[lovelettr]

I have tried this script on my own account to see what it looks like when it succeeds and all of that. While it does appear to succeed and not be rate limited. The outcome is that the account will have been disabled as a result running the script. Even if it succeeded and found the password it would be no good to the attacker anymore.

> This Apple ID has been locked for security reasons. Visit iForgot to reset your account (https://iforgot.apple.com).

I'm no security expert but that must reduce at least some of the vulnerability.

Though it seems like this could be weaponized to be a hassle. I only point this out because I have 2-factor auth and have locked my account and cannot seem to find my recovery key. /facepalm

[EC1]

Could also be used to just grab the password and try it against other accounts. Most people have one password for everything.

[lovelettr]

That is a valid point that I didn't think about.

I forget that not everyone uses something like 1password generate random passwords for all sites. Therefore, compromising one doesn't compromise them all. I recognize that is not common behavior.