4 ms·

If you enter the wrong PIN, does it let you continue anyway? That’s a simple test to see if it’s the app or the OS that’s asking.

ric2b 3y ago
Is there no way for the app to check if the PIN is correct?
- pgraf 3y ago
  No, because if there was the app could either brute-force your pin or lock you out by trying it too often :-) If there was a way this would be a pretty big vulnerability from Apple’s side. Even in the unlikely event that there is some private API, there is no chance you could pass an App Store review with that in your code
brirec 3y ago
I’m not so sure — what if an attacker can just run a test to see if the PIN is valid, and if not they can just shake the PIN entry and ask again like iOS does. And since every app is essentially a full screen modal, this sort of PIN phishing would probably be difficult for a human to detect. I bet you could recreate the iOS passcode prompt in SwiftUI relatively simply.
- szundi 3y ago
  This simplicity I never understood. Windows at least does something with the screen when asking for privileges.
  - gruez 3y ago
    What can you do with the pin though? Does iOS provide any sort of API that allows you to pass in a pin for verification?
    - lxgr 3y ago
      Yes, you can require the user to enter their PIN before allowing usage of a keychain secret, for example: https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1394326-devicepasscode https://developer.apple.com/documentation/security/secaccess...
      - gruez 3y ago
        But for that you can't pass in a pin yourself. You're relying on the OS to obtain and verify the pin.
  - KMnO4 3y ago
    Windows doesn’t do anything that you couldn’t replicate in your own program.
    - gruez 3y ago
      It does, it's called secure desktop. https://en.wikipedia.org/wiki/User_Account_Control#Features https://en.wikipedia.org/wiki/User_Account_Control#Features
      - lxgr 3y ago
        That’s not the same thing. Secure Desktop solves the problem of trusted input, i.e. you don’t want untrusted user space apps to be able to interact with an OS dialog. (Note that in Secure Desktop, you’re not entering any password; you’re reading a message and allowing or declining a privilege escalation.) For iOS passcode verification, you’d need both secure input (which the UI almost certainly achieves), but also trusted output of at least one bit of information: Whether the user is currently interacting with the OS (or a trusted application) or an (untrusted) application.
        gruez 3y ago
        >(Note that in Secure Desktop, you’re not entering any password; you’re reading a message and allowing or declining a privilege escalation.) If you're a standard user, you'll be asked for the administrator's username/password on the secure desktop. Also, the secure desktop encompasses other parts of the system as well, like the lockscreen or the password change option on the ctrl-alt-del screen. >For iOS passcode verification, you’d need both secure input (which the UI almost certainly achieves), but also trusted output of at least one bit of information: Whether the user is currently interacting with the OS (or a trusted application) or an (untrusted) application. At least on windows that's provided by the secure attention key sequence. It's not enabled by default, but there's a group policy for it: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del https://learn.microsoft.com/en-us/windows/security/threat-pr...
- kr0bat 3y ago
  There's still no way for TikTok, or any app, to determine your password hash, so even if they test for validity (by conforming to OS pin restrictions), how would they test for veracity (being given the user's ACTUAL) passcode.
falcolas 3y ago
You can cancel the prompt and continue on in the app as usual. It's sketchy as fuck, but I've been able to effectively ignore it for a good month now.
gcr 3y ago
This reddit user reports that tapping Cancel still brought them to their FYP page. https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_asking_for_iphone_passcode/ https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_...

ric2b 3y ago

Is there no way for the app to check if the PIN is correct?

pgraf 3y ago
No, because if there was the app could either brute-force your pin or lock you out by trying it too often :-) If there was a way this would be a pretty big vulnerability from Apple’s side. Even in the unlikely event that there is some private API, there is no chance you could pass an App Store review with that in your code

brirec 3y ago

I’m not so sure — what if an attacker can just run a test to see if the PIN is valid, and if not they can just shake the PIN entry and ask again like iOS does. And since every app is essentially a full screen modal, this sort of PIN phishing would probably be difficult for a human to detect. I bet you could recreate the iOS passcode prompt in SwiftUI relatively simply.

szundi 3y ago
This simplicity I never understood. Windows at least does something with the screen when asking for privileges.
- gruez 3y ago
  What can you do with the pin though? Does iOS provide any sort of API that allows you to pass in a pin for verification?
  - lxgr 3y ago
    Yes, you can require the user to enter their PIN before allowing usage of a keychain secret, for example: https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1394326-devicepasscode https://developer.apple.com/documentation/security/secaccess...
    - gruez 3y ago
      But for that you can't pass in a pin yourself. You're relying on the OS to obtain and verify the pin.
- KMnO4 3y ago
  Windows doesn’t do anything that you couldn’t replicate in your own program.
  - gruez 3y ago
    It does, it's called secure desktop. https://en.wikipedia.org/wiki/User_Account_Control#Features https://en.wikipedia.org/wiki/User_Account_Control#Features
    - lxgr 3y ago
      That’s not the same thing. Secure Desktop solves the problem of trusted input, i.e. you don’t want untrusted user space apps to be able to interact with an OS dialog. (Note that in Secure Desktop, you’re not entering any password; you’re reading a message and allowing or declining a privilege escalation.) For iOS passcode verification, you’d need both secure input (which the UI almost certainly achieves), but also trusted output of at least one bit of information: Whether the user is currently interacting with the OS (or a trusted application) or an (untrusted) application.
      - gruez 3y ago
        >(Note that in Secure Desktop, you’re not entering any password; you’re reading a message and allowing or declining a privilege escalation.) If you're a standard user, you'll be asked for the administrator's username/password on the secure desktop. Also, the secure desktop encompasses other parts of the system as well, like the lockscreen or the password change option on the ctrl-alt-del screen. >For iOS passcode verification, you’d need both secure input (which the UI almost certainly achieves), but also trusted output of at least one bit of information: Whether the user is currently interacting with the OS (or a trusted application) or an (untrusted) application. At least on windows that's provided by the secure attention key sequence. It's not enabled by default, but there's a group policy for it: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del https://learn.microsoft.com/en-us/windows/security/threat-pr...
kr0bat 3y ago
There's still no way for TikTok, or any app, to determine your password hash, so even if they test for validity (by conforming to OS pin restrictions), how would they test for veracity (being given the user's ACTUAL) passcode.

falcolas 3y ago

You can cancel the prompt and continue on in the app as usual. It's sketchy as fuck, but I've been able to effectively ignore it for a good month now.

gcr 3y ago

This reddit user reports that tapping Cancel still brought them to their FYP page. https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_asking_for_iphone_passcode/ https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_...