News for hackers. Stuff that matters.

A comment on Zero-day in Sign in with Apple. Parent comment

Re:Zero-day in Sign in with Apple by meowface on Saturday May 30, 2020 @03:02PM (#23363686)
You can't forget the infamous "goto fail": https://www.imperialviolet.org/2014/02/22/applebug.html

There seems to be kind of a common theme to these:

- SSL certificates not validated at all

- root authentication not validated at all

- JWT token creation for arbitrary Apple ID users not validated at all

I think these are all very likely due to error and not malice, but it's pretty crazy how these gaping holes keep being found.

[ Parent | on HN ]

There are no comments on this comment yet.