Friends Kingdom: Re: [iPad] Ouch a real iPad Virus / Ransomware

Spearhead an initiative using multi-factor authentication. Most of the best people are. There are always good ideas. Amazon and better sites are laden with multi-factor authentication at several layers.
http://redmondmag.com/articles/2014/05/01/lesson-from-target-breach.aspx

Many of the security we take for granted now or products we took for granted were considered impossible or infeasible till people though out of the box and solved the problems in new ways.

There may be ways to get the bigger better sites (Amazon, iTunes, NetFlix, etc.) in long term to switch to certificates or biometrics instead of passwords or as a component with passwords, or even block cross site passwords - a salted-checksum of a password I attempted to create on one of those sites could hit a webservice and give me a "disallowed, used elsewhere" message.

All security is about hardening and better design, not invulnerability.

On Sat, May 31, 2014 at 9:36 AM, Jim Saklad jimdoc@icloud.com [iPad] <iPad@yahoogroups.com> wrote:

>> Hopefully Apple will patch quick and remind us why they are security superheroes while Windows still is vulnerable to Crypto and ICE and a few dozen ransom wares that have been out for over a year.
>
> Right in the article is the line:
> "seem to involve any malware or malicious activity on the device itself"
>
> I don't understand your heading -- what has happened is neither a virus nor is it Ransomware. Instead it is a person who has been able to take control of the iDevice from a remote location through using Apple's own anti-theft protocol.
>
> Yes it is asking for a ransom, but true ransomware is a piece of software which is loaded onto your device and then takes control until you pay the ransom.
>
> This is just a clever person outsmarting Apple's own "lock this device if it gets lost or stolen" protocol.
>
> How exactly do you expect Apple to patch things so that this can't happen?
>
> David H. Bailey

More relevantly, since it is apparently NOT a defect in iCloud security, how can Apple patch "users so stupid as to use the same password for iCloud as elsewhere" ?