http://iphone-services.apple.com/clbl/unauthorizedApps

I wonder how long it will be before some hacker figures out how to use
this mechanism for a malicious attack on iToys running the 2.x software.

I hope that the iToy actually verifies that the page is signed by Apple's
Verisign-issued certificate, as opposed to any CA-issued certificate (or
worse, some self-signed certificate). If not, the task is trivial.

The iToy does not offer user control over certificates, although Mail.app
does prompt (once) in the event of a self-signed certificate for IMAP or
POP3 connections. Safari, however, does NOT seem to report certificate
issues.

There seem to be some good hacking opportunities here.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Mark Crispin wrote:

> I wonder how long it will be before some hacker figures out how to use
> this mechanism for a malicious attack on iToys running the 2.x software.
>
> I hope that the iToy actually verifies that the page is signed by
> Apple's Verisign-issued certificate, as opposed to any CA-issued
> certificate (or worse, some self-signed certificate). If not, the task
> is trivial.
>
> The iToy does not offer user control over certificates, although
> Mail.app does prompt (once) in the event of a self-signed certificate
> for IMAP or POP3 connections. Safari, however, does NOT seem to report
> certificate issues.
>
> There seem to be some good hacking opportunities here.
>
> -- Mark --


Wunder-, I mean, blunder-bar!

Mark Crispin <mrc@Panda.COM> wrote in
news:alpine.OSX.1.10.0808080914150.10599@pangtzu.p anda.com:

> I hope that the iToy actually verifies that the page is signed by
> Apple's Verisign-issued certificate, as opposed to any CA-issued
> certificate (or worse, some self-signed certificate). If not, the
> task is trivial.
>
>

As utterly arrogant as Apple is, I doubt it.

Mark Crispin <mrc@Panda.COM> wrote in
news:alpine.OSX.1.10.0808080914150.10599@pangtzu.p anda.com:

> -- Mark --
>
>

Mark, are you at NYU?

Just curious.