Janky Apple ID Security

https://mjtsai.com/blog/2024/04/26/janky-apple-id-security/

by latexr • 2 years ago

133 27 2 years ago

lapcat• 2 years ago

See also: Apple users are being locked out of their Apple IDs with no explanation https://news.ycombinator.com/item?id=40177617

cjk22• 2 years ago

Reading various forum and social media posts, this seems to be limited to @me.com and @mac.com addresses. Anyone seen anything else outside of that?

Smells like credential stuffing attack to me at the moment which has triggered some rather vicious account protection measures.

someonehere• 2 years ago

I have me and Mac and haven’t seen this issue.

eksu2• 2 years ago

I had this issue with my third party email provider as username for account, others are reporting iCloud.

cjk22• 2 years ago

Thanks for confirming.

chrisjj• 2 years ago

I went to Settings ‣ Privacy & Security ‣ Location Services ‣ System Services ‣ Significant Locations to check, and for some reason the only location in the list was the grocery store that I go to once every two weeks.

This is the most worrying aspect of the messup. Locking out the owner is scary. Admitting a thief is terrifying.

time0ut• 2 years ago

I just checked my significant locations and all it has is my home. I guess that’s lucky. It usually also has my office where I spend quite a bit of time. Hopefully they recover from whatever outage is going on.

nikolajan• 2 years ago

Super strange, I'm seeing the exact same thing, the only significant location is a grocery store that I semi-frequent.

ChrisMarshallNY2• 2 years ago

but the sheet was broken

Apple's Web services have been a shitshow, for many years. I suspect that several iOS screens are little more than WebViews into their Web services.

It's worst, on the backend, in things like App Store Connect, or Developer Center.

Ironically, they tend to work better on Chrome, than on Safari, and my workflow for encountering issues, is to reopen the page in Chrome.

rcarmo2• 2 years ago

Nope, they don't really rely on WebViews unless you're in Safari. They do have an extensive API surface, and a lot of Swift stuff consumes it directly.

axlee• 2 years ago

Really? The "Apple ID" (and subscriptions) section in the settings in so janky and doesnt feel native at all.

ChrisMarshallNY2• 2 years ago

I know that most of the infrastructure apps in all Apple operating systems, nowadays, are SwiftUI, so it makes sense that they aren’t WebViews. SwiftUI has a definite UX “flavor.”

I’m not thrilled with some of the choices they made, irt information architecture, and basic UX, but they are consistent.

janandonly• 2 years ago

Could a (nation state?) hacker group be attacking Apple?

Maybe this is not their fault at all but the result of some others pressure on certain (undocumented?) API’s or some such thing?

dewey• 2 years ago

Maybe this is not their fault at all but the result of some others pressure on certain (undocumented?) API’s or some such thing?

Both things can be true at the same time.

rjzzleep• 2 years ago

One thing I noticed actually that I didn't notice in the other thread is that a few days ago, I saw "a new device has been added to Facetime". I didn't know what it was and whether it was my device or not, so I just removed it from the list immediately. A few days later I noticed the same behaviour everyone else had, i.e. that my apple id was logged out.

So when I logged back in there was no particular issue, I wonder if there is a correlation between the two. It makes me wonder if something on Apples side has been compromised.

drexlspivey• 2 years ago

This happens when some device is being offline for a while (30+ days?) and goes online again

can16358p• 2 years ago

It actually happens if a device has been offline for about 3 days for me.

Someone1234• 2 years ago

I've had it happen recently after installing software updates.

EasyMark• 2 years ago

Yep happened to me, I have two iphones, one is on a cheap phone provider and I justhave it for when I need a second phone for whatever. I fired it up the other day and got one of these messages.

user_7832• 2 years ago

Slightly tangential but I'd sometimes wish for a 3rd party option for such accounts. You can have a gmail, an icloud mail or your own email domain as email is a (well?) defined standard. Why can't I do the same with my iPhone? Back up my device to my own NAS instead of iCloud. Having such a standard would force accountability - not that I consider Apple's security poor, but rather that it could be better.

jedisct1• 2 years ago

This is apparently only affecting people with `me.com` and `mac.com` accounts.

So, that sounds just like a bug after a migration of these services to some new APIs.

eksu2• 2 years ago

This is not true.

mmcnl• 2 years ago

No, I'm not using those accounts and I got locked out too.

Janky Apple ID Security

Related Stories