Apple Freak
A
In response to Apple Freak.
Likewise, the data was obtained through one of the interfaces that this app uses for the Pods feature, meaning this information was sent to any user that hovered over another user's profile pic (even if it was otherwise invisible to the user).
11:21 AM - Feb 05, 2024
0
0
Apple Freak
A
In response to Blair Houghton.
Yep, the password hash (basically a one-way encrypted form) was leaked. These hashes weren't salted (salts being a way to make it harder to figure out what the original password was), so combined with weak presets and short max passwords, it's entirely possible they can be decrypted easily enough.
11:19 AM - Feb 05, 2024
2
0
Apple Freak
A
In response to Apple Freak.
For the tech averse, this means that even without access to your email, anyone can reset your password and take over your account, even with 2FA enabled. And, even then, it'd be easy enough to decrypt your password from what was leaked and get your original password in plaintext.

That's abysmal.
11:13 AM - Feb 05, 2024
0
3
Apple Freak
A
In response to Christopher Bouzy.
Saw this from Troy's writeup and had to make an account. That disclosure report minimizes what was leaked so hard I'd call it actively deceptive. No, the passwords themselves weren't leaked, but when you include the actual unsalted hashes, 2FA seeds, and PW reset codes, is that really any better?
11:04 AM - Feb 05, 2024
1
1
loading...
{{ notificationModalContent }} {{ promptModalMessage }}