How to tell the difference between a legitimate Apple request for my password, and an app phishing attempt?
Press on the Home button on your device - if the app quits, it is a fake popup. If the app persists, it is real.

The safest is to always assume that the popup is fake. Then access the Apple supplied program that supposedly gave the popup (for example Settings => iCloud) and enter your password there if indicated.