Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AppleID password brute force proof-of-concept

github.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: AppleID password brute force proof-of-concept

#71

Post by hraedon »

Tloewald wrote: post #67
zyxley wrote: post #51

Earlier quoted context omitted.

I've found this to work pretty well in most cases, but there are some websites that don't semantically mark up their fields in a way the browser can recognize, and there's no way to manually trigger the password suggestion feature.

Worse, many sites -- notably banking sites -- reject secure passwords (no weird characters, no long passwords)

One of my credit cards requires a password no longer than 16 characters, no spaces, no special characters. They're only a few more restrictions away from just requiring that it be a significant birthday or something similar.

Re: AppleID password brute force proof-of-concept

#72

Post by andrewchambers »

crocowhile wrote: post #12
andrewchambers wrote: post #10

Dictionary attacks are incredibly effective. Humans have a hard time coming up with unique passwords.

They are also quite easy to prevent, though.

They are, but the average granny or non tech person doesn't care enough.

Re: AppleID password brute force proof-of-concept

#74

Post by stusmall »

Tloewald wrote: post #67
zyxley wrote: post #51

Earlier quoted context omitted.

I've found this to work pretty well in most cases, but there are some websites that don't semantically mark up their fields in a way the browser can recognize, and there's no way to manually trigger the password suggestion feature.

Worse, many sites -- notably banking sites -- reject secure passwords (no weird characters, no long passwords)

What is worse than rejecting is I know of one major site that would, at least used to, silently truncate long passwords. That was... frustrating.

Re: AppleID password brute force proof-of-concept

#75

Post by joshschreuder »

eknkc wrote: post #3

Weird that this surfaces right after the celebrity photo leak eveyone attributes to an iCloud breach..

Currently the rumour is that the photo leak is an underground celeb photo sharing ring, where you use photos you've hacked to get access to more photos, and isn't limited to iCloud / Apple, but who knows.

Re: AppleID password brute force proof-of-concept

#76

Post by cynwoody »

stusmall wrote: post #74
Tloewald wrote: post #67

Earlier quoted context omitted.

Worse, many sites -- notably banking sites -- reject secure passwords (no weird characters, no long passwords)

What is worse than rejecting is I know of one major site that would, at least used to, silently truncate long passwords. That was... frustrating.

I used to have an ATM card with an 8-digit PIN. When entering the PIN, I noticed the screen would flash after the fourth digit. Subsequently, I discovered I actually only needed to enter the first four. That continued until the bank got taken over by Bank of America in 2004. Suddenly, I needed to enter the whole PIN!

Re: AppleID password brute force proof-of-concept

#77

Post by stephenr »

zyxley wrote: post #51
stephenr wrote: post #26

Earlier quoted context omitted.

Safari on OSX & iOS does do random password suggestions, out of the box.

I've found this to work pretty well in most cases, but there are some websites that don't semantically mark up their fields in a way the browser can recognize, and there's no way to manually trigger the password suggestion feature.

I think generally all it needs is a password field.

My Thai business banking system is paranoid and disables autocomplete, paste, etc, even with the security of a physical token), but the one that really annoys me is things like Basecamp - I had to futz around and disable JavaScript for a login to be recognised and prompt to save a password - by default it does an XHR which doesn't trigger the "save password" prompt.

Re: AppleID password brute force proof-of-concept

#78

Post by nikcub »

Quarrelsome wrote: post #46
IBM wrote: post #42

Earlier quoted context omitted.

@nikcub seems to think it wasn't this. https://twitter.com/nikcub/status/506421890517200896

he's assuming from when the tool was released. The exploit was in the wild for much longer.

i'm watching them continue to attempt to hack new accounts on a forum, so whatever apple patched with this bug wasn't it.

Re: AppleID password brute force proof-of-concept

#79

Post by iPhoneunlockpro »

I solve the problem whit bypass iCloud activation screen lock on my iPhone from Apple . Hakers hack it !!! This bypass iCloud software is available on this page : www.bypassicloudactivationlock.net . This is a survey page , so for downloading the tool I must compleate a survey ( I download Flash player before the tool ) . Nice job hackers. Great work ...
Post reply on HN