pull down to refresh

114 sats \ 2 replies \ @zuspotirko 18h \ on: Apple's Password app was vulnerable to phishing attacks for 3 months post launch security
This left the user vulnerable: an attacker with privileged network access could intercept the HTTP request and redirect the user to a phishing website
That's not a phishing attack. That sounds like a profound security hole in the TLS implementation.
write
preview
50 sats \ 0 replies \ @WeAreAllSatoshi 14h
I think it’s MITM since they weren’t enforcing TLS to begin with
reply
33 sats \ 0 replies \ @zuspotirko 18h
Notably this is not the first time Apple has issues with checking identities on TLS initial connection. There was a famous bug years ago called "Goto Fail" where MacOS would just accept any signature/identity in certain cases.
Sometimes you just want to shake Apple management and scream: implement. basic. unit. tests. for. security. stuff. aaaaa.
reply