{"id":713,"date":"2008-07-08T13:30:51","date_gmt":"2008-07-08T12:30:51","guid":{"rendered":"http:\/\/www.itwriting.com\/blog\/713-apple-accused-of-security-blunder-highlights-cloud-risks.html"},"modified":"2008-07-08T13:30:51","modified_gmt":"2008-07-08T12:30:51","slug":"apple-accused-of-security-blunder-highlights-cloud-risks","status":"publish","type":"post","link":"https:\/\/www.itwriting.com\/blog\/713-apple-accused-of-security-blunder-highlights-cloud-risks.html","title":{"rendered":"Apple accused of security blunder; highlights cloud risks"},"content":{"rendered":"

According to this post<\/a>, someone at Apple committed a huge security blunder, giving the password to someone\u2019s Apple ID to a third party. How was this accomplished? Someone emailed from an email account not associated with the Apple ID, and asked for the password. Apple apparently just reset the password and emailed it to the enquirer.<\/p>\n

I haven\u2019t verified the claim; but even if it is false, it highlights the risks of living the cloud life. Here\u2019s what victim Marko Karppinen emailed to Apple:<\/p>\n

\n

Apparently based on a single-line email inquiry, you have allowed a third party access to:
– My personal details
– My personal email
– All the files stored on my iDisk
– Everything I’ve synchronized to .Mac, including my Address Book, Bookmarks, Keychain items, etc.
– My credit card details as stored in my Apple Store profile
– My iTunes Music Store Account
– My ADC Premier membership, including the software seed key and other assets
– The iPhone Developer Program’s Program Portal, including details of our development team<\/p>\n

Frankly, this makes me so angry that I can’t see straight.<\/p>\n<\/blockquote>\n

Simon Willison, whose blog alerted me<\/a> to the incident, mentioned a few weeks ago<\/a> the security problem inherent in any site which will email you a password:<\/p>\n

\n

I have a very simple rule of thumb for whether or not a site should consider whitelisting OpenID providers: does the site offer a \u201cforgotten password\u201d feature that e-mails the user a login token? If it does, then the owners have already made the decision to outsource the security of their users to whoever they picked as an e-mail provider.<\/p>\n<\/blockquote>\n

Let\u2019s bear in mind too that email mostly travels through the internet as plain text, vulnerable to interception.<\/p>\n

Thought for the day: how much of your data is protected only by a simple username\/password combination, and presuming there is some, how well protected is that password itself?<\/p>\n

I imagine Apple will be tightening up its procedures, if the incident above is confirmed, since it was easily avoidable.<\/p>\n

Technorati tags: apple<\/a>, security<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

According to this post, someone at Apple committed a huge security blunder, giving the password to someone\u2019s Apple ID to a third party. How was this accomplished? Someone emailed from an email account not associated with the Apple ID, and asked for the password. Apple apparently just reset the password and emailed it to the … Continue reading Apple accused of security blunder; highlights cloud risks<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,75],"tags":[],"class_list":["post-713","post","type-post","status-publish","format-standard","hentry","category-apple","category-security"],"_links":{"self":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts\/713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/comments?post=713"}],"version-history":[{"count":0,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts\/713\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/media?parent=713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/categories?post=713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/tags?post=713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}