3 ms·

You keep repeating yourself and missing the point, which is: no, it does not matter and does not change the overall security of pretty much all users. It is sim

You keep repeating yourself and missing the point, which is: no, it does not matter and does not change the overall security of pretty much all users. It is simply not within the threat model. Unless you have to consider a technically advanced adversary or highly automated attacks, it's simply still not relevant. None of the iOS related things apply to the download portal, and none of the intercept/local access exploits apply to normal users.

acqq 8y ago
> it's simply still not relevant It is absolutely relevant for this very thread: it disproves the initial claim in the thread that the attacker would need “device, passcode and appleid password”. The article proves that the third (appleid password) is not needed (that was the main topic of the article) and you never demontrated anything else. I don’t care for other kinds of relevance or irrelevance as they never were never claimed by me.
- oneplane 8y ago
  If you want to scope the thread to the OP article: If you go to the portal on Apple's site, you need an AppleID, and if the AppleID has MFA enabled you need a device. The is no way around that. If you want to scope the thread to the Elcomsoft article and specific on-device physical extraction, sure you'd have a different story.
  - acqq 8y ago
    I haven't "scoped it" that way, the parent poster of my answer did it so: "Someone would need my apple id, my password, access to one of my apple devices (I had to enter a code that appeared on one of my devices), and access to my email." Note: "someone would need my" -- as in "an attacker", not "me as the owner of the device." And the answer, supported by the Elcomsoft's article is, no, the attacker just needs the device and the passcode. Nothing more. Since iOS 11, everything else he can extract from that.

3 ms·

You keep repeating yourself and missing the point, which is: no, it does not matter and does not change the overall security of pretty much all users. It is sim

by oneplane 8y ago

acqq 8y ago
> it's simply still not relevant It is absolutely relevant for this very thread: it disproves the initial claim in the thread that the attacker would need “device, passcode and appleid password”. The article proves that the third (appleid password) is not needed (that was the main topic of the article) and you never demontrated anything else. I don’t care for other kinds of relevance or irrelevance as they never were never claimed by me.
- oneplane 8y ago
  If you want to scope the thread to the OP article: If you go to the portal on Apple's site, you need an AppleID, and if the AppleID has MFA enabled you need a device. The is no way around that. If you want to scope the thread to the Elcomsoft article and specific on-device physical extraction, sure you'd have a different story.
  - acqq 8y ago
    I haven't "scoped it" that way, the parent poster of my answer did it so: "Someone would need my apple id, my password, access to one of my apple devices (I had to enter a code that appeared on one of my devices), and access to my email." Note: "someone would need my" -- as in "an attacker", not "me as the owner of the device." And the answer, supported by the Elcomsoft's article is, no, the attacker just needs the device and the passcode. Nothing more. Since iOS 11, everything else he can extract from that.