Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
You didn't even read the articles... People don't break into your iCloud account by guessing your username and password.

They break in using your security questions and other loopholes. If someone knows your real name, they can find just about any answer you have provided to the security questions that Apple asks.

Once they're in, they can re-direct your iCloud account, change the password themselves, and now you're locked out. It can be accomplished within hours. And, with access to your iCloud account, they can use Find my iPhone and Find my Mac to wipe your devices remotely without your consent, and then hold your backups for ransom.

It's also easy to brute force. As one of the websites states, for $200 I could buy an app that will brute force your account since Apple doesn't institute an account lockout when bad passwords are entered.

You should really do yourself a favor and read through the articles I posted. It's an eye-opener how insecure iCloud truly is.

That method of cracking your account goes away the second you turn on two-factor authentication. It's been available for iCloud for a long time. Do I wish that Apple made it mandatory and required a token to login to iCloud? Yes.

But Google doesn't require two-factor authentication, either. And as you can see from the below link you have a much higher probability of someone possessing your gmail information right now if you don't use their two-factor authentication:

http://time.com/3318853/google-user-logins-bitcoin/

Why all the fuss about iCloud, when this Google story is a much bigger issue?
 
"Everyone else does it, so Apple must do it too" isn't an argument. This isn't some low-level person saying Apple doesn't do it, it's the CEO.

If you have specific cases that you know of, you might as well mail tcook@apple.com about them as well as posting them here.
 
Spectrumfox, what services do you use? In your line of thought, you should live in a cave because everyone is selling your data!

I have an Android phone, an iPad, and I use Google services for email, maps, Internet searches, etc. I also have a Facebook account for keeping in touch with family.

I have no qualms about these companies selling my data. I know it's being done, and that it's been done for years. It just doesn't bother me.

However, one thing I refuse to do is allow Google, Facebook, or Apple to backup my data. All my data is backed up locally to my home workstation. iCloud never gets turned on, and Google+ and Facebook don't get access to my photos.

Additionally, I have two-factor authentication turned enabled on all services I have accounts with, so if someone tries to break in I'll know about it.
 
Last edited:
You didn't even read the articles... People don't break into your iCloud account by guessing your username and password.

They break in using your security questions and other loopholes. If someone knows your real name, they can find just about any answer you have provided to the security questions that Apple asks.

It's even worse when some companies (not Apple) use personal information to verify your real identity, only to compare your answers to publicly available data... :rolleyes:

That security logic is up there with "emails my username and password to me when I make an account".
 
http://time.com/3318853/google-user-logins-bitcoin/

Why all the fuss about iCloud, when this Google story is a much bigger issue?

They're both huge issues. I'm not saying Google is innocent in the security game.

I'm simply saying Apple isn't infallible. There are some people here who base their decision to go with Apple solely because of how secure they are and how much they trust Apple with their data.

No matter what Tim Cook says on television, Apple's systems are no more secure than any other system on the Internet.
 
You didn't even read the articles... People don't break into your iCloud account by guessing your username and password.

They break in using your security questions and other loopholes. If someone knows your real name, they can find just about any answer you have provided to the security questions that Apple asks.

Otherwise known as phishing. There is nothing wrong with iCloud's authentication system. Password reset, security questions, etc is used by every competent website. The problem is weak user passwords, the lack of two-factor education and people putting obvious things as their security question answers. None of that is Apple's problem. That's entirely on the users.

It's also easy to brute force. As one of the websites states, for $200 I could buy an app that will brute force your account since Apple doesn't institute an account lockout when bad passwords are entered.

Apple has a lockout on all but one login method, which was a Find my iPhone login for development. Once that was revealed it was quickly patched. Regardless, Apple denied that brute force was used in the celebrity hack which makes sense because even a reasonably secure password can take decades to brute force.
 
Hah... anyone who actually believes Apple isn't collecting data in one form or another is as blind as a one eyed bat.

Seriously, Apple isn't your friend, they're a huge corporation. Their number one goal is to make money. PERIOD.

If you think Apple is any different than Google, or Microsoft, or Facebook, or... on and on... then you're flat out dilusional.

But, hey, keep drinking that Kool Aid and living your life in blisfull ignorance. :cool:

They are different. They have a different business model. It is clear to a 5th grader what the difference is.

The cost of getting caught lying about such things would be much greater than any benefit in the first place.
 
Otherwise known as phishing. There is nothing wrong with iCloud's authentication system. Password reset, security questions, etc is used by every competent website. The problem is weak user passwords, the lack of two-factor education and people putting obvious things as their security question answers. None of that is Apple's problem. That's entirely on the users.

While this is mostly true, Apple's primary problem is they don't allow users to come up with their OWN security questions. They have a stock selection of questions available for people to answer.

All you really have to do to break into an iCloud account is to write down these questions, find a target, and then find out the answers to all of the security questions.

Find the one that the target answered and you're golden.
 
They are different. They have a different business model. It is clear to a 5th grader what the difference is.

The fact that you believe Apple is a "different" multi-billion dollar corporation, and has a different business model than every other multi-billion dollar corporation is cute.
 
While this is mostly true, Apple's primary problem is they don't allow users to come up with their OWN security questions. They have a stock selection of questions available for people to answer.

All you really have to do to break into an iCloud account is to write down these questions, find a target, and then find out the answers to all of the security questions.

Find the one that the target answered and you're golden.

Sure, which is why security questions should be done away with entirely. But again, that has nothing to do with iCloud being insecure and everything to do with security questions being a terrible system. You can phish almost every major website through security questions.
 
Sure, which is why security questions should be done away with entirely. But again, that has nothing to do with iCloud being insecure. You can phish almost every major website through security questions.

Of course you can. That's not my point.

My point is Apple touts endlessly about how secure iCloud is, while at the same time users' iCloud accounts are being broken into on a hourly basis. Tim Cook gets on television and tells people what they want to hear so they'll feel comfortable buying his product.

It's all just lip service to sell more iPhone's. Apple's service is no more secure than any other service.
 
Hah... anyone who actually believes Apple isn't collecting data in one form or another is as blind as a one eyed bat.

Seriously, Apple isn't your friend, they're a huge corporation. Their number one goal is to make money. PERIOD.

If you think Apple is any different than Google, or Microsoft, or Facebook, or... on and on... then you're flat out dilusional.

But, hey, keep drinking that Kool Aid and living your life in blisfull ignorance. :cool:

Yes, but it is the way they make money that is different. Apple makes money by selling a fairly expensive product. It is a onetime transaction and it is pretty clear to the consumer the money being made by Apple. Google and others are making money in a far less clear way. It becomes harder for the consumer to figure out if they are getting a good deal or not.

It is a fundamental difference. And it is one that I like.

But yes Apple is a company. And I doubt they will refrain from mining data to a greater degree in the future. The other fact is that much of this data mining is fairly innocuous to the consumer. So you don't know how Facebook and Google make money off of you, but you mainly don't care because you don't loose too much in the transaction and you don't really notice it that much either.
 
Otherwise known as phishing. There is nothing wrong with iCloud's authentication system. Password reset, security questions, etc is used by every competent website. The problem is weak user passwords, the lack of two-factor education and people putting obvious things as their security question answers. None of that is Apple's problem. That's entirely on the users.

Since I'm not likely to remember them anyways, I usually put in gibberish and keep that info in 1Password. I'm not exactly sure why I save it, since it would be gone if I lost my password anyways, but there it is.
 
Since I'm not likely to remember them anyways, I usually put in gibberish and keep that info in 1Password. I'm not exactly sure why I save it, since it would be gone if I lost my password anyways, but there it is.

Putting gibberish or incorrect answers for security questions is one of the best things you do can to further secure yourself. Just remember what answers you gave in case you forget your password. :D
 
Next time someone asks me why I prefer Apple over Google, I'll tell them that I prefer buying Apple products, not being their product.
 
Next time someone asks me why I prefer Apple over Google, I'll tell them that I prefer buying Apple products, not being their product.

That is a perfectly legitimate and fair answer. But know that Apple does mine your data as well. Apple claims to not sell this data to other companies. It's up to you if you want to believe them.
 
anyone who says they can brute force an account through a network connection is lying unless they already know the password is very weak already. Since many passwords ARE weak, they still stand not totally bad chance of logging in even within a few dozen loging attemps (if there are no lockouts).

Even through the "find my phone" no limit access, you think apple wouldn't notice the hundreds of thousand of login attempts on one account required to crack a long password? Even without a lockout, there is little chance you'd be able to do enough tries to crack the acount without Apple noticing.

Most brute force attacks are done directly on password files or data syphoned from a Web Site DB. Not through the new were your attempts will all be logged.

----------

Of course you can. That's not my point.

My point is Apple touts endlessly about how secure iCloud is, while at the same time users' iCloud accounts are being broken into on a hourly basis. Tim Cook gets on television and tells people what they want to hear so they'll feel comfortable buying his product.

It's all just lip service to sell more iPhone's. Apple's service is no more secure than any other service.

How are they "broken" in too. You choose a crap password, or used your Apple password and ID somewhere else that is easier to hack or you gave your password or Apple ID away through phishing, etc. None of this is directly Apple's fault; should Apple secure people's own computer too, even if its not running any Apple software?
 
Most brute force attacks are done directly on password files or data syphoned from a Web Site DB. Not through the new were your attempts will all be logged.

Anonymous VPN accounts and Tor browser are great for avoiding being logged when you are brute forcing an account password.
 
The way he seems to be going after Google by mentioning how we aren't a product being sold, and then mentions how there is super secret stuff that they're working on makes me think that Apple is going to unveil their own search engine. There was a hint of a rumor about that—it was very sketchy and light on details. A search engine to spite Google. A search engine that is installed by default with every Apple device, but Apple doesn't make a cent off of it. No ads, no tracking, revolutionary search algorithm. I'm skeptical of Apple being able to deliver outstanding services (IMO they're slowly getting better), but if they have somehow made a breakthrough, it could change the course of everything. I think 2015 is going to be really interesting.
 
I don’t believe for one second that there isn’t a way in. This may be a deliberate back door or a bug that has been purposely ignored. I do believe however that Apple have gone much further than anybody else in this regard.

----------

Well said.

Well yeah but people also need to remember that, (there are alternative search engines now), way back Google made your life easier with search. All of that costs money, time and privacy.
A lot of these moaners are the ones that grew up on Google searching to pass time, catch scandal, current affairs, further education etc etc..
They didn’t mind when it was someones else’s privacy at stake.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.