Why is Apple's online account security so poor?

[munkery]

...

Many accounts don't use encrypted login sessions let alone full session encryption.

So, if you log into one of these insecure accounts on a public network, it is very easy for your login credentials to be compromised via packet sniffing.

Combined with any password and/or username re-use, a few compromised accounts due to packet sniffing will lead to other accounts being compromised.

Often an email account is used to reset the password of other accounts, so more accounts are compromised once email accounts are compromised.

Apple logins use SSL so the compromise was either due to using a weak password or having a insecure login compromised in combination with password re-use.

 

[polobruce]

So you were hacked three times, or was it four times, on the same service?

I'm curious because most of us go through life not having been hacked even once, on anything.

This was the third time... The first time I can say fine my fault for using the same password.

What many people don't realize is that many times the people stealing this information aren't sitting there cracking peoples passwords. they are trying to find flaws in web software like for example this forum app..(NOT SAYING THERE IS A SECURITY VULNERABILITY IN THIS APP), They look for security flaws in open source web software forum apps, ecommerce apps, anything that has users creating accounts. They then go and download the entire database for the said application. Once they have the database they can see all the information you used to create the account on the XYZ forum, message board, whatever site.... They then will take THE username, password and email address that you used on that site and try to use it everywhere else. And... 9 times out of 10 they get into other accounts that you might have because most people use the same password....


As far as why me and why so many times... I don't know.. I owned a few companies, so that might make me a bit more of a target than the average joe consumer. I live online so i have a lot of user accounts a variable forums, message boards, etc. So in the example above my name may show up more than someone with less online accounts. But i'm not sure...

----------

Many accounts don't use encrypted login sessions let alone full session encryption.

So, if you log into one of these insecure accounts on a public network, it is very easy for your login credentials to be compromised via packet sniffing.

Combined with any password and/or username re-use, a few compromised accounts due to packet sniffing will lead to other accounts being compromised.

Often an email account is used to reset the password of other accounts, so more accounts are compromised once email accounts are compromised.

Apple logins use SSL so the compromise was either due to using a weak password or having a insecure login compromised in combination with password re-use.

Well, most sites now a days can afford an SSL certificate so me logging into a site using an encrypted session is a given. I now use lastpass.. so, I have one master password I use and lastpass logs me in each site with a highly secure (as the site will allow) password that has been generated just for that particular site and account. So, even if they got that how did they get my appleid info?

----------

Well now that you gave me a base line it is time to show you how oh so wrong you are.

Taking you example there are 84 possible chars for each spot (52 letters, 10 numbers, 10 chars above the number and 11 over chars) you have to remember several chars can no be used in a password and in those 84 I was giving some extra. Chances are it would be limited to maybe 73 in most cases which would push the need number to match google even higher than the 12 already.

now there are 26 for each of googles possible 16 spots.

now for your password to be better than a google pass word it requires a min of 12 chars long.

For googles 16 chars there are
43,608,742,899,428,874,059,776 possible passwords That is knowing that it is 16 chars long and all lower case.

Mix that with server time at a max of 100 try per sec brute force it would take on average 6,971,420,173,967.42 YEARS to brute force a Google random password. So even if you had 20 possible random ones that is not going to bring down the number that much at all and really pretty limited effect.

It is simple math.

To figured out the average time it is take that big long number of possible passwords and divided by 2. That gives you the average case for brute force.

So really you might want to do a some math fact checking before try call it insecure.

Reason for the limitation of a 100 trys per second is that is being nice in the max number of server pings Google would allow you to hit it for. Just raw brute force hacking with out that limitation you are still talking years for a brute force hack job as you are maxing out your CPU speeds here.


Really do some basic math checking here.

Either way your secure password at min which is 8 chars long

2,478,758,911,082,496<43,608,742,899,428,874,059,776

Thank you for spreading FUD and getting owned by basic math skills.




Does not negate it. Passwords can and often are stolen. Lets assume someone got a keylogger when you entered it once. They got the password but that password is only semi useful to hack in as you can not brute force it due to the limitation of the Google server side.

Passwords can be stolen. The 2 step is a little harder to do. This is one more step to protect your stuff.

I already showed to you that the google random password beats out your secure one. Using Mac keychain is not exactly valid argument for remembering as you can not log in from elsewhere if need be.

I know how to remember long passwords that hard hard to hack. There are tricks and up to 10 chars it is fairly easy to make it look random to everyone but say you.

Also i'm not a mathematician or a data encryption expert but depending on how it's generated, patterns, encryption methods, salts, things I don't even really understand but should can apparently make it easier to figure out .


Look at this site below and see all that goes into making their password unbreakable. It's over my head and i'm a techie.

https://www.grc.com/passwords.htm

 

[munkery]

Well, most sites now a days can afford an SSL certificate so me logging into a site using an encrypted session is a given. I now use lastpass..

It isn't a given, most sites don't use SSL by default.

Facebook, Twitter, and most other popular social media websites don't use SSL by default.

MacRumors, the site that you're logged into when you post in this forum, doesn't have a SSL secured login.

Many ISP provided email services don't use SSL secured logins.

These login credentials are visible in plain text if captured by a packet analyzer.

so, I have one master password I use and lastpass logs me in each site with a highly secure (as the site will allow) password that has been generated just for that particular site and account. So, even if they got that how did they get my appleid info?

Lastpass still send out those credentials in clear text if the login isn't secured via SSL.

Given that most online accounts either have logins that are not secured or don't use the secured login by default, most of the credentials being sent via Lastpass are transmitted in clear text.

If a unique secure password was used for the Apple ID account, then it was compromised by one of the following:

1) from another account that was compromised, such as an email account.

2) malware (what OS do you use?)

3) sophisticated MITM attack.

4) phishing email.

See #14 in the "Mac Security Suggestions" link in my sig for more details.

 

[MorphingDragon]

It isn't a given, most sites don't use SSL by default.

I've even seen web servers that use /dev/null as the SSL random generation file.

Great Stuff.

 

[munkery]

BTW, unless I missed something, it appears that transmission of passwords with Mac Rumors during login uses MD5.

This type of security is not always present with non-SSL logins.

This makes it more work than just sniffing the password to acquire a user's login password.

Further steps are required to compromise the password. For example, cracking the MD5 hash and etc.