5 ms·
Am I being hyperbolic or is this an absolutely enormous compromise of trust in Apple? XSS in iCloud Email allowing for data exfiltration of emails, pictures, vi
by lukeramsden 6y ago
Am I being hyperbolic or is this an absolutely enormous compromise of trust in Apple? XSS in iCloud Email allowing for data exfiltration of emails, pictures, videos??? That's absolutely insane. It just comes to show how vulnerable we all are to exploits like this, especially if you're a notable person of interest.
- floatingatoll 6y agoImagine how many thousands of exploits Apple has found and fixed internally, that weren’t found by outside researchers. Bug bounty programs aren’t a replacement for internal security, and they have the potential to be very expensive compared to paying someone a salary. Is it an enormous compromise of trust? Dunno. With an average fix time of a single business day, I’m inclined towards “no”: that’s an awfully rapid response for incompetence to deliver.
- selykg 6y agoSoftware is made by people and people are not perfect. The bigger the project the more moving pieces there are and the more likelihood of flaws. My experience in bug bounty programs has taught me that if you do start a bug bounty program you need to be serious about it and when a report comes in that is actually serious that you need to act on it quickly. And it seems Apple is doing that. What would be more concerning is if they weren't acting on fixing issues quickly. Some take longer, that's to be expected depending on the problem, but what has been reported so far has been fixed in a timely manner.
- intricatedetail 6y agoThis happens when a company choses to amass wealth instead of investing in security. Their ads about privacy now sound laughable
- selykg 6y agoOh please... EVERY SINGLE piece of software has some security issue. Apple is no exception. Assuming they should be perfect is just petty BS and short sighted. Also, keep in mind that security and privacy, while related, are not the same things. You can have privacy (i.e. minimal data gathering) and poor security. You can also have poor privacy but amazing security. Not sure why I'm feeding the troll here but whatever.
- intricatedetail 6y agoDo you mean issues like those found here? It's pretty embarrasing and negligent.
- selykg 6y agoI feel like you’ve never worked at a large company before. None of this is abnormal. And it seems based on this article that Apple responded quickly and fixed the reported issues.
- dkonofalski 6y agoI agree. The bigger lesson here, imo, is that companies need to take security of their tools even if they're only used by a handful of people and not just focus on their front-facing tools. A forum that everyone had access to but that likely didn't get much traffic was used to get access to internal networks. That needs to be taken seriously.
- tptacek 6y agoFirst, practically nobody uses iCloud Email. I'm honestly surprised it still exists. You can confirm with Google searchs the C.W. that iCloud Mail isn't a serious contender among email platforms. Second, you'd be a little naive if you thought Google Mail has never had XSS vulnerabilities.
- saagarjha 6y agoThe people who specifically choose to use iCloud email are far more likely to care about an XSS than the average Gmail user.
- kchr 6y agoPlease elaborate.
- rswail 6y agoPeople who have mac.com and me.com email addresses (which are now part of iCloud email) are many and have the same variation in security posture as any other cloud email user.
- tptacek 6y agoWe'd be talking about people who have @me.com email addresses and use the web application and not Mail.app on macOS or iOS. I doubt there's that many.