Random Apple ID Password Prompts Are Counterproductive To Security and Experience

Originator:brian
Number:rdar://11348669 Date Originated:4/30/12
Status:Open Resolved:
Product:iPhone/iPod Touch Product Version:9B179
Classification:Security Reproducible:Always
 
To a user at seemingly "random" times, while doing absolutely nothing (e.g., at the home screen, in another app), iOS will ask for the password for the user's Apple ID. Thus far I've parameterized this to occur when iCloud is trying to keep things (apps, music, etc.) in sync after some amount of time has passed.

Regardless, this is a serious issue. The prompt is "valid" insofar as it's legitimately from you guys, and is presumably being displayed by necessity. That being said, the prompt has NO explanation and does not obviously occur from a user-prompted action. This simultaneously creates a dangerous scenario — you are conditioning users to blindly enter their password for no apparent reason — AND it's a user-experience nightmare, as the user is now forced to deal with this modal dialogue that they've done nothing to invoke.

Comments

Duped as rdar://11381666

By max.desyatov at May 4, 2012, 9:45 a.m. (reply...)

Duped as rdar://11356948

Summary: To a user at seemingly "random" times, while doing absolutely nothing (e.g., at the home screen, in another app), iOS will ask for the password for the user's Apple ID. Thus far I've parameterized this to occur when iCloud is trying to keep things (apps, music, etc.) in sync after some amount of time has passed.

Regardless, this is a serious issue. The prompt is "valid" insofar as it's legitimately from you guys, and is presumably being displayed by necessity. That being said, the prompt has NO explanation and does not obviously occur from a user-prompted action. This simultaneously creates a dangerous scenario — you are conditioning users to blindly enter their password for no apparent reason — AND it's a user-experience nightmare, as the user is now forced to deal with this modal dialogue that they've done nothing to invoke.

Steps to Reproduce: Turn on automatic downloads of apps or music, or turn on iCloud syncing. Download an app on another device. Wait for iOS to prompt you for your password on the first device before it can initiate the download.

Expected Results: Everything works.

Actual Results: You are prompted for your iTunes password seemingly at random.

Regression: Users were not frequently bothered with modal alerts requesting their password. Malicious apps and even websites may be able to use this new prompt in social engineering to harvest passwords. iOS works best when things like this don’t happen; random modal alerts warning about security with password entry forms should be relics of the PC era.

Notes: I don’t understand why the password must be entered time after time.

By joe at May 1, 2012, 8:08 p.m. (reply...)

Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!