Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcome to the Cloud - "Your Apple ID has been disabled."

hanselman.com

Post reply on HN
Print view View original

91–100 of 109 posts

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#91

Post by sprovoost »

jsz0 wrote: post #72

How would Apple know about a new iOS device or Mac signing into your iTunes Store account? It learns of the device the first time you successfully login on the device. Besides doing some sort of pre-registration or requiring an iTunes Store ID to simply buy the device there's no easy way around that. They'd also have to end all used/third party sales of Apple products or require resellers to activate every iPad, iPod…

They could do something similar to what Facebook does: as soon as they detect a new device using your account, send an email. If the new device is not in the same country as your other devices, don't allow purchases until you've clicked on that link in your email.

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#92

Post by sprovoost »

technoslut wrote: post #70
RexRollman wrote: post #2

"We'll never see this fixed until Gruber gets the error." Awesome.

Well Gruber did give his reply to this story: http://daringfireball.net/linked/2011/08/12/itunes-account-h...

> In Hanselman’s case, though, he admits he was using PayPal, > not a credit card. Perhaps it’s therefore safer to use a > credit card instead of PayPal for iTunes Store payments?

I don't see how that makes a difference if your iTunes account is compromised. Or perhaps it's because your creditcard company is more likely than Paypal to alert you to suspicious activity?

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#93

Post by sprovoost »

Dysiode wrote: post #67
rickmb wrote: post #60

Earlier quoted context omitted.

I have a problem with most these arguments. You're suggesting that they should not have allowed the purchase. I would be highly annoyed if Apple didn't allow me to purchase from a different device. I see no reason for Apple to outright refuse this. The same goes for purchasing something like you've never purchased before. Hell, one of the commercial strengths of the App Store/iTunes concept is that it gets people to…

I don't seen the downside to verifying your account on a new device before being able to use it. If you have access to the appstore then you have access to Gmail and one simple email to say "Yeah, go ahead and let my friend's iPad buy this app on my account for 24 hours/7days/forever" is all it takes to prevent this sort of thing. > We don't implement such paranoid measures either in other web-services or in real liv…

As I mentioned in another comment, you don't have to go as far as verifying before usage (although in some cases you should), but at the very least alert the user of any new device, just like Facebook does.

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#94

Post by sprovoost »

alanh wrote: post #76
shanselman wrote: post #75

Earlier quoted context omitted.

Of course. A simple email with a confirm link would solve this.

Email to what, your @me.com email that the attacker may very well have access to?

It's a numbers game; it would help people without an @me.com account or with a secondary email address.

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#95

Post by shinratdr »

comex wrote: post #81
shinratdr wrote: post #49

Earlier quoted context omitted.

> Apple's new-device-detection algorithm doesn't seem to be perfect - I was vacationing and bought an app, and it was flagged as a new device (I got the mail for my purchase), despite it being the same one I've been using for a few years. I have had this happen with Steam countless times, it's made me hate the Steam Guard system. I have a long complex password for Steam and I don't play online so my account isn't hig…

FWIW, you can disable Steam Guard for your account in the preferences.

Thanks. I can't believe I didn't notice that.

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#96

Post by sprovoost »

It's interesting to look at the companies that are mentioned. Pearl-in-palm is based in Beijing and has been around for seven years [0]. They make games and this one gets great ratings on the English store [1].

But very bad ratings on the Japanese store [2], saying things Google translates as "Amount has been exploited to gain unauthorized access".

Based on this and on anto1ne's comment about Chinese "gift cards" [3], my guess is that the company is legit and that someone sells iTunes usernames passwords to individual gamers looking for extra points.

There's another company mentioned in these discussions: Kamagame Poker. In fact, if you Google "Kamagame poker chip" the first two hits are people on Apple forums complaining about unauthorized charges. Same phenoma as above: great reviews in the US store, bad reviews in the Japanse store.

Perhaps the Japanese are not interested in these two games, so a larger percentage of their downloads are scam related, while in the US the majority of downloads is legitimate?

So here's an opportunity for some automated detective work:

1 - scrape all applications with in app purchases

2 - scrape US and Japanese reviews

3 - look for rating differentials (and of course terms like 'fraud', 'charge')

Follow up with more manual labor:

1 - where are most of the customers of these apps? (China?)

2 - are these companies related? (I have no reason to suspect these two, but the bigger picture might look different)

[0] http://investing.businessweek.com/research/stocks/private/sn...

[1] http://itunes.apple.com/en/app/id428912410?mt=8

[2] http://itunes.apple.com/en/app/id428912410?mt=8

[3] http://news.ycombinator.com/item?id=2879423

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#97

Post by stingraycharles »

sprovoost wrote: post #91
jsz0 wrote: post #72

How would Apple know about a new iOS device or Mac signing into your iTunes Store account? It learns of the device the first time you successfully login on the device. Besides doing some sort of pre-registration or requiring an iTunes Store ID to simply buy the device there's no easy way around that. They'd also have to end all used/third party sales of Apple products or require resellers to activate every iPad, iPod…

They could do something similar to what Facebook does: as soon as they detect a new device using your account, send an email. If the new device is not in the same country as your other devices, don't allow purchases until you've clicked on that link in your email.

And don't forget to ensure that you can't change your email unless you're doing it from an authorized device. Otherwise a malicious person could just change the email address where the notification emails are going to.

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#98

Post by DannoHung »

sprovoost wrote: post #92
technoslut wrote: post #70

Earlier quoted context omitted.

Well Gruber did give his reply to this story: http://daringfireball.net/linked/2011/08/12/itunes-account-h...

> In Hanselman’s case, though, he admits he was using PayPal, > not a credit card. Perhaps it’s therefore safer to use a > credit card instead of PayPal for iTunes Store payments? I don't see how that makes a difference if your iTunes account is compromised. Or perhaps it's because your creditcard company is more likely than Paypal to alert you to suspicious activity?

He's just saying that there's an extra authentication step. Which wouldn't do him jack-all if he had a keylogger on his computer.

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#99

Post by DannoHung »

I'm confused about something here: This guy gets an email about his account being accessed illegally, and the email's got some problems with it in how it presents the info, okay, sure, Apple should get right on it.

Then we jump to some stuff about his AppleID being disabled? What?

Re: Welcome to the Cloud - "Your Apple ID has been disabled."

#100

Post by codeglomeration »

eropple wrote: post #69
rickmb wrote: post #60

Earlier quoted context omitted.

I have a problem with most these arguments. You're suggesting that they should not have allowed the purchase. I would be highly annoyed if Apple didn't allow me to purchase from a different device. I see no reason for Apple to outright refuse this. The same goes for purchasing something like you've never purchased before. Hell, one of the commercial strengths of the App Store/iTunes concept is that it gets people to…

We don't implement such paranoid measures either in other web-services Yes "we" do. Steam doesn't let you authenticate, let alone buy stuff, from a new computer without entering a code that they'll email to you. Takes all of ten seconds--start up Steam, go to my email client, paste the code in, done. And it works great. So what's the complaint?

Oh man, I've tried numerous time to buy something using Steam and was never able. If you have a card issued in a country and you are traveling abroad, good luck making a purchase. Even if you change the billing address registered with the credit card to the same country you're traveling to and making a purchase from, it won't go through.

I would not give Steam as an example of a successful payment system implementation.

Post reply on HN