Have you had a reason not to trust Apple?
I think it has to come more from the way you present your case and the bad mouthing and negativity you have towards Apple.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Why is Apple's online account security so poor?
- Thread starter neiltc13
- Start date
- Sort by reaction score
Have you had a reason not to trust Apple?
I think it has to come more from the way you present your case and the bad mouthing and negativity you have towards Apple.
I just think Apple has the resources to do something pretty good here, but at the moment is doing nothing.
It's the monopoly-itis. They're settling into a lack of innovation because they conquered all mountains.
I think Apple would be more likely to spend the resources if this was something more people were interested in.
Obviously this is a topic near-and-dear to you, but based on the response you've gotten to the majority of your other posts on this topic (some quoted below), nobody else on MacRumors seems to care about it.
If this security topic doesn't get any traction on a geeky place like here, how high on the "want list" do you think this topic is for average folks?
Again, I'm not saying it's a bad idea, I'm just saying that I don't think most folks would even bother using it, if it were an option, and that's going to play a lot into if Apple would even consider doing it.
Millions of people drive a car every day, and never get into an accident. That doesn't stop the car companies from developing more, and improving existing, safety features every year.
I completely agree with Neil here, and sadly, I'm not surprised at the responses given to his initial question. Will you get hacked? Statistics say probably not. But if/when someone attempts it, having that extra layer of security is very welcome. I'd, personally, much rather have a slight inconvenience occasionally, in return for knowing my accounts are that extra bit more secure. For people who don't care, they don't have to enable the feature. For the rest of us, at least give us the option.
I completely agree. I think Apple should be offering the option for more secure behaviour for those who want it, and now is the time to be wondering this, not just after encouraging everyone to store personal data in the iCloud.
If I'm storing family photos and music maybe I wouldn't be that concerned, but if I was storing confidential work files it becomes an issue. Even if some think it's overkill for them, it's logical that to compete with other companies offering similar services something as important as the security of accounts should be something Apple wants to be proud of, not offering the lowest-common-demoninator of solutions.
The answer to the question is probably that for the user, convenience is often the enemy of security, and Apple like things to be easy to use.
That's because there is more of an economic incentive to develop car safety. It's easy to hit home with advertising about car safety because the danger of physical harm is much more apparent to the average person than protecting one's information. As usual, car/computer analogies fail.
Again, are you saying that if I gave you my username and password, you could access my iCloud backups on your device? I am not at all certain how the backup works, but saying that the passwords need another form of security is fine, but what if they are already there with device Id's history for that said backup.
It appears (and believe me I am no expert at iCloud) that it is simply a backup for the device, so unless you are tied into my device history and my backup can be tied to your device easily I don't see what the worry is. Kinda like iTunes, you are only allowed 5 devices on one account, if you have 6 nothing on that device will even play or DL.
Sorry, I just am not getting it. Even if you could login online, are my backups readable in a valid format, or do you need to restore to access the data?
Docs are apparently stored the old iDisk way, but even those i am not sure how they work exactly. They appear to also be tied in system preferences to my iCloud account, so I am not quite sure of the security feature needed on those either.
I'd hope that they could be restored to a different device. If my iPhone broke and I was given a warranty replacement one, I'd expect I could restore the last backup from my broken phone onto my replacement one.
If that's the case, I'd guess anyone with your AppleID and password could restore your backup to one of their devices.
The car analogy doesn't work well on several levels. First, it's comparing serious injury and death to being hacked. Next, many car accidents occur to people randomly, and due to the actions of others. Breaking a password is almost always due to user using a weak password, or using their password in appropriately. Car companies didn't start adding safety features because they felt like it, but because there was mass public outcry about how unsafe their vehicles had started becoming. At this point, there does not appear to be lots of people calling for stronger measures from Apple.
A problem with 2 part authentication is that it's expensive to implement (I'm assuming this - but creating a whole new subsystem, and then tying it into the messaging medium, and then testing to keep it 99.999% reliable can't come cheap. And it needs to be that reliable, otherwise people won't trust it to use it, which defeats the purpose.) .... anyway, it's expensive to implement and support.
Those increased costs are now borne by everybody whether they use it or not. In otherwords, the few people who are concerned get a free ride, paid for by those of us who can't use it (no cell phone) or who aren't concerned because we practice safe password use.
As far as security is concerned, Apple has always, imho, spent "just enough" to be safe. They could make safer systems, but they haven't needed to (until the recent Trojan outbreak). They could spend more on security, but then those costs would be passed on to customers. And - would there be any fewer people who get infected?
Same thing for the passwords... from what I've read about the Apple ID hackings, the Apple systems were not compromised, it was people using the same name and password everywhere (which is not good password practice).
Not only do I use several different passwords, I also use several different usernames. So, knowing my Apple ID username won't get you far with my Google account.
All of this said.... if Apple added a couple of extra security questions for logins from unknown computers, I'd be OK with that. Cheap to implement (relatively speaking). Much less intrusive. Probably handle the majority of issues those few people who are hacked are facing.
I think your tone in the original post contributes. It seemed intentional to me so I find your statement disingenuous.
I think Apple doesn't offer it because it would be terribly annoying to most users. Make it required and you annoy almost all of your customers. Make it optional and almost no one uses it. We all already have the choice to use hard passwords, but how many do it?
It's a classic bad UI where you put the burden for solving a system challenge on the user of the system.
Everyone's working on improving everything all the time. I'm sure they've got a list of priorities somewhere and it's on there. They probably know when and how to do it. There's probably a reason for things bring the way they are in this area, rather than being some gaping hole that mysteriously got past them.
The problem is that you're blowing it up to be a much bigger issue than it actually is.
Yeah, the last thing MR needs is a member who makes issues bigger than they are.
Apropos, your sig is pure gold.
You folks that gave me -4 for this might not like it, but just because you don't like something does not mean its untrue.
"Don't be evil" my a@@.
Wake up folks.
And on the same token you have people like you for example defending Apple not offering as an example. Get back to me when your email gets hack. Let me tell you it sucks and I have a strong password and first thing I did after I got it cleaned up was change the password and kick on two step verification.
As for Google 2 step it does not require you being in cell coverage to work. It has an App which you can install on Android, iOS or blackberry that uses the phones internal clock to provide you with the 2 step verification. with an SMS back up along with 10 one time use codes that can be regenerate as needed.
Anything that can not use a two step (like your cell phone email, out look ect) google will supply you with a 16 char randomly generated password for that device that you can revoke at any time.
I would say it would be nice to see Apple step up the game and provide it. Clearly it is not something hard to do. The hardest part would be generating the App for iOS and even then that would be a cake walk to do. Say maybe 4 hours or so to created the App.
The people defending Apple calling 2 step stupid are what amaze me the most.
People really need to educate themselves on a topic before throwing their arguments around, even more so when dealing with account security.
Whilst the chances are that you are buggered if an experienced hacker decides to come after you... Two factor authentication will go a long way to protecting you against your opportunist script kiddy.
- Two factor authentication is optional. It is not 'annoying' to most users, because they dont have to use it if they dont value their account security.
- When implemented as well as Google has, it is of no inconvenience even when enabled. The app works with/without a signal or the internet, and takes less than 5 seconds to open and enter the pin. The fact people rarely delete their browser data means you probably wont need to log in for another 90 days.
- There are a number of precautions in place should you lose your phone. They can provide you with one time passwords for you to save for future use, or alternatively ring your home phone.
Whilst the chances are that you are buggered if an experienced hacker decides to come after you... Two factor authentication will go a long way to protecting you against your opportunist script kiddy.
Last edited:
Google's 2-step verifacation isn't that good for several reasons:
1) the codes are only 6 characters long and only include numbers.
- these types of codes are easily brute forced. So, this doesn't provide much benefit over a single secure password.
2) an app can be downloaded to generate functioning codes without a network connection.
- this suggests that these codes can be re-used. So, this provides no protection if you log into a public computer that contains a keylogger. (P.S. never log into security sensitive accounts on any public computer despite the fact that the Google video suggests 2-step authentication provides extra security on untrusted computers.)
- this provides no benefit if a local attacker has access to your device that has the app installed.
3) an option exists to inhibit 2-step verification for 30 days on a specific computer.
- if used and the attacker has local access, this negates the benefit of the extra verifaction by effectively turning it off.
1) the codes are only 6 characters long and only include numbers.
- these types of codes are easily brute forced. So, this doesn't provide much benefit over a single secure password.
2) an app can be downloaded to generate functioning codes without a network connection.
- this suggests that these codes can be re-used. So, this provides no protection if you log into a public computer that contains a keylogger. (P.S. never log into security sensitive accounts on any public computer despite the fact that the Google video suggests 2-step authentication provides extra security on untrusted computers.)
- this provides no benefit if a local attacker has access to your device that has the app installed.
3) an option exists to inhibit 2-step verification for 30 days on a specific computer.
- if used and the attacker has local access, this negates the benefit of the extra verifaction by effectively turning it off.
No, the car analogy works quite well if you ask me.
Yea, that is how an analogy works, the point of which you clearly missed. I was comparing the process of avoiding/surviving the crash to avoiding being hacked. I wasn't saying that being hacked is as traumatic to being seriously injured in a crash.
Correct, but not every hack is directed at a specific individual either. Often times, it is a service that gets hacked, thus leaking people's information in the process.
Having only a password protecting your online account is like relying on only your seatbelt to protect you. If/when you have a crash (regardless of who is at fault), would you like to only rely on a seatbelt to keep you safe, or would you also like to have airbags, seat tensioners, crumple zones, etc, to help mitigate injury? I don't know about you, but I like having as much safety and security as I can.
With as much personal information and data that we are putting online, I welcome companies offering these extra layers. I take a lot of steps to be proactive with my personal security online, just like I try and drive very safe when on the road. Having the option to add a couple more layers to that safety to help if/when there is a problem, though, is fine with me.
Can not brute force something that changes every 30 sec. That the entire point is a 6 digit code that changes every 30 sec.
Look up Security Token http://en.wikipedia.org/wiki/Security_token It has nothing to do with the needing a network connection. As long as the server and the local device use the same system to generated the token and change the counter. I have seen small battery operated ones that changed ever 30 sec that have no radio in them at all.
If the person stole your device and has the counter on it then well they lack the password so they can not get in to it. From there you can easily revoke that token generator so what it makes is completely worthless. Also any single device pass work can be revoked so it is no long works.
That option is there so if you use the same computer over and over again you do not want to do 2 step all the time. Now if you change your password all those 30 days are revoked and have to be redone.
All in all you have a lot of FUD in your entire post and a complete miss understanding of how it works. I suggest you go look it up and learn how it really works before you make yourself look like a fool.
Did you watch the same video on the OP that I did? It says 30 days, not 90.
Attachments
I didnt watch the vid no, I have used the two factor authentication since Google implemented it.
That comment was me just going off my memory, which obviously isnt that good
The point remains the same. 5 seconds every 30 days is not a problem.
How the hell can it change every 30 seconds when a device can suspend the service for 30 days?
BTW, any passcode can be brute forced with a sufficient amount of time.
But, a secure password alone can make the amount of time needed for brute forcing unfeasible. So, the extra authentication is not required to protect oneself from a remote compromise if a secure password is used.
Also, 2-step authentication doesn't justify re-using passwords because not all accounts have this extra authentication. So, if an attacker gets the passwords via the user assuming that it is safe due to the extra authentication, the re-used password can still be used to comprise the user's other accounts.
If someone has local access to your system, then the extra authentication makes no difference. See my post above and my comments below.
Not all 2-step authentication systems use one-time codes.
I was unaware that Google used one-time codes. I assumed Google's system allows codes to be re-used given the haphazard manner in which backup codes are implemented.
An attacker does not have to try to brute force the one-time codes given that each account has 10 backup codes.
The attacker only has to brute force 1 of those 10 backup codes to access the account.
Again, these codes only use numbers so they aren't inherently secure.
BTW, what happens when the battery dies? Do you have to set everything up again?
Hey, I remember your username. You use Windows. No wonder you need all this extra stuff to be secure.
That is exactly my point. A secure password is still the most important security mitigation.
Sure, if you know someone is accessing the device.
But someone trying to compromise your account locally does not necessarily involve your device being stolen; someone can access your device without stealing it.
And, allowing the extra authentication to be suspended negates the purpose of it in the first place.
So, that machine is functioning like it only has a single password. Which means that this is no more secure than having only a single password. Which means that it is still important to make sure to use a secure password.
Really?
Last edited:
No one suggested that 2-step authentication justified password re-use.
The attacker would need the valid password and a valid one-time code to log in. Simply brute forcing one code is not enough. See: http://www.google.com/support/accounts/bin/answer.py?answer=1187538
This isn't relevant to the topic.
No one said that it wasn't.
No one said that 2-step is a reason not to re-use passwords or not created strong ones. It is one more line of defense against it. You keep slamming a system that clearly you have never used or under stand. You are spreading FUD.
Well first off the 1 time use verification codes are longer than 6 digits (they are 8)
Also I point back to it is 2 step. It requires you knowing someones password which should be secure any how. Also brute forcing the 2 step is rather hard in time because google does slow it down after a few fail attempts. Brute force kind of sucks when you can not do slam it 100's a second.
don't ask me. I was talking about a general 2 step system that uses security tokens for remote log in where my Uncle worked. It was to point out that network access is not exactly needed for the system to work.
No one said otherwise.
More FUD. At this point this is pure FUD.
Yes really. You pretty much are spitting out put FUD. You clearly have done zero research in to it and on top of that you clearly have zero understanding of how it works.
I already suggested you go look up how it works before you make yourself look like a bigger fool and you clearly failed to take that advice. Instead you tried to spread more FUD and go insulting.