TikTok is making users give their iPhone passwords for unclear reasons | Hacker News Reader

TikTok is making users give their iPhone passwords for unclear reasons

nypost.com

68 pointsharambae44 comments

I wish the article put more emphasis onto the facg that TikTok was requesting the password through a system prompt. They don't have anyone's passwords, just a conformation from the device that the correct password was inputted. This is such a nothingburger.

All that aside...is this an nypost article referencing a Dextero article referencing an (unsourced) reddit comment?

Indeed. If you do a quick image search you can find screenshots of the same prompt for other apps: https://guide.duo.com/static/images/en/iphone-passcode_2x.pn...

But obviously "tiktok = china = bad" doesn't apply, so no ragebait article.

I haven't seen these sorts of native prompts. Even passkey prompts open with a popover toast that covers the bottom part of the screen to confirm which account you want to use. Do you know what mechanism Duo is using in this example?

Edit: could this be a prompt from a failed faceID authentication for the app's secure enclave storage? most of those prompts aren't cancelable, but this tiktok one is

Normally you'll see a prompt like "touch/face id for [app name]". If the authentication fails, you'll have the option to enter your passcode, which opens the screen in the above screenshot.

It’s the NY Post. They’re not really known for high quality reporting.

The cropped screenshot they show with a TikTok logo gives a false impression of what these prompts look like. It very much looks like a native prompt.

https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_...

On the post you linked, OP mentioned that tapping "Cancel" still brought them to their FYP page.

What native prompt does that?

Edit: Another concerning detail is that a native lock screen prompt should show a blurred copy of your phone's background image. This prompt is a single solid color.

Edit 2: perhaps a native passkey prompt with session token fallback? if tiktok is trying to upgrade everyone to passkeys, this could be them setting users up early for a smooth migration, but i'm just speculating

Edit 3: i downloaded TikTok to test, and am immediately presented with a native Passkey prompt upon opening the app (it infact shows a QR code because I don't have a passkey on my phone). It's likely to be a passkey prompt then. But I am really wondering why it's cancelable without any issues.

But even if it is native (putting aside that if TikTok is trying to steal a password they would make it look native, and that tbh. that is somewhat unlikely) there is still one problem.

What is TikTok doing which triggers the OS to prompt the user for a password?

There is some chance that it's something harmless (idk. wield speculative maybe possibility: something like they use some form of passkey API from apple to do client authentication and that API had some changes where it now ask for the password in some situation).

There are many more (but unlikely) possibilities where TikTok is doing something bad or outright nefarious. But lets be honest if TikTok is intentionally doing something bad they are quite subtle about it, as not doing so would likely cause more harm for them then it does good.

But we know TikTok has in the past multiple times done things which would have gotten a "normal" app developer perm-banned due to a breach of the App stores Terms of Service in a intentional consumer harming way, so it is concerning even if they most most likely don't steal your passwords.

Title is inaccurate. It’s vanishingly unlikely that TikTok is asking users for their device pin, Apple would trigger the kill switch and it would be gone before the nypost could write a scaremongering article.

It’s much more likely that iOS is asking for the password.

I think it is orobably technically true that TikTok is making people do it (triggering the event that requires confirmation), but its probably an OS prompt and its probably an OS, more than TikTok, issue if the purpose is unclear.

Perhaps a bug in their recently announced passkeys implementation? https://www.theverge.com/2023/7/17/23798046/tiktok-passkeys-...

That's my guess as well. I haven't used a device without Face ID or Touch ID in a long time, but I guess that on those devices, the OS would fall back to the passcode as a second factor.

Edit: It's almost certainly that. Users that don't have biometrics set up (or presumably also that have biometry attempts exhausted) get this behavior:

> Use Face ID or Touch ID to complete sign in. If you didn’t set up Face ID or Touch ID on your iPhone, enter your device passcode (the code you use to unlock your iPhone).

(from https://support.apple.com/guide/iphone/use-passkeys-to-sign-...)

aha! i downloaded tiktok just now to test, and I'm immediately presented with a passkey prompt: "scan this QR code with a device to sign into TikTok"

If I had a TikTok passkey on my phone at the time, it's likely that the prompt would be an ordinary FaceID auth challenge with a PIN fallback. Perhaps OP has faceID disabled?

You can cancel the prompt and continue in the app as normal. It's a sketchy prompt to be sure, but it's easily ignored.

My uneducated guess is a keychain prompt, since I'm signed in with my apple ID via OAuth2 (with the email hidden, etc).

If you enter the wrong PIN, does it let you continue anyway? That’s a simple test to see if it’s the app or the OS that’s asking.

I’m not so sure — what if an attacker can just run a test to see if the PIN is valid, and if not they can just shake the PIN entry and ask again like iOS does.

And since every app is essentially a full screen modal, this sort of PIN phishing would probably be difficult for a human to detect. I bet you could recreate the iOS passcode prompt in SwiftUI relatively simply.

There's still no way for TikTok, or any app, to determine your password hash, so even if they test for validity (by conforming to OS pin restrictions), how would they test for veracity (being given the user's ACTUAL) passcode.

This simplicity I never understood. Windows at least does something with the screen when asking for privileges.

What can you do with the pin though? Does iOS provide any sort of API that allows you to pass in a pin for verification?

Yes, you can require the user to enter their PIN before allowing usage of a keychain secret, for example: https://developer.apple.com/documentation/security/secaccess...

But for that you can't pass in a pin yourself. You're relying on the OS to obtain and verify the pin.

Windows doesn’t do anything that you couldn’t replicate in your own program.

It does, it's called secure desktop.

https://en.wikipedia.org/wiki/User_Account_Control#Features

That’s not the same thing. Secure Desktop solves the problem of trusted input, i.e. you don’t want untrusted user space apps to be able to interact with an OS dialog. (Note that in Secure Desktop, you’re not entering any password; you’re reading a message and allowing or declining a privilege escalation.)

For iOS passcode verification, you’d need both secure input (which the UI almost certainly achieves), but also trusted output of at least one bit of information: Whether the user is currently interacting with the OS (or a trusted application) or an (untrusted) application.

>(Note that in Secure Desktop, you’re not entering any password; you’re reading a message and allowing or declining a privilege escalation.)

If you're a standard user, you'll be asked for the administrator's username/password on the secure desktop. Also, the secure desktop encompasses other parts of the system as well, like the lockscreen or the password change option on the ctrl-alt-del screen.

>For iOS passcode verification, you’d need both secure input (which the UI almost certainly achieves), but also trusted output of at least one bit of information: Whether the user is currently interacting with the OS (or a trusted application) or an (untrusted) application.

At least on windows that's provided by the secure attention key sequence. It's not enabled by default, but there's a group policy for it: https://learn.microsoft.com/en-us/windows/security/threat-pr...

Ah, yes, a secure attention sequence works as well for a trusted path!

Unfortunately, it's no longer the default on Windows as you mention (presumably because OS-privileged malware is now the norm, so the net benefit is probably small?), and iOS only very rarely and inconsistently uses their secure attention sequence (i.e. the double home/lock button tap used for Apple Pay).

This reddit user reports that tapping Cancel still brought them to their FYP page.

https://www.reddit.com/r/Tiktokhelp/comments/186ipwb/tiktok_...

You can cancel the prompt and continue on in the app as usual. It's sketchy as fuck, but I've been able to effectively ignore it for a good month now.

Is there no way for the app to check if the PIN is correct?

No, because if there was the app could either brute-force your pin or lock you out by trying it too often :-) If there was a way this would be a pretty big vulnerability from Apple’s side. Even in the unlikely event that there is some private API, there is no chance you could pass an App Store review with that in your code

Could this be as simple as a keychain key with the appropriate access permissions [1] set?

It would be a very bad idea to do that without clear user messaging, but not necessarily nefarious.

[1] https://developer.apple.com/documentation/security/secaccess...

> Even more concerning, experts say the reasons why TikTok — which had reportedly been caught red-handed spying on journalists in the past — remains unclear.

Is there a missing word here? What is it?

There's a dead reply here that doesn't see the issue and instead thinks I misunderstood the sentence structure, which is interesting to me. Maybe they mentally inserted a word and didn't know, or maybe they just kind of get the tone -- it's a sentence critical of tiktok -- and don't notice that it carries no meaning. Just kind of interesting how differently people process info.

I understand what you are parsing, and it is missing something, but I think it reads fine.

Like..

"Experts say the reasons why TikTok (_topic of the article_) remains unclear."

Or perhaps it's referring to the previous sentence or paragraph. I do think the hyphenated subsection sets the tone too.

Made up example:

"The President today issued a statement. Experts says the reason why The President - who has issues statements in the past - remains unclear.

I didn't even know an app could ask for your passcode. I've never seen that and would think there's not an API for it. Hopefully an iOS developer can chime in.

You can tie key usage to a successful passcode entry. The app never sees the passcode; it’s handled by the OS: https://developer.apple.com/documentation/security/secaccess...

I recently logged into Amazon via Safari on my iPhone and it asked for my passcode/Face ID. I didn’t know there was a JS API to authenticate that way, but I guess there is.

That’s WebAuthN, also known as “passkeys”.

I feel like this has to be a bug in implementation, it seems like they have competent devs I doubt they’d do something this brazen on purpose

Is there a better source for this? Nypost is one of the worst scandal generating clickbait sites out there

I hope Apple's banhammer will solve this quickly

What is there to solve?

I am still surprised on how people install on their phones apps from Facebook/Meta, TikTok, and other shady companies.

We've seen here in comments were people say that they access FB over their phone's browser JUST SO they don't install that data siphon to their phone.

When you are a 12 year old and all your friends are on this and you would be alienated in a second from your social life at school with this nonsense - you would install it, haha.

Reply on news.ycombinator.com