While it's still possible that even complex passwords were discovered through alternate methods It's hard to say that is more likely than Apple's iCloud servers being compromised. I'd expect Apple to have used the same security methods that have kept iTunes servers secure over the years and I wonder why it seems to be limited to so few users if it's an account server hack which should open up millions of potential user accounts.


A bit off topic: One thing I'd like Apple to add to iCloud is to see what devices and what IP addresses (for web based access) are connecting to iCloud for any services. This is important because my Mail, Photos, iMessage, Contacts, Calendar and Find My iDevices are all syncs via one account which makes it easy for a single person to spy on your activates and whereabouts.

The fact that this person is an IT professional with 10 years experience does not add validity to his statement. I've known plenty of IT professionals - some smart, some not as smart. Why should we just "trust him?" Maybe a coworker watched him type his password. Or someone was looking over his shoulder while he typed on his iOS device (where the last character is shown as you type it) Maybe someone put a key logger on his computer at his job.

Very curious circumstances ("I never use my iCloud account") with a complete denial of mea culpa by all posters.  Several of the posters are convinced their passwords are nigh impenetrable (randomly generated, alphanumeric and special characters with caps and lower case letters) and they are not "n00bs" who call tech support.

I believe if iCloud were hacked we would see wide spread instances of spam rather than ten posters.  While there are likely ten or one hundred times more people who aren't posting about the spam that is still a drop in the bucket of iCloud users.

This guy being a Pro means that he knows that it's still possible to brute force a random password. That was something like less than 100 out of millions of users actually shows that Apple's security is tight and someone did just get lucky with the randomizers. 

I know a white hat that tried this kind of stunt just to prove to a client that it was possible. He had his script drop all passwords that had words, was less than 12 characters, didn't have at least one number and one symbol. He also checked all number sequences against the zip code listings in the country and removed any password with that sequence. Took something like 5 days but the clients 'totally impossible to break' password was broken. 

This particular white hat actually said that most of the time when he hacks a password for a client to show security issues it's not the password that gets him in, it's the security question. As the WH put it, the best password in the world doesn't mean jack if your question is "who is Sir Fluffy Barks A Lot" and he can go to Facebook, search the same email and there is your dog in bold living color all over the page. And he's seen it. A lot. Even with corporate clients. They have where they work on their page so even though the emails are different he can still match it up and 99% of the time the answer to the question is there 

It's also possible that these folks are just lying about how good their passwords were or that they got phished and are too embarrassed to admit it so they are blaming Apple. Even IT Pros can be fooled because their arrogance makes them sloppy

Quote:

Originally Posted by SolipsismX 

A bit off topic: One thing I'd like Apple to add to iCloud is to see what devices and what IP addresses (for web based access) are connecting to iCloud for any services. This is important because my Mail, Photos, iMessage, Contacts, Calendar and Find My iDevices are all syncs via one account which makes it easy for a single person to spy on your activates and whereabouts.

I don't consider that "off topic" and I agree entirely.  In fact, everyone please submit a feature request here.  You can just copy and paste SolipsismX's text.

If you would like to make my day, you can copy and paste the following text into another feature request for iTunes Security Info here:

Greetings,

Please add questions that the average person over 40 can actually remember, more imporantly see the website listed above for security question best practices:

In which city, county and state were you born?

What is your maternal grandmother's maiden name?

Thank you very much for your time and consideration,

"MacBook Pro"

Interesting that most of hacked people claim to be IT. Why I am not feeling better about IT people now?!

Quote:

Originally Posted by SolipsismX 

A bit off topic: One thing I'd like Apple to add to iCloud is to see what devices and what IP addresses (for web based access) are connecting to iCloud for any services. This is important because my Mail, Photos, iMessage, Contacts, Calendar and Find My iDevices are all syncs via one account which makes it easy for a single person to spy on your activates and whereabouts.

It was possible to see your devices with MobileMe. I don't know why you can't with iCloud. I think this is a basic feature that needs to be added. If you write a feature request for this we can then copy and paste it into Apple feedback form.

Quote:

Originally Posted by Gustav 

The fact that this person is an IT professional with 10 years experience does not add validity to his statement. I've known plenty of IT professionals - some smart, some not as smart. Why should we just "trust him?" Maybe a coworker watched him type his password. Or someone was looking over his shoulder while he typed on his iOS device (where the last character is shown as you type it) Maybe someone put a key logger on his computer at his job.

 

Quote:

Originally Posted by SolipsismX 


Or he logged into a machine that was compromised.

Or someone is capturing his wireless network traffic.

Or someone hacked the random password generator (and those 10 posters all using the same application).

Or someone really did use a brute force attack on their password.

It took me about 30 seconds to figure out a "crack" for iCloud if I have someone's Apple ID and considering the ubiquity of iCloud you can probably just try any name at iCloud.com with some small chance of success.  Unfortunately, iCloud is very vulnerable to social hacks apparently (based on the 30 second "crack").  I should add that I am no Charlie Miller either so this is something any computer savvy person could discover (disclaimer: I do have formal education in network administration).

Quote:

Originally Posted by NasserAE 

It was possible to see your devices with MobileMe. I don't know why you can't with iCloud. I think this is a basic feature that needs to be added. If you write a feature request for this we can then copy and paste it into Apple feedback form.

Haha.  See the post immediately preceding yours.  I just copied and pasted his text verbatim.

As for security questions, I always answer them with nonsensical answers.

What was your mother's maiden name?

Traffic light is green.

What is your pet's name?

Do you like yellow?

Where were you born?

I ate a pear.

And answer them differently for each site. Store them in an encrypted file or write them down and store the paper securely and you're good.