Sign in with Apple bug discovery earns developer $100,000

guest · May 30, 2020

Sign in with Apple bug discovery earns developer $100,000
May 30, 2020
https://appleinsider.com/articles/20/05/30/sign-in-with-apple-bug-discovery-earns-developer-100000

Details of a now-patched vulnerability in the "Sign in with Apple" account authentication have been revealed, a zero-day that could have allowed an attacker to take control of a user's account.

Launched in 2019, "Sign in with Apple" is intended to be a more privacy-focused alternative to website and app log-in systems powered by Facebook and Google accounts. By minimizing the amount of a user's data that is used for authentication and account creation, the API also helped reduce the amount of tracking Facebook and Google performed on users, in turn making it more private.
Click to expand...

Disclosed on Saturday by security-focused developer Bhavuk Jain, a zero-day vulnerability in Sign in with Apple had the potential to let an attacker gain access to, and fully take over, a user's account on a third-party application. According to Jain, the bug would have enabled a change in control of the application's user account, regardless of whether the user had a valid Apple ID or not.

Jain responsibly disclosed the flaw to Apple, which led to an award from Apple's bug bounty program worth $100,000. Apple has since patched the vulnerability, but it isn't clear exactly how yet.
Click to expand...

Rasheed187 · Jun 6, 2020

That's why I wonder if this "Sign in with Apple or Facebook" stuff is truly secure. Probably not.

Log in or Sign up

Sign in with Apple bug discovery earns developer $100,000

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Sign in with Apple bug discovery earns developer $100,000

guest Guest

Rasheed187 Registered Member

Useful Searches