4 ms·
I really do respect Apple's attention to security and privacy, however I was a little disappointed when I came across an Apple ID leak from their login form [0]
by zaytoun 10y ago
I really do respect Apple's attention to security and privacy, however I was a little disappointed when I came across an Apple ID leak from their login form [0] last week. They patched a fix a couple days after I reported it, but still haven't responded to my initial report. It's quite concerning given how easy this simple flaw could have been used for malicious purposes to potentially collect millions of Apple ID's.
[0] https://github.com/zaytoun/Apple-ID-Data-Leak https://github.com/zaytoun/Apple-ID-Data-Leak
- chatmasta 10y agoThat looks like extremely irresponsible disclosure? Publishing to GitHub and then "edit: I contacted apple" ????
- deleted 10y ago[deleted]
- sillysaurus3 10y agoThere's nothing wrong with disclosing a security bug immediately. https://hn.algolia.com/?query=author:tptacek%20responsible%20disclosure%20&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:tptacek%20responsible%2...
- SamReidHughes 10y agoA list of Apple ID's isn't exactly a big deal. I've got mine listed in my HN profile.
- eridius 10y agoAnd what exactly would you do with those Apple IDs? Just knowing the email address doesn't really get you very far.
- Buge 10y agoYou could spam them. Anyways, it's a privacy violation. Apple shouldn't be handing out your email without your permission. Facebook has a setting allowing you to choose whether you want your email to be public or not.
- eridius 10y agoSure, you could spam them, but that's not a special property of Apple IDs. Apple certainly shouldn't be leaking emails, but describing this as "leaking Apple IDs" instead of "leaking emails" makes it sound like it's more serious than it is.
- obstinate 10y agoLiterally every company is going to have some non-zero number of security leaks. I don't think it's reasonable to be disappointed in an entire company because of a bug written by (likely) one engineer. God knows I've written my share, but none of my software is on routes easily accessible to the public. Unless it's part of a larger pattern, this reaction is going to lead to you being disappointed with 100% of producers of software, past, present, and future, which doesn't seem like a useful state. Incidentally, in the list of IDs you published, are those real? If they are: that's BS that you are publishing real people's IDs, and I'm also surprised by the number of numeric qq.com accounts.
- Gaelan 10y agoIirc, QQ uses a number as the "username," sort of like a phone number.