iOS Privacy: Easily get a user's Apple ID password, just by asking

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by EGreg on Tuesday October 10, 2017 @09:52AM (#15441752)

I wrote this email to [email protected] back in 2011. Never heard back :-/

Dear Steve,

There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password.

I wanted to write and suggest an easy fix, that would make the next version of MacOS and iOS much more secure. Why not have the users set a personal phrase, that MacOS will store and show them in every native MacOS dialog, to prove that it's really coming from MacOS? Of course, you'd have to prevent apps from screen-capturing that portion of the screen for the entire time the dialog is up, and capturing the keystrokes that are being sent to the dialog, but that shouldn't be too much of a problem. You can do something similar for the iPhone.

I really hope this finds its way into MacOS. After MacOS X came out I switched from the PC and haven't looked back. It's awesome.

Sincerely, Greg ...

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by ballenf on Tuesday October 10, 2017 @10:42AM (#15442187)

Prescient of you!

Although I’m skeptical that users will really be alerted by the absence of a thing. The users I work with wouldn’t. But I would prefer it.

The inability to use the home button on the dialogues has become second nature to me out of healthy distrust/ paranoia.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by EGreg on Tuesday October 10, 2017 @10:45AM (#15442207)

I guess since writing that email, I would have preferred the option of taking a photo (and not storing it anywhere except here). You get used to system dialogs "looking like this" with the photo. If something is wrong, most humans pick it up easily. Only for blind users do you need the text.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by jclardy on Tuesday October 10, 2017 @11:11AM (#15442438)

With the hundreds of password dialogs that you get in iOS for various reasons, I think people would catch on pretty quickly to a new secure variant.

Yeah, some people wouldn't, but that isn't a reason to leave it with the terrible implementation they have now. This has annoyed me since forever on iOS.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by IshKebab on Tuesday October 10, 2017 @12:08PM (#15442928)

I mean this flaw has been known for years. How long have we been pressing ctrl-alt-delete to log in to Windows?

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by jsjohnst on Tuesday October 10, 2017 @10:30AM (#15442062)

Man I wish this had been seen and acted on! Would be an excellent feature (and one I’ve thought of myself before).

[ Parent | on HN ]