{"id":8346,"date":"2014-01-21T17:29:56","date_gmt":"2014-01-21T22:29:56","guid":{"rendered":"http:\/\/mjtsai.com\/blog\/?p=8346"},"modified":"2016-04-08T13:36:54","modified_gmt":"2016-04-08T17:36:54","slug":"calendar-app-asks-for-apple-id-and-password","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2014\/01\/21\/calendar-app-asks-for-apple-id-and-password\/","title":{"rendered":"Calendar App Asks for Apple ID and Password"},"content":{"rendered":"

Neven Mrgan<\/a>:<\/p>\r\n

For years I’ve rejected app ideas that would require the user’s Apple ID and password, certain that Apple would reject such apps swiftly. Now, Sunrise app—which asks for this info, and a whole lot more—is not just approved, but prominently featured. Sigh.<\/p><\/blockquote>\r\n

A previous version of OmniFocus<\/a> also asked for your iCloud login info, since there was then no API for reminders. iOS does have an API for calendar access, but apparently it doesn’t cover everything the Sunrise<\/a> (App Store<\/a>) developers wanted to do. A couple months ago, they had a security breach<\/a> and recommended that customers change their iCloud passwords. This does not inspire confidence, but I wouldn’t focus too much on this particular developer. These days, your Apple ID is the master key to all sorts of personal information and privileges, including the ability to remote wipe iOS devices<\/a> and access your Mac<\/a>, even if<\/a> you didn’t share your FileVault 2 recovery key with Apple. It doesn’t seem prudent to share it with anyone.<\/p>\r\n

Update (2014-01-22): Marco Arment<\/a>:<\/p>\r\n

I couldn’t believe it, so I downloaded the app myself and took these screenshots.<\/p><\/blockquote>\r\n

Update (2014-01-23): Sunrise<\/a>:<\/p>\r\n

When you type in your iCloud credentials, they are sent to our server only once in a secured way over SSL. We use them to generate a secure token from Apple. This secure token is the only thing we store on our servers, we never store your actual iCloud credentials.<\/p><\/blockquote>\r\n

Marco Arment<\/a>:<\/p>\r\n

This is better than storing<\/em> your password in their database, but it’s still not very secure by modern standards: they’re still taking on the responsibility of transmitting it securely from the app, receiving it securely on the servers, sending it back<\/em> to Apple securely to get a token, ensuring no tools, proxies, or analytics<\/a> are caching or logging it along the way, and ensuring that their servers aren’t quietly hacked and nobody’s monitoring the application to capture the credentials in flight.<\/p><\/blockquote>\r\n

Update (2014-01-30): Sunrise<\/a>:<\/p>\r\n

Since our 2.11 version, we are not sending iCloud credentials to our servers, the app generates the secure token client-side.<\/p><\/blockquote>","protected":false},"excerpt":{"rendered":"

Neven Mrgan: For years I’ve rejected app ideas that would require the user’s Apple ID and password, certain that Apple would reject such apps swiftly. Now, Sunrise app—which asks for this info, and a whole lot more—is not just approved, but prominently featured. Sigh. A previous version of OmniFocus also asked for your iCloud login […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"","apple_news_api_id":"","apple_news_api_modified_at":"","apple_news_api_revision":"","apple_news_api_share_url":"","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[91,707,16,31,26,48,730],"class_list":["post-8346","post","type-post","status-publish","format-standard","hentry","category-technology","tag-appstore","tag-apple-id","tag-icloud","tag-ios","tag-iosapp","tag-security","tag-sunrise"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/8346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=8346"}],"version-history":[{"count":5,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/8346\/revisions"}],"predecessor-version":[{"id":14133,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/8346\/revisions\/14133"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=8346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=8346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=8346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}