Janky Apple ID Security(mjtsai.com)
mjtsai.com
Janky Apple ID Security
https://mjtsai.com/blog/2024/04/26/janky-apple-id-security/
30 comments
This happens when some device is being offline for a while (30+ days?) and goes online again
Yep happened to me, I have two iphones, one is on a cheap phone provider and I justhave it for when I need a second phone for whatever. I fired it up the other day and got one of these messages.
It actually happens if a device has been offline for about 3 days for me.
I've had it happen recently after installing software updates.
> but the sheet was broken
Apple's Web services have been a shitshow, for many years. I suspect that several iOS screens are little more than WebViews into their Web services.
It's worst, on the backend, in things like App Store Connect, or Developer Center.
Ironically, they tend to work better on Chrome, than on Safari, and my workflow for encountering issues, is to reopen the page in Chrome.
Apple's Web services have been a shitshow, for many years. I suspect that several iOS screens are little more than WebViews into their Web services.
It's worst, on the backend, in things like App Store Connect, or Developer Center.
Ironically, they tend to work better on Chrome, than on Safari, and my workflow for encountering issues, is to reopen the page in Chrome.
Nope, they don't really rely on WebViews unless you're in Safari. They do have an extensive API surface, and a lot of Swift stuff consumes it directly.
I know that most of the infrastructure apps in all Apple operating systems, nowadays, are SwiftUI, so it makes sense that they aren’t WebViews. SwiftUI has a definite UX “flavor.”
I’m not thrilled with some of the choices they made, irt information architecture, and basic UX, but they are consistent.
I’m not thrilled with some of the choices they made, irt information architecture, and basic UX, but they are consistent.
Except isn’t the settings pane on Mac OS using react or something? I know it feels different and I kind of hate it.
Only the iCloud panel is
Yea that’s what I figured. The one that pulls data from the web with every click. It just bugs me when a view will sometimes render absolutely nothing, sometimes while checking subscriptions, other times in the middle of a flow like adding hardware keys. UI’s that fail to produce feedback need to disappear.
> I went to Settings ‣ Privacy & Security ‣ Location Services ‣ System Services ‣ Significant Locations to check, and for some reason the only location in the list was the grocery store that I go to once every two weeks.
This is the most worrying aspect of the messup. Locking out the owner is scary. Admitting a thief is terrifying.
This is the most worrying aspect of the messup. Locking out the owner is scary. Admitting a thief is terrifying.
Reading various forum and social media posts, this seems to be limited to @me.com and @mac.com addresses. Anyone seen anything else outside of that?
Smells like credential stuffing attack to me at the moment which has triggered some rather vicious account protection measures.
Smells like credential stuffing attack to me at the moment which has triggered some rather vicious account protection measures.
I have me and Mac and haven’t seen this issue.
Slightly tangential but I'd sometimes wish for a 3rd party option for such accounts. You can have a gmail, an icloud mail or your own email domain as email is a (well?) defined standard. Why can't I do the same with my iPhone? Back up my device to my own NAS instead of iCloud. Having such a standard would force accountability - not that I consider Apple's security poor, but rather that it could be better.
Super strange, I'm seeing the exact same thing, the only significant location is a grocery store that I semi-frequent.
See also: Apple users are being locked out of their Apple IDs with no explanation https://news.ycombinator.com/item?id=40177617
I just checked my significant locations and all it has is my home. I guess that’s lucky. It usually also has my office where I spend quite a bit of time. Hopefully they recover from whatever outage is going on.
Could a (nation state?) hacker group be attacking Apple?
Maybe this is not their fault at all but the result of some others pressure on certain (undocumented?) API’s or some such thing?
Maybe this is not their fault at all but the result of some others pressure on certain (undocumented?) API’s or some such thing?
> Maybe this is not their fault at all but the result of some others pressure on certain (undocumented?) API’s or some such thing?
Both things can be true at the same time.
Both things can be true at the same time.
[deleted]
[deleted]
So when I logged back in there was no particular issue, I wonder if there is a correlation between the two. It makes me wonder if something on Apples side has been compromised.