iOS Privacy: Easily get a user's Apple ID password, just by asking

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by Splines on Tuesday October 10, 2017 @01:12PM (#15443496)

I've seen this at banks that do something similar (and it's probably for this reason). They include a user-selected picture at logon, so if you see the wrong picture, you know that their logon page is being spoofed.

I have no idea of the feasibility of locking down some piece of user data such that the OS can display it for privileged access, but random apps cannot, but this seems like a reasonable solution. Include some user selected word or picture in the title bar of the settings dialog so that users know its the real one.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by krallja on Tuesday October 10, 2017 @03:50PM (#15444813)

Those pictures can easily be proxies by a spoofer, so I don't see the point of them.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by kibwen on Tuesday October 10, 2017 @06:21PM (#15445815)

Those pictures are indeed useless when used by banks, since they do nothing against MITM. But for the attack described in the OP they would actually be a reasonable defense, since this sort of indiscriminate low-privilege phishing can't intercept requests between the user and the system in order to determine the secret image.

[ Parent | on HN ]