[flagged]

Odd that you would omit the part of the text you quoted that contradicts the impression your partial quote creates.

> The images were initially believed to have been obtained via a breach of Apple's cloud services suite iCloud, or a security issue in the iCloud API which allowed them to make unlimited attempts at guessing victims' passwords. Apple claimed in a press release that access was gained via spear phishing attacks.

I also found it notable that the source for the above unlimited password guessing password guessing is an Apple press release that states no such thing.

Also interesting was that all sources in that article suggesting anything about unlimited attempts describe to an app or script (unclear which) called iDar, which the only source to actual name iDar claims that it reports success 100% of the time, regardless of its actual success in guessing the password.

I've no love for Apple. Maybe it's true. But the evidence presented in this wiki article is weak.

Either you didn't read the page you linked or are deliberately lying, the API issue is speculation we know now that it was predominantly spearphishing.

All from the same article:

>"Apple claimed in a press release that access was gained via spear phishing attacks."

> "Apple later reported that the victims' iCloud account information was obtained using "a very targeted attack on user names, passwords and security questions", such as phishing and brute-force attack guessing."

>"Court documents from 2014 indicated that one user created a fake email account called "appleprivacysecurity" to ask celebrities for security information."

>"During the investigation, it was found that Collins phished by sending e-mails to the victims that looked like they had been sent by Apple or Google, warning the victims that their accounts might be compromised and asking for their account details. The victims would enter their passwords, and Collins gained access to their accounts, downloading e-mails and iCloud backups."

>"In August 2016, 28-year-old Edward Majerczyk of Chicago, agreed to plead guilty to a similar phishing scheme, although authorities believe he worked independently and he was not accused of selling the images or posting them online."

>"Garofano's attorney said he had been led into the phishing scheme by criminals."

>"Through a phishing expedition[further explanation needed], he hacked more than 200 people"

All of the other methods of compromise are speculation, what has been unambiguously proven in a court of law over and over again was phishing.

It's a little embarrassing that people are still pushing that particular conspiracy theory a decade after it was debunked.

Not only was "Celebgate" the consequence of a standard phishing attack, but we know from court records that a larger number of Google accounts were breached than Apple accounts.

> A Pennsylvania court has sentenced a man to 18 months in jail for hacking into the accounts of celebrities and stealing nude photos and videos.

Collins tricked his victims - including actresses Jennifer Lawrence, Kate Upton, Scarlett Johansson, and Kirsten Dunst - by sending emails appearing be from Google or Apple.

Collins accessed at least 50 iCloud accounts and 72 Gmail accounts.

https://www.bbc.com/news/technology-37796986

That was a pretty big screw-up. But, it was more than a decade ago.

That's unfortunate, but your passwords should be such that it would take an attacker millions of years to guess the password through HTTP requests.

They were also active participants in prism...

https://en.m.wikipedia.org/wiki/PRISM

What they actually do is a moderate effort to keep app developers from accessing user data. Which is definitely good!

Though the reason for this likely more about keeping the customer relationship with apple then actually protecting the privacy of users, but it's a nicely marketable side effect - and that's definitely a good thing for the users, too!