4 ms·

Of all the good reasons to criticize Apple, you picked the most bogus one. Congratulations, that's an achievement. :D You severely overestimate celebrities' te

Of all the good reasons to criticize Apple, you picked the most bogus one. Congratulations, that's an achievement. :D You severely overestimate celebrities' technical prowess -- and underestimate their naivete. They live in their own bubble of trust and laughs and fun and parties; and if somebody crafts a message that looks to be from their agent or a friend celebrity they absolutely WILL click on it and will give their data willingly. None of us has the entire picture of course, but after knowing a few local celebrities 10+ years ago, I can definitely believe they are that gullible so as to make a spear-phishing attack successful.

acdha 5y ago
And, let’s be clear, this is true for almost everyone — even most HN commenters. Companies have spent years training people to expect email from bizarre domains, with random attachments or HTML links which point to gibberish tracking URLs, etc. Spam filters have gotten better but by far the best protection move has been widespread U2F/FIDO deployment.
smoldesu 5y ago
It sounds like they're just like everyone else then: in which case, even more users were vulnerable, and Apple has even more incentive to secure their system. Is there anything I'm missing here?
- pdimitar 5y ago
  Nothing, except for the fact that people hate managing passwords with a passion and take the risk for their accounts willingly (I've had the heated table discussions to prove it). For them it's all about the tradeoff between "how much energy must I invest?" and "how much do I care if I lose this account?". Most of the people I knew only enabled 2FA on their Gmail because they really couldn't afford to lose it. Everything else they were very meh about. They even had 000000 as their online banking PIN... <facepalm> Password managers only started gaining prominence after biometric authentication allowed you to access your passwords with your finger or face. So yeah, celebrities are users like all others -- if not slightly worse even. I am pretty sure every corp like Apple, Google, Facebook, Microsoft et. al. would love to enforce maximum security but they also have to be very careful not to alienate their users. One good example is Google who will pester you for 2FA and recovery codes but never truly force you; they prefer to ban your account for suspicious activity instead (happened to one guy I knew some 3-4 years ago because his drunk friends tried to breach his Gmail account from several different phones). So I get it, you don't like Apple, but as I have snarkily remarked above: it's for the wrong reasons. (I don't like them either but it's for completely other reasons.)

acdha 5y ago

And, let’s be clear, this is true for almost everyone — even most HN commenters. Companies have spent years training people to expect email from bizarre domains, with random attachments or HTML links which point to gibberish tracking URLs, etc. Spam filters have gotten better but by far the best protection move has been widespread U2F/FIDO deployment.

smoldesu 5y ago

It sounds like they're just like everyone else then: in which case, even more users were vulnerable, and Apple has even more incentive to secure their system. Is there anything I'm missing here?

pdimitar 5y ago
Nothing, except for the fact that people hate managing passwords with a passion and take the risk for their accounts willingly (I've had the heated table discussions to prove it). For them it's all about the tradeoff between "how much energy must I invest?" and "how much do I care if I lose this account?". Most of the people I knew only enabled 2FA on their Gmail because they really couldn't afford to lose it. Everything else they were very meh about. They even had 000000 as their online banking PIN... <facepalm> Password managers only started gaining prominence after biometric authentication allowed you to access your passwords with your finger or face. So yeah, celebrities are users like all others -- if not slightly worse even. I am pretty sure every corp like Apple, Google, Facebook, Microsoft et. al. would love to enforce maximum security but they also have to be very careful not to alienate their users. One good example is Google who will pester you for 2FA and recovery codes but never truly force you; they prefer to ban your account for suspicious activity instead (happened to one guy I knew some 3-4 years ago because his drunk friends tried to breach his Gmail account from several different phones). So I get it, you don't like Apple, but as I have snarkily remarked above: it's for the wrong reasons. (I don't like them either but it's for completely other reasons.)