing in system, and then force all apps on their store (that already support e.g. Google Account login) to implement it. So they brought a huge amount of additional complexity in a large amount of apps, and then they fucked up security. Than…

I still trust Apple over a rando site or SaaS app. No system is flawless.

OTOH, rando SaaS flaws don't compromise the security of billions

Re: Zero-day in Sign in with Apple

#38

Post by gruez » Sat, May 30, 2020, 5:04 PM UTC

Is it me or is this writeup low on details? There are a couple of commenters saying that this is a great writeup, but all it amounts to is:

1. what sign in with apple is

2. sign in with apple is like oauth2

3. there's some bug (not explained) that allows JWTs to be generated for arbitrary emails

4. this bug is bad because you can impersonate anyone with it

5. I got paid $100k for it

Re: Zero-day in Sign in with Apple

#39

Post by cheez » Sat, May 30, 2020, 5:04 PM UTC

gruez wrote: post #38

Is it me or is this writeup low on details? There are a couple of commenters saying that this is a great writeup, but all it amounts to is: 1. what sign in with apple is 2. sign in with apple is like oauth2 3. there's some bug (not explained) that allows JWTs to be generated for arbitrary emails 4. this bug is bad because you can impersonate anyone with it 5. I got paid $100k for it

it's literally that simple.

Re: Zero-day in Sign in with Apple

#40

Post by saagarjha » Sat, May 30, 2020, 5:06 PM UTC

NicoJuicy wrote: post #30

Perhaps slightly related that finding Apple zero days was less bounty award than finding Android zero days. I think we can wrap up the security and anonymous part that Apple has been claiming for their overpriced devices.

Wrong exploit target.