The process displaying the iCloud Password window on OS X Yosemite is:
The way to confirm: navigate to and read the contents of the answers under this question on SuperUser:
The first one contains a link to a blog post describing a way to debug the very same problem (iCloud Password window). Author suggests running the following script and moving the window in question with a mouse/trackpad. The script discovers position change and prints the details of a window that was moved.
from Quartz import CGWindowListCopyWindowInfo, kCGWindowListExcludeDesktopElements, kCGNullWindowID
from Foundation import NSSet, NSMutableSet
wl1 = CGWindowListCopyWindowInfo(kCGWindowListExcludeDesktopElements, kCGNullWindowID)
print 'Move target window'
wl2 = CGWindowListCopyWindowInfo(kCGWindowListExcludeDesktopElements, kCGNullWindowID)
w = NSMutableSet.setWithArray_(wl1)
print '\nList of windows that moved:'
The other answer points to a github project mac_list_windows_pids with a Python script that lists currently active windows and their processes. You can run it twice with the iCloud Password window active and after closing, save the results to text files and
Both scripts in my case pointed to
UserNotificationCenter process, which after
ps -ef revealed the following executable:
For ultimate confirmation you can check if the window would disappear after:
$ pkill UserNotificationCenter
Next you can check the validity of the app's signature using the following command:
$ codesign --verify --no-strict -vvvv /System/Library/CoreServices/UserNotificationCenter.app
/System/Library/CoreServices/UserNotificationCenter.app: valid on disk
/System/Library/CoreServices/UserNotificationCenter.app: satisfies its Designated Requirement
And check the signature with (with results from my OS X 10.10.5 (14F1605) for reference):
$ codesign -dvvv /System/Library/CoreServices/UserNotificationCenter.app
Format=bundle with Mach-O universal (i386 x86_64)
CodeDirectory v=20100 size=501 flags=0x0(none) hashes=18+3 location=embedded
Hash type=sha1 size=20
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Sealed Resources version=2 rules=14 files=4
Internal requirements count=1 size=80
Also for reference SHA of the executable is
Of course everyone should test for themselves to make sure no other program impersonates this window.
While not related, there is a report that a phishing method mimicking the iCloud password prompt has been used on iOS, so it is a valid concern.
As for the problem itself it seems to be commonly reported. Disabling the
UserNotificationCenter with the following command prevented the window from appearing:
$ sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.UserNotificationCenter.plist