Is this request really from Apple, with it's first word misspelled?

I've started getting this box showing up on my Mac OS 11.6.5 asking for my confidential stored information in something I've never heard of called AppleIDClientIdentifier that it says is in my keychain, what ever that is.


I ignore it, even if from Apple because it makes no sense and the first word in it, accounts, is misspelled.


So, any idea who or this hacker is or what they likely intend to do if I'd been foolish enough to give them the password, even if I knew what it was. I have to change all the secondary passwords practically every time I go to an area where Apple requires a password different from my log onto computer password, which will forever be my biggest complaint about Apple, why do I have to have 3 or 4 more different passwords after I've already entered the locked Apple vault that is my Mac.


It's like if at work I had to have a pocket full of different keys. One to get in the building, then one to my office, another for my desk, another for the restroom, another for the break room. That would be so much easier too, having keys, but keeping track of all these passwords that we have everywhere with 8 characters or 12, and a special character, upper case, lower case, number, not in sequence, that's too easy, you can't use one used long ago, that's too similar to one of your others..


I'm not a secret agent or manager of the Gold Vault at Fort Knox, and I don't care much about a hacker wanting to read my boring email or come here and pretend to be me to ask a dirty question or something.


I hate the password obsessions Apple and others have, but today, I hope you less irritated password user friends might advise me on this box.

Do I just ignore this apparent fake message or do I do anything to get it's gremlin out of my Mac?


Thank you.



iMac, OS X 10.11

Posted on May 24, 2022 4:40 AM

Reply
Question marked as Top-ranking reply

Posted on May 26, 2022 6:58 AM

The request is valid, but your concern is equally so.


accountsd is a macOS process that refers to a daemon used to access information required for your Apple / iCloud accounts. The more important question is when does that dialog appear. For example, the dialog may appear immediately upon using some Apple product or service that requires authentication, and you did not previously grant that authorization. In that case you can be comfortable providing it.


Requests for your login credentials should never come as a surprise.


Back to your concern: A core tenet of Apple's design philosophy is to minimize or eliminate needless and distracting user interaction. In my opinion this counts as one of those annoyances for no other reason that the accountsd process amounts to technical minutia users ought not to even know exists. They're asking for trouble when completely valid and legitimate process names are similar to those used by illegitimate or malicious apps or processes. For example rapportd is an equally valid macOS process (daemon) but is frequently confused with a popular "banking security" product that will effectively prevent your Mac from working and render it practically useless. It is a very short step from there for a bad actor to leverage obscure macOS process names in an effort to obscure its intent.


I encourage you to express your highly valid concerns to Apple using their feedback portal: Feedback - macOS - Apple

Similar questions

10 replies
Question marked as Top-ranking reply

May 26, 2022 6:58 AM in response to RocknRowBoat

The request is valid, but your concern is equally so.


accountsd is a macOS process that refers to a daemon used to access information required for your Apple / iCloud accounts. The more important question is when does that dialog appear. For example, the dialog may appear immediately upon using some Apple product or service that requires authentication, and you did not previously grant that authorization. In that case you can be comfortable providing it.


Requests for your login credentials should never come as a surprise.


Back to your concern: A core tenet of Apple's design philosophy is to minimize or eliminate needless and distracting user interaction. In my opinion this counts as one of those annoyances for no other reason that the accountsd process amounts to technical minutia users ought not to even know exists. They're asking for trouble when completely valid and legitimate process names are similar to those used by illegitimate or malicious apps or processes. For example rapportd is an equally valid macOS process (daemon) but is frequently confused with a popular "banking security" product that will effectively prevent your Mac from working and render it practically useless. It is a very short step from there for a bad actor to leverage obscure macOS process names in an effort to obscure its intent.


I encourage you to express your highly valid concerns to Apple using their feedback portal: Feedback - macOS - Apple

May 26, 2022 5:24 PM in response to RocknRowBoat

RocknRowBoat wrote:

As usual, you good folks are absolutely correct. I had a moment of vast intellect that said to just Google it.
I did and confirmed sure enough, Apple puts screwy additional letters on several common words to describe Apple stuff.

I wonder what kind of bonus the person received who pitched the idea of just tacking a “d” to the end of a word to make it their own?
That might have been an interesting meeting.

You may want to read this article that explains "daemon". It has been in common usage for decades and is identified by adding a "d" to a process. https://en.wikipedia.org/wiki/Daemon_(computing)

So your insinuations above are completely mistaken.

May 26, 2022 5:19 PM in response to RocknRowBoat

As usual, you good folks are absolutely correct. I had a moment of vast intellect that said to just Google it.

I did and confirmed sure enough, Apple puts screwy additional letters on several common words to describe Apple stuff.


I wonder what kind of bonus the person received who pitched the idea of just tacking a “d” to the end of a word to make it their own?

That might have been an interesting meeting.




May 26, 2022 6:24 AM in response to D.I. Johnson

Ok, I guess.. so Apple uses common words, change’s the spelling for some reason, then asks for my “confidential information” just out of the blue one day when there has been no software change or update that one might expect would prompt such an unusual request without explanation of any kind from Apple?

I’m not comfortable with giving it my password without knowing what it needs it for specifically and why they don’t already have whatever info they need in order to provide me with the product I paid thousands of dollars for.


Why is this odd request coming up now, almost 2 years since purchase of this $4,000 iMac and months since it’s last OS update?


It reminds me of scam phone calls telling me men will come to take me to the courthouse jail if I don’t give them my Social Security number immediately.


In those calls there are always simple mistakes made like when the voice said “courthouse jail”, when no such place exists. I’m equally suspicious when I get a notice that appears on my computer screen appearing to be from Apple but begins with a common word misspelled intentionally or not, asking for passwords.


It appears more like malware as it now doesn’t let me enter text anywhere on the computer except in the box where it wants my password.


if this is from Apple they’ve got some explaining to do.


Thank you very much for the info, but I think I’ll try to contact support for more info of what they need to access, why, and why now and why the odd spelling of a common English word?



May 26, 2022 7:31 AM in response to RocknRowBoat

... every time I go to an area where Apple requires a password different from my log onto computer password, which will forever be my biggest complaint about Apple, why do I have to have 3 or 4 more different passwords after I've already entered the locked Apple vault that is my Mac.


There is nothing that prevents using the same password as your login password.


Change the login password on Mac - Apple Support

May 26, 2022 6:00 PM in response to RocknRowBoat

I wonder what kind of bonus the person received who pitched the idea of just tacking a “d” to the end of a word to make it their own?


The answer will disappoint you, since the "daemon" concept predates macOS by a long time. It actually makes sense from a programming perspective, since tacking the d suffix on to some descriptive word makes it instantly recognizable.


macOS implements countless such daemons that operate as background processes. They range from things like cloudd (obviously used for iCloud) to cupsd (Common Unix Printing System) to lsd (launch services) and even deleted (which deletes temporary files).


Since Unix-like operating systems are largely the product of collaborative open source development, it's doubtful anyone got a bonus or even passing recognition for developing this more or less accepted naming convention.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Is this request really from Apple, with it's first word misspelled?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.