News for hackers. Stuff that matters.

A comment on iOS Privacy: Easily get a user's Apple ID password, just by asking. Parent comment

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by simias on Tuesday October 10, 2017 @10:08AM (#15441864)
That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an unprivileged app or website.

The equivalent scenario with sudo would be to have a website display a mock terminal asking for sudo password, although that would be a lot harder to do inconspicuously because I don't expect terminal windows to pop out of the blue. It's also the reason why browser notify you when a page wants to go fullscreen.

I think the right solution to this problem is simply not to have privileged system UI elements drawn in a way that can be mimicked by a regular app or website. LastPass made a similar mistake: https://github.com/cxxr/lostpass

I don't have an iphone so I'm not sure what would be the right way to deal with that. AFAIK apps can draw to the entire screen surface so it sounds tricky to avoid.

[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by dEnigma on Tuesday October 10, 2017 @10:36AM (#15442115)
Maybe the actual password dialogue could contain some kind of visual code, like the one on paper money. Then the OS could detect when a fake password input is shown to the user, just like copy machines detect it when you put a bank note in the scanner.
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by amelius on Tuesday October 10, 2017 @10:31AM (#15442071)
> That's slightly different though, in order to do this you need to have shell access on the target's computer.

But I suppose any application can write to the current user's .bashrc file right? Then it can also set the alias whenever the user opens a terminal.

[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by simias on Tuesday October 10, 2017 @11:13AM (#15442448)
I don't think running a native application on a desktop is similar to running a sandboxed app on iOS. The security implication is wildly different IMO. I think a webapp is a more apt comparison.
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by vortico on Tuesday October 10, 2017 @10:53AM (#15442272)
That's what shell access means. Running a program = access to system() and thus shell access.
[ Parent | on HN ]