How my brother's iCloud account was stolen

Re:How my brother's iCloud account was stolen by majormajor on Monday January 16, 2023 @08:06PM (#34407872)

> The web session is untrusted, and they have a trusted connection to the OS known to belong you.

Known to belong to me, yes. Known to be in my possession, no.

You'd still need one further thing to go on as far as I can figure - I'd need the password to type into my browser first - but treating "browser session" and "machine the browser is running on" as separate levels of trust seems naive in terms of what someone who steals the machine can do.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by bryan_w on Tuesday January 17, 2023 @02:31PM (#34417441)

I don't know the exact workings, but usually the authentication popup should popup with at least 1 other factor to challenge(e.g. touchid or password) if it hasn't asked recently. That way it uses 1) something you are (touchID) and something you have (Validation from a known good device) as the 2 factors.

[ Parent | on HN ]