5 ms·

Apple's performance here is inexcusable for a software company. It displays either a complete disregard or a complete lack of understanding of basic security.

by debacle 14y ago

stephengillie 14y ago
For support organizations, hackers and social engineers are still edge cases. The primary use case is dealing with paying yet indignantly impatient non-technical users. These people treat identity verification as stalling, thinking you're trying to get them off the line so you don't have to deal with their problem.
- SoftwareMaven 14y ago
  Munich is why you don't have a one-size-fits-all approach. If I can't figure out how to turn on my shiny, new Mac, there is zero need to any verification. If I'm asking for a password reset, they should know for sure who I am by the end. I had to remove an authentication from my Blizzard account once. They required me to do all the normal verification stuff (secret questions, password, etc), send an ID and confirm the process via a contact point I already had on the account. It took 24 hours. And they did it right.
  - SoftwareMaven 14y ago
    It is always interesting to see what my iPad decided I was trying to say. I wish the edit window was a bit longer. I don't check back immediately. For the record, "Munich" == "Which" in iPad-ese.
ajross 14y ago
I think that might be too harsh. For people like us, customer service policies aren't normally included in "basic security". Obviously they should be. But my guess is that this kind of vulnerability exists all over the world in all sorts of industries. In the US, at least, regulated banks have some security requirements that might prevent this (though I'm not sure). But outside of that my guess is that it's routine for a customer service agent to be able to make any modification to an account they want, without an extra authentication factor or supervision. So yes: blame Apple. But be wary, they can't possibly be the only ones.
- debacle 14y ago
  I've had plenty of banks ask me to call back later because I didn't meet all of their screening vectors for identity verification simply because I didn't have a certain piece of information available at the time. Frustrating? Yes. But good security can't be transparent to the user.
  - codemac 14y ago
    Amazon was a great example of this for me. I was trying to get a phone I had purchased through them replaced, and they asked me what my "display name" was. Now I had completely blanked on what that was.. was it my username? Was it my full name? Was it the beginning part of my email? gah, I'm on break outside a cafe and thought I could get this settled quick.. So the person on the phone, in quite a polite and understandable way, gave me a number to call back directly when I could remember it as I had passed all other verification steps. Had a moment of clarity and called back 2 seconds later and got on with it. They overnighted me a brand new phone. I rate that interaction a 10/10. 9/10 if we can imagine a world of omniscient amazon that knows when I've received broken items..
  - rmc 14y ago
    Frustrating? Yes. But good security can't be transparent to the user. Nearly always security is the opposite of convenience. Once people realise that you can be "more secure" or "more convenient" we'll all be better off. This implies to be "more secure" you must be "less convenient". It's always a trade off.
- equalarrow 14y ago
  Yes, definitely blame Apple, no doubt about it. I'm still a little shocked that the last 4 cc digits constitutes 'security'. An easy alternative - which I think they already have - is the whole two security questions thing. I would feel much better - as a customer - if they used those. This type of thing is going to happen more and more and the fact that remote wipe of all the devices happened totally negates any advantages of using cloud services. I mean, what's the point of having everything backed up remotely if a) the backup is not current b) the same remote servers can wipe your devices at any time In addition, it's possible the remote backups could be removed as well (although not sure about that for iCloud) and in that case, you might as well not back anything up and have a hard drive die (at least that could be recovered I suppose). Apple needs to jump out in front of this asap and announce a policy change in regards to security in order to put people at ease. I'm glad this is making waves and I think there needs to be more noise about it in order to get them to change.
Jamiecon 14y ago
<flippant>But par for the course for a consumer entertainment products company</flippant> In my blinkered world, Google and Facebook seem to be the companies to beat in the area of security for consumer services. 2-factor auth, proactive account security such as geographic checks etc. I can see how Apple's corporate mindset would find it painful to sacrifice user experience for security. Google, not so much. As an aside, it's about time Microsoft offered 2-factor auth for their accounts.
ScottBurson 14y ago
I think that in particular it shows that they don't have their own internal security team trying to find a way in. If you run a system on the scale of iCloud, and you don't crack it yourself, you can bet someone else will save you the trouble.
- taligent 14y ago
  I think you are confused. iCloud was NOT hacked. There was simply a mistake made by a customer service rep as acknowledged by Apple.
  - jholman 14y ago
    Except that Wired claims to have replicated the "mistake" at least twice (on top of the original attack). So that's a systematic error, and dedicated self-attack team ("tiger team") could have found that, and the hole could have been closed.
  - mjwalshe 14y ago
    Social Engineering is a form of hacking

Apple's performance here is inexcusable for a software company. It displays either a complete disregard or a complete lack of understanding of basic security.

by debacle 14y ago

Apple's performance here is inexcusable for a software company. It displays either a complete disregard or a complete lack of understanding of basic security.

stephengillie 14y ago

For support organizations, hackers and social engineers are still edge cases. The primary use case is dealing with paying yet indignantly impatient non-technical users. These people treat identity verification as stalling, thinking you're trying to get them off the line so you don't have to deal with their problem.

SoftwareMaven 14y ago
Munich is why you don't have a one-size-fits-all approach. If I can't figure out how to turn on my shiny, new Mac, there is zero need to any verification. If I'm asking for a password reset, they should know for sure who I am by the end. I had to remove an authentication from my Blizzard account once. They required me to do all the normal verification stuff (secret questions, password, etc), send an ID and confirm the process via a contact point I already had on the account. It took 24 hours. And they did it right.
- SoftwareMaven 14y ago
  It is always interesting to see what my iPad decided I was trying to say. I wish the edit window was a bit longer. I don't check back immediately. For the record, "Munich" == "Which" in iPad-ese.

ajross 14y ago

I think that might be too harsh. For people like us, customer service policies aren't normally included in "basic security". Obviously they should be. But my guess is that this kind of vulnerability exists all over the world in all sorts of industries. In the US, at least, regulated banks have some security requirements that might prevent this (though I'm not sure). But outside of that my guess is that it's routine for a customer service agent to be able to make any modification to an account they want, without an extra authentication factor or supervision. So yes: blame Apple. But be wary, they can't possibly be the only ones.

debacle 14y ago
I've had plenty of banks ask me to call back later because I didn't meet all of their screening vectors for identity verification simply because I didn't have a certain piece of information available at the time. Frustrating? Yes. But good security can't be transparent to the user.
- codemac 14y ago
  Amazon was a great example of this for me. I was trying to get a phone I had purchased through them replaced, and they asked me what my "display name" was. Now I had completely blanked on what that was.. was it my username? Was it my full name? Was it the beginning part of my email? gah, I'm on break outside a cafe and thought I could get this settled quick.. So the person on the phone, in quite a polite and understandable way, gave me a number to call back directly when I could remember it as I had passed all other verification steps. Had a moment of clarity and called back 2 seconds later and got on with it. They overnighted me a brand new phone. I rate that interaction a 10/10. 9/10 if we can imagine a world of omniscient amazon that knows when I've received broken items..
- rmc 14y ago
  Frustrating? Yes. But good security can't be transparent to the user. Nearly always security is the opposite of convenience. Once people realise that you can be "more secure" or "more convenient" we'll all be better off. This implies to be "more secure" you must be "less convenient". It's always a trade off.
equalarrow 14y ago
Yes, definitely blame Apple, no doubt about it. I'm still a little shocked that the last 4 cc digits constitutes 'security'. An easy alternative - which I think they already have - is the whole two security questions thing. I would feel much better - as a customer - if they used those. This type of thing is going to happen more and more and the fact that remote wipe of all the devices happened totally negates any advantages of using cloud services. I mean, what's the point of having everything backed up remotely if a) the backup is not current b) the same remote servers can wipe your devices at any time In addition, it's possible the remote backups could be removed as well (although not sure about that for iCloud) and in that case, you might as well not back anything up and have a hard drive die (at least that could be recovered I suppose). Apple needs to jump out in front of this asap and announce a policy change in regards to security in order to put people at ease. I'm glad this is making waves and I think there needs to be more noise about it in order to get them to change.

Jamiecon 14y ago

<flippant>But par for the course for a consumer entertainment products company</flippant> In my blinkered world, Google and Facebook seem to be the companies to beat in the area of security for consumer services. 2-factor auth, proactive account security such as geographic checks etc. I can see how Apple's corporate mindset would find it painful to sacrifice user experience for security. Google, not so much. As an aside, it's about time Microsoft offered 2-factor auth for their accounts.

ScottBurson 14y ago

I think that in particular it shows that they don't have their own internal security team trying to find a way in. If you run a system on the scale of iCloud, and you don't crack it yourself, you can bet someone else will save you the trouble.

taligent 14y ago
I think you are confused. iCloud was NOT hacked. There was simply a mistake made by a customer service rep as acknowledged by Apple.
- jholman 14y ago
  Except that Wired claims to have replicated the "mistake" at least twice (on top of the original attack). So that's a systematic error, and dedicated self-attack team ("tiger team") could have found that, and the hole could have been closed.
- mjwalshe 14y ago
  Social Engineering is a form of hacking