iOS Privacy: Easily get a user's Apple ID password, just by asking

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by djrogers on Tuesday October 10, 2017 @11:39AM (#15442688)

> IMO, the iTunes password should be eliminated entirely.

Whoa whoa whoa - hold on there. Your ‘iTunes password’ protects purchases in the App Store and iTunes media stores, access to the iCloud website, your iCloud email, iMessages, app data such as notes and contacts, third party app data, and freaking backups of your entire device.

What exactly would you suggest Apple do to eliminate that account? You might as well say that google should eliminate their gmail passwords, or that Dropbox should eliminate the account password.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by e12e on Tuesday October 10, 2017 @12:41PM (#15443216)

Some of those could be handled by the device password (although apple might have dug themselves a hole with touch I'd there) - the other with an one time password generator whose secret was available to trusted ios devices? For Apple services, that might even be simplified to a callback system; mail app on desktop shows a token "bushy eyebrows", ios auth app display the token "busy eyebrows" and a login/cancel prompt. The actual auth can be done in a challenge - response fashion between the service and the ios device. Another use for the Apple watch...

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by dawnerd on Tuesday October 10, 2017 @04:00PM (#15444887)

Should just be handled by icloud instead of iTunes, even though these days it's the same thing

[ Parent | on HN ]