While it feels HN to hate any companies that didn't do security "right", I think what Apple says makes total sense here. At least, the author claims that under

While it feels HN to hate any companies that didn't do security "right", I think what Apple says makes total sense here. At least, the author claims that under his assumptions, his exploit would have worked and affected a majority of iCloud accounts, but it won't. You can't claim that you found a vulnerability without actually demonstrating it. Key takeaway from Apple: > They concluded that the only way to brute force the passcode is through brute forcing the Apple device which is not possible due to the local system rate limits. The author did not understand that sentence accurately: > There is very bleak chance for this endpoint to be not vulnerable to race hazard before my report because all the other endpoints I tested was vulnerable – SMS code validation, email code validation, two factor authentication, password validation was all vulnerable. How I interpret that sentence is that, while other forms of verification are done on the server and thus subject to the vulnerability, the passcode verification is done on the device. When you send a passcode from another device, it is sent to the server and then routed to the device storing the passcode to perform the verification. Apple's servers do not store the hash throughout the process, and no form of brute force would have worked against the server. Instead, they are routed to the device storing the passcode, say iPhone, and the iPhone's HSM performs the verification. It's the HSM doing the rate limit here, and thus it's not subject to the vulnerability.