Apple Apologizes After Stolen Apple ID Credentials Aided in Phishing Attack in China

[KPandian1]

Please delete.

 

[DaveN]

While the links are the clearest evidence that message is a fake, one need only look at the poor grammar to get a hint that it's not a legitimate message: "You are in charged for your subscription." And this is one of the better ones. Seems like many phishing messages don't even try to get English right these days. I wonder how much more successful they'd be if they learned to proofread.

They also need to learn how companies price things. A company won't charge $150.99. They would charge $149.99. I think the other one was something like $120.66. At least there are a lot fewer "I came into a lot of money. Give me your bank account information and I will share it with you" emails.

 

[KPandian1]

Putting your seatbelt on while driving is optional as well

Nope.It is illegal in the USA also! Has been so in Europe, even in the backseat, for a long time, decades.

Hands-free still catching up in this country, and the cops are still ignorant of the law!

 

[Tech198]

With two factor being an option, to 'assist' provide stronger means to access an account, why did Apple apologize?... Its the users fault for leaving the gate open...

I bet these users weren't even using complex passwords. Having said that

 

[BC2009]

No, I'm saying that as long as the non-2FA option is available, it't Apple's responsibility to protect the data of the users who are not on 2FA.

That’s disingenuous of you. If you gave your front door key to a thief it is no longer Kwikset’s responsibility to protect your home from access by that thief.

1FA by its very nature means if you provide the required credentials then you have access. There is nothing more Apple could do without stepping the user up to some form of 2FA despite the user declining that option.

Apple’s only responsibility at that point is to protect your data from other vectors or attack. Which is not what happened here. In this case phishing attacks were used to obtain user credentials.

 

[szw-mapple fan]

That’s disingenuous of you. If you gave your front door key to a thief it is no longer Kwikset’s responsibility to protect your home from access by that thief.

1FA by its very nature means if you provide the required credentials then you have access. There is nothing more Apple could do without stepping the user up to some form of 2FA despite the user declining that option.

Apple’s only responsibility at that point is to protect your data from other vectors or attack. Which is not what happened here. In this case phishing attacks were used to obtain user credentials.

Sure, but in this case it's more like you live in a gated community managed by Apple and someone stole your key on the bus. While it may not be up to Apple to make sure your password can't get stolen they should at least try their hardest to deter thieves who has the key.