4 ms·
TikTok is making users give their iPhone passwords for unclear reasons
- LeoPanthera 3y agoIf you enter the wrong PIN, does it let you continue anyway? That’s a simple test to see if it’s the app or the OS that’s asking.
- ric2b 3y agoIs there no way for the app to check if the PIN is correct?
- pgraf 3y agoNo, because if there was the app could either brute-force your pin or lock you out by trying it too often :-) If there was a way this would be a pretty big vulnerability from Apple’s side. Even in the unlikely event that there is some private API, there is no chance you could pass an App Store review with that in your code
- brirec 3y agoI’m not so sure — what if an attacker can just run a test to see if the PIN is valid, and if not they can just shake the PIN entry and ask again like iOS does. And since every app is essentially a full screen modal, this sort of PIN phishing would probably be difficult for a human to detect. I bet you could recreate the iOS passcode prompt in SwiftUI relatively simply.
- szundi 3y agoThis simplicity I never understood. Windows at least does something with the screen when asking for privileges.
- gruez 3y agoWhat can you do with the pin though? Does iOS provide any sort of API that allows you to pass in a pin for verification?
- lxgr 3y agoYes, you can require the user to enter their PIN before allowing usage of a keychain secret, for example: https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1394326-devicepasscode https://developer.apple.com/documentation/security/secaccess...
- gruez 3y agoBut for that you can't pass in a pin yourself. You're relying on the OS to obtain and verify the pin.
- KMnO4 3y agoWindows doesn’t do anything that you couldn’t replicate in your own program.
- gruez 3y agoIt does, it's called secure desktop. https://en.wikipedia.org/wiki/User_Account_Control#Features https://en.wikipedia.org/wiki/User_Account_Control#Features
- lxgr 3y agoThat’s not the same thing. Secure Desktop solves the problem of trusted input, i.e. you don’t want untrusted user space apps to be able to interact with an OS dialog. (Note that in Secure Desktop, you’re not entering any password; you’re reading a message and allowing or declining a privilege escalation.) For iOS passcode verification, you’d need both secure input (which the UI almost certainly achieves), but also trusted output of at least one bit of information: Whether the user is currently interacting with the OS (or a trusted application) or an (untrusted) application.
- kr0bat 3y agoThere's still no way for TikTok, or any app, to determine your password hash, so even if they test for validity (by conforming to OS pin restrictions), how would they test for veracity (being given the user's ACTUAL) passcode.
- falcolas 3y agoYou can cancel the prompt and continue on in the app as usual. It's sketchy as fuck, but I've been able to effectively ignore it for a good month now.
- gcr 3y agoThis reddit user reports that tapping Cancel still brought them to their FYP page. https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_asking_for_iphone_passcode/ https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_...
- jbverschoor 3y agoI hope Apple's banhammer will solve this quickly
- pests 3y agoWhat is there to solve?
- furyofantares 3y ago> Even more concerning, experts say the reasons why TikTok — which had reportedly been caught red-handed spying on journalists in the past — remains unclear. Is there a missing word here? What is it?
- decremental 3y ago[dead]
- furyofantares 3y agoThere's a dead reply here that doesn't see the issue and instead thinks I misunderstood the sentence structure, which is interesting to me. Maybe they mentally inserted a word and didn't know, or maybe they just kind of get the tone -- it's a sentence critical of tiktok -- and don't notice that it carries no meaning. Just kind of interesting how differently people process info.
- pests 3y agoI understand what you are parsing, and it is missing something, but I think it reads fine. Like.. "Experts say the reasons why TikTok (_topic of the article_) remains unclear." Or perhaps it's referring to the previous sentence or paragraph. I do think the hyphenated subsection sets the tone too. Made up example: "The President today issued a statement. Experts says the reason why The President - who has issues statements in the past - remains unclear.
- HenryBemis 3y agoI am still surprised on how people install on their phones apps from Facebook/Meta, TikTok, and other shady companies. We've seen here in comments were people say that they access FB over their phone's browser JUST SO they don't install that data siphon to their phone.
- szundi 3y agoWhen you are a 12 year old and all your friends are on this and you would be alienated in a second from your social life at school with this nonsense - you would install it, haha.
- lancesells 3y agoI didn't even know an app could ask for your passcode. I've never seen that and would think there's not an API for it. Hopefully an iOS developer can chime in.
- lxgr 3y agoYou can tie key usage to a successful passcode entry. The app never sees the passcode; it’s handled by the OS: https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1394326-devicepasscode https://developer.apple.com/documentation/security/secaccess...
- KMnO4 3y agoI recently logged into Amazon via Safari on my iPhone and it asked for my passcode/Face ID. I didn’t know there was a JS API to authenticate that way, but I guess there is.
- lxgr 3y agoThat’s WebAuthN, also known as “passkeys”.
- andsoitis 3y agoPerhaps a bug in their recently announced passkeys implementation? https://www.theverge.com/2023/7/17/23798046/tiktok-passkeys-iphone-passwordless-login-security https://www.theverge.com/2023/7/17/23798046/tiktok-passkeys-...
- lxgr 3y agoThat's my guess as well. I haven't used a device without Face ID or Touch ID in a long time, but I guess that on those devices, the OS would fall back to the passcode as a second factor. Edit: It's almost certainly that. Users that don't have biometrics set up (or presumably also that have biometry attempts exhausted) get this behavior: > Use Face ID or Touch ID to complete sign in. If you didn’t set up Face ID or Touch ID on your iPhone, enter your device passcode (the code you use to unlock your iPhone). (from https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios https://support.apple.com/guide/iphone/use-passkeys-to-sign-...)
- gcr 3y agoaha! i downloaded tiktok just now to test, and I'm immediately presented with a passkey prompt: "scan this QR code with a device to sign into TikTok" If I had a TikTok passkey on my phone at the time, it's likely that the prompt would be an ordinary FaceID auth challenge with a PIN fallback. Perhaps OP has faceID disabled?
- lxgr 3y agoCould this be as simple as a keychain key with the appropriate access permissions [1] set? It would be a very bad idea to do that without clear user messaging, but not necessarily nefarious. [1] https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1394326-devicepasscode https://developer.apple.com/documentation/security/secaccess...
- mrintegrity 3y agoIs there a better source for this? Nypost is one of the worst scandal generating clickbait sites out there
- kr0bat 3y agoI wish the article put more emphasis onto the facg that TikTok was requesting the password through a system prompt. They don't have anyone's passwords, just a conformation from the device that the correct password was inputted. This is such a nothingburger. All that aside...is this an nypost article referencing a Dextero article referencing an (unsourced) reddit comment?
- gruez 3y agoIndeed. If you do a quick image search you can find screenshots of the same prompt for other apps: https://guide.duo.com/static/images/en/iphone-passcode_2x.png https://guide.duo.com/static/images/en/iphone-passcode_2x.pn... But obviously "tiktok = china = bad" doesn't apply, so no ragebait article.
- BlackjackCF 3y agoIt’s the NY Post. They’re not really known for high quality reporting.
- gcr 3y agoI haven't seen these sorts of native prompts. Even passkey prompts open with a popover toast that covers the bottom part of the screen to confirm which account you want to use. Do you know what mechanism Duo is using in this example? Edit: could this be a prompt from a failed faceID authentication for the app's secure enclave storage? most of those prompts aren't cancelable, but this tiktok one is
- gruez 3y agoNormally you'll see a prompt like "touch/face id for [app name]". If the authentication fails, you'll have the option to enter your passcode, which opens the screen in the above screenshot.
- 01nate 3y ago[dead]
- graypegg 3y agoThe cropped screenshot they show with a TikTok logo gives a false impression of what these prompts look like. It very much looks like a native prompt. https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_asking_for_iphone_passcode/ https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_...
- gcr 3y agoOn the post you linked, OP mentioned that tapping "Cancel" still brought them to their FYP page. What native prompt does that? Edit: Another concerning detail is that a native lock screen prompt should show a blurred copy of your phone's background image. This prompt is a single solid color. Edit 2: perhaps a native passkey prompt with session token fallback? if tiktok is trying to upgrade everyone to passkeys, this could be them setting users up early for a smooth migration, but i'm just speculating Edit 3: i downloaded TikTok to test, and am immediately presented with a native Passkey prompt upon opening the app (it infact shows a QR code because I don't have a passkey on my phone). It's likely to be a passkey prompt then. But I am really wondering why it's cancelable without any issues.
- dathinab 3y agoBut even if it is native (putting aside that if TikTok is trying to steal a password they would make it look native, and that tbh. that is somewhat unlikely) there is still one problem. What is TikTok doing which triggers the OS to prompt the user for a password? There is some chance that it's something harmless (idk. wield speculative maybe possibility: something like they use some form of passkey API from apple to do client authentication and that API had some changes where it now ask for the password in some situation). There are many more (but unlikely) possibilities where TikTok is doing something bad or outright nefarious. But lets be honest if TikTok is intentionally doing something bad they are quite subtle about it, as not doing so would likely cause more harm for them then it does good. But we know TikTok has in the past multiple times done things which would have gotten a "normal" app developer perm-banned due to a breach of the App stores Terms of Service in a intentional consumer harming way, so it is concerning even if they most most likely don't steal your passwords.
- zarzavat 3y agoTitle is inaccurate. It’s vanishingly unlikely that TikTok is asking users for their device pin, Apple would trigger the kill switch and it would be gone before the nypost could write a scaremongering article. It’s much more likely that iOS is asking for the password.
- dragonwriter 3y agoI think it is orobably technically true that TikTok is making people do it (triggering the event that requires confirmation), but its probably an OS prompt and its probably an OS, more than TikTok, issue if the purpose is unclear.
- falcolas 3y agoYou can cancel the prompt and continue in the app as normal. It's a sketchy prompt to be sure, but it's easily ignored. My uneducated guess is a keychain prompt, since I'm signed in with my apple ID via OAuth2 (with the email hidden, etc).
- vsgherzi 3y agoI feel like this has to be a bug in implementation, it seems like they have competent devs I doubt they’d do something this brazen on purpose