10 ms·
I'm surprised that nobody mentioned how big of a target this is for the criminal enterprise. Gaining unauthorized access to someone's account through this porta
by mirkules 8y ago
I'm surprised that nobody mentioned how big of a target this is for the criminal enterprise. Gaining unauthorized access to someone's account through this portal would be a gold mine, even better than iCloud alone.
- lmpostor 8y agoLmao my first thought
- epicide 8y agoThey mention they use the seven day period "to verify that the request was made by you". I am very curious as to what that includes.
- Gaelan 8y agoIf nothing else, that’s plenty of time for the real user to see the email notification and complain.
- sdegutis 8y agoSure but if a malicious user is going to request access to someone's iCloud, they can probably also access their emails and delete this one. Reminds me of how when I sign into my Gmail from another computer, it sends me an email saying "alert! someone signed in from this computer!" which I could immediately delete if I was a hacker. Seems useless to me.
- glhaynes 8y agoMany (I'd guess most, but I have nothing but anecdotal experience to base it on) people have a non-Apple-hosted email account tied to their Apple ID. Sure, in some cases if someone's iCloud account is compromised, their non-Apple email account is compromised, too, but in plenty they aren't.
- 14 8y agoUseless in most cases but at one point I did have emails set to come up on my iPhone's lock screen and such an email would have popped up immediately.
- pathseeker 8y agoThat's why you setup and alternate email in your google account. It also sends the same alert to your alternate.
- the_mitsuhiko 8y agoIf it’s the same they do in the EU: 2FA, notification by email, 7 day cooloff period and download link via mail.
- epicide 8y agoProbably. The particular wording makes it sound like there might be more to the 7 day thing than just a cooloff period. Not sure what that would even be, really.
- the_mitsuhiko 8y agoThe way my supermarket did it is mail an archive by email and the decryption key as signature required in snail mail to my stored physical address.
- Operyl 8y agoWait .. your supermarket did that? That’s .. pretty impressive, but now I want to know what exactly your supermarket had on you (assuming you had some sort of loyalty card they tracked you with).
- the_mitsuhiko 8y agoPurchase history for two years and classification of what I buy. Yes, loyalty scheme.
- Operyl 8y agoAnything other than that? Sounds super interesting, glad to see a place get it right :).
- androidgirl 8y agoThat's really cool honestly. Which supermarket was this?
- yashap 8y agoOn top of what was already mentioned, this could also help with unexpected vulnerabilities. Like say a vulnerability is discovered where you can request someone else’s data - as long as they notice the vulnerability within 7 days, they can shut things down before there’s a data breach.
- irrational 8y agoI just tried it. Someone would need my apple id, my password, access to one of my apple devices (I had to enter a code that appeared on one of my devices), and access to my email. If someone already has all of that, I'm hosed no matter what.
- sambe 8y agoUnless there is a weakness in that authentication.
- ash_gti 8y agoThen they would have access to my iTunes account anyway...
- alttab 8y agoBut then they can easily exfiltrate, which would allow it to happen programmatically and in mass.
- irrational 8y agoWhich authentication? My password manager authentication? My email authentication? My apple device authentication?
- acqq 8y ago
- Antrikshy 8y agoPerhaps. Note that it's not unprecedented. Google, and likely others, offer a similar service: https://support.google.com/accounts/answer/3024190?hl=en https://support.google.com/accounts/answer/3024190?hl=en