5 ms·

How they changed the trusted phone number is the biggest mystery here and the biggest concern. They linked to a HN thread, and I guess by implication they're sa

How they changed the trusted phone number is the biggest mystery here and the biggest concern. They linked to a HN thread, and I guess by implication they're saying that the phone was unlocked when it was stolen and that is somehow how it was changed? It is interesting that Apple has no way of viewing phone number histories.

limitedsupply 4y ago
On an iPhone you can go to Settings -> Name, Phone Numbers, Email -> Edit Reachable At. That's one way I guess. Haven't used this menu before so not 100% positive.
- judge2020 4y ago
  True - maybe it shows it afterwards, but adding a new phone number doesn't require password entry or Face ID. As for removing the existing number, I can't remove mine until I de-register it from iMessage & Facetime (since it's the number on the phone), so maybe they turned those off or they popped in a new SIM card.
majormajor 4y ago
Something that's always confused/concerned me - at least on Mac - is that when I get asked for a 2FA code logging into the icloud web UI or similar, the same computer I'm logging in from pops up a popup with the code the Apple site is requesting. Wonder if that sort of thing comes into play here - if you are trying to do something "untrusted" on a device, the trust check shouldn't rely on that same device? But then if you only had a single device you're in trouble...
- nerdponx 4y ago
  I imagine the problem is that, from the perspective of the web browser, the computer you happen to be using is a separate device, because it's a separate logged-in application. Seems like an obvious hole, but I don't know how you would fix that.
- judge2020 4y ago
  On Safari in latest macOS/iOS, it pops up an official prompt for signing into appleid.apple.com instead of having you remember and enter a code[0], so it becomes "you either need to use the local authentication factor, eg. face ID to sign in, or be in possession of an unlocked device and know the password". The real question here, IMO, is how do you prevent against this. Because to the Apple engineers in the US of A, having your phone stolen at gunpoint is almost unheard of, and getting it swiped from your hand is also barely a problem anymore since thieves in the US typically don't go through all this effort to phish the Apple ID password from you (at most they sell it to a 3p service that ships it overseas to China for teardowns and parts salvaging). 0: https://apple.stackexchange.com/q/382190 https://apple.stackexchange.com/q/382190 (note that it prompts for local user account password because the long-lived token that performs a new grant for the Safari session is stored in local Keychain; so if you have touch ID or watch unlock on your Mac, it'll use that first)
- krisoft 4y ago
  The web session is untrusted, and they have a trusted connection to the OS known to belong you. Don’t know how it is implemented exactly, but on the OS level they can do a lot of clever tricks. From their servers they can literally send a challenge-response protocol to the secure enclave of your computer, thus verifying that on the other end of the encrypted connection they are trully talking with a computer manufactured by them, and that computer is the one which is registered to your account. If they implement this correctly they can make an attack against this chain of trust very costly. On the other hand on the web they get a http querry with some cookie attached. Maybe. Lot harder to gain the same level of assurances there. And a simple cross site scripting attack, or a compromised browser extension can steal said cookie.
  - majormajor 4y ago
    > The web session is untrusted, and they have a trusted connection to the OS known to belong you. Known to belong to me, yes. Known to be in my possession, no. You'd still need one further thing to go on as far as I can figure - I'd need the password to type into my browser first - but treating "browser session" and "machine the browser is running on" as separate levels of trust seems naive in terms of what someone who steals the machine can do.
    - deleted 4y ago
      [deleted]
    - bryan_w 4y ago
      I don't know the exact workings, but usually the authentication popup should popup with at least 1 other factor to challenge(e.g. touchid or password) if it hasn't asked recently. That way it uses 1) something you are (touchID) and something you have (Validation from a known good device) as the 2 factors.
lstamour 4y ago
I can’t confirm right now if it works today, but I remember previously inserting a new SIM and having Apple ask me if I want to update my iMessage number to the new number? Actually, never mind, easier than that. All you need is unlocked access to a device that already has 2FA, it seems: https://support.apple.com/en-ca/guide/iphone/iphd709a3c46/ios https://support.apple.com/en-ca/guide/iphone/iphd709a3c46/io... (see section to add or remove a new phone number) Feels like there’s a missing password prompt there. And maybe confirmation on a second device, if you have one.
- collectedparts 4y ago
  I have to enter my password every 15 minutes that I buy something from the App Store. The change felt recent, maybe after high-profile cases of toddlers spending $$$ on in app purchases? The fact that "I'm going to change my phone number, which is an important credential to this account" has less security than "I want to buy an app for $0.99" just goes to show you that sometimes, particular emergent properties of a system are not what any logical person would come up with deliberately. That or someone just needs to make a big enough stink and try to get the liability shifted to Apple for negligence here on account takeovers, and they'll figure out how to change.
  - limitedsupply 4y ago
    Have you verified this information? Other comments in this thread have and are saying that changing any phone number connected to iCloud requires a password.
  - pohuing 4y ago
    I'm probably being too cynical. But charge backs and customer support because some kid is falling for predatory IAPs cost apple money. This? Idk

limitedsupply 4y ago

On an iPhone you can go to Settings -> Name, Phone Numbers, Email -> Edit Reachable At. That's one way I guess. Haven't used this menu before so not 100% positive.

judge2020 4y ago
True - maybe it shows it afterwards, but adding a new phone number doesn't require password entry or Face ID. As for removing the existing number, I can't remove mine until I de-register it from iMessage & Facetime (since it's the number on the phone), so maybe they turned those off or they popped in a new SIM card.

majormajor 4y ago

Something that's always confused/concerned me - at least on Mac - is that when I get asked for a 2FA code logging into the icloud web UI or similar, the same computer I'm logging in from pops up a popup with the code the Apple site is requesting. Wonder if that sort of thing comes into play here - if you are trying to do something "untrusted" on a device, the trust check shouldn't rely on that same device? But then if you only had a single device you're in trouble...

nerdponx 4y ago
I imagine the problem is that, from the perspective of the web browser, the computer you happen to be using is a separate device, because it's a separate logged-in application. Seems like an obvious hole, but I don't know how you would fix that.
judge2020 4y ago
On Safari in latest macOS/iOS, it pops up an official prompt for signing into appleid.apple.com instead of having you remember and enter a code[0], so it becomes "you either need to use the local authentication factor, eg. face ID to sign in, or be in possession of an unlocked device and know the password". The real question here, IMO, is how do you prevent against this. Because to the Apple engineers in the US of A, having your phone stolen at gunpoint is almost unheard of, and getting it swiped from your hand is also barely a problem anymore since thieves in the US typically don't go through all this effort to phish the Apple ID password from you (at most they sell it to a 3p service that ships it overseas to China for teardowns and parts salvaging). 0: https://apple.stackexchange.com/q/382190 https://apple.stackexchange.com/q/382190 (note that it prompts for local user account password because the long-lived token that performs a new grant for the Safari session is stored in local Keychain; so if you have touch ID or watch unlock on your Mac, it'll use that first)
krisoft 4y ago
The web session is untrusted, and they have a trusted connection to the OS known to belong you. Don’t know how it is implemented exactly, but on the OS level they can do a lot of clever tricks. From their servers they can literally send a challenge-response protocol to the secure enclave of your computer, thus verifying that on the other end of the encrypted connection they are trully talking with a computer manufactured by them, and that computer is the one which is registered to your account. If they implement this correctly they can make an attack against this chain of trust very costly. On the other hand on the web they get a http querry with some cookie attached. Maybe. Lot harder to gain the same level of assurances there. And a simple cross site scripting attack, or a compromised browser extension can steal said cookie.
- majormajor 4y ago
  > The web session is untrusted, and they have a trusted connection to the OS known to belong you. Known to belong to me, yes. Known to be in my possession, no. You'd still need one further thing to go on as far as I can figure - I'd need the password to type into my browser first - but treating "browser session" and "machine the browser is running on" as separate levels of trust seems naive in terms of what someone who steals the machine can do.
  - deleted 4y ago
    [deleted]
  - bryan_w 4y ago
    I don't know the exact workings, but usually the authentication popup should popup with at least 1 other factor to challenge(e.g. touchid or password) if it hasn't asked recently. That way it uses 1) something you are (touchID) and something you have (Validation from a known good device) as the 2 factors.

lstamour 4y ago

I can’t confirm right now if it works today, but I remember previously inserting a new SIM and having Apple ask me if I want to update my iMessage number to the new number? Actually, never mind, easier than that. All you need is unlocked access to a device that already has 2FA, it seems: https://support.apple.com/en-ca/guide/iphone/iphd709a3c46/ios https://support.apple.com/en-ca/guide/iphone/iphd709a3c46/io... (see section to add or remove a new phone number) Feels like there’s a missing password prompt there. And maybe confirmation on a second device, if you have one.

collectedparts 4y ago
I have to enter my password every 15 minutes that I buy something from the App Store. The change felt recent, maybe after high-profile cases of toddlers spending $$$ on in app purchases? The fact that "I'm going to change my phone number, which is an important credential to this account" has less security than "I want to buy an app for $0.99" just goes to show you that sometimes, particular emergent properties of a system are not what any logical person would come up with deliberately. That or someone just needs to make a big enough stink and try to get the liability shifted to Apple for negligence here on account takeovers, and they'll figure out how to change.
- limitedsupply 4y ago
  Have you verified this information? Other comments in this thread have and are saying that changing any phone number connected to iCloud requires a password.
- pohuing 4y ago
  I'm probably being too cynical. But charge backs and customer support because some kid is falling for predatory IAPs cost apple money. This? Idk