Severe security risks with family share, app and in-app purchases

Question

Level 1

9 points

Severe security risks with family share, app and in-app purchases

In particular when children (but actually in the end all users) purchase on purpose or accidentally an app or in-app goods by default the organizer (and of cause the purchaser) must always be actively asked for authorization, but this is NOT the case! The active request for app downloads is by default off in family share and will stay off if it is not activated (each time) by the organizer. However, a purchase request must always stay active at least after a short lag time by default! Not the case! Furthermore, in-app purchases can slip through once an app has been downloaded. This lack of security can result in substantial financial damages where the iTunes-Store does not help at all (I actually suffer from that and witness the clear no help from iTunes Store for purchases my son did of which not even he was made aware of)! While for logins and regular online purchases 2-way authentication and active purchase confirmation is standard, regarding payments for apps and in-apps for Apple these fundamental security measurements are missing. Good for the iTunes-Store revenues bad for the users.

Posted on Aug 10, 2019 2:17 AM

Reply

Answer 1

14biotec Author

Level 1

9 points

Aug 10, 2019 6:24 AM in response to King_Penguin

As mentioned in my post I of cause did contact the iTunes store without getting help on resolving the issue. This is to letting everyone know about this security issue and hope through better awareness that it will be eventually be changed for the better to prevent at least others running into the same trap. It really can hit everyone and is IMHO not really visible enough to every user how sloppy app and in-app purchases are handled by the iTunes store. In posts it often reads easy to charge back purchases with the iTunes store but this is not what happend to me. In the end these pootential problems can entirely be prevented with proper verification of a purchase request which simply does not take place. Apple pay is clearly a no go with these insufficient security measurements.

Reply