Live data from Hacker News

FaceTime bug lets you hear audio of person you are calling before they pick up

9to5mac.com

441–450 of 458 posts

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#441
post #316
post #255

Earlier quoted context omitted.

My guess is that it’s an unfortunate combination of several problems: - audio and video capture has to start going before call is actually established at signaling level, in order to minimize call establishment delay. Audio maybe going through Bluetooth, for example, and waking up Handsfree mode of BT may take 1-2 sec - most of the group calling functionality was developed by a separate team, and group calling signal…

> audio and video capture has to start going before call is actually established at signaling level, in order to minimize call establishment delay. Audio maybe going through Bluetooth, for example, and waking up Handsfree mode of BT may take 1-2 sec As a user, while I can accept capture starting before I answer, I cannot accept sending. I understand how it helps the speed of establishing calls. But it means the only…

I am not saying whether sending happens at the establishment phase or not - it's just that when your AV capturing is started and even encoding goes on - it's a matter of dropping the actual AV packets or sending them at the network stack/jitter buffer level. By the way, if not for privacy/security, it's actually very useful to start sending AV stream over the network, to pre-heat the network & test its throughput. For example, cellular data bitrate ramps up only when you actually send data, and it takes some delay to ramp up at more power-hungry levels and for cellular to even test what's possible. Also, estimating network bandwidth for the application layer requires measuring the round-trip time for a few seconds...

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#442
post #394

Earlier quoted context omitted.

Well, that's a plain and simple lie, since you can't download apps from the App Store without an Apple account, nor do I believe you can install software updates.

I haven't tried in a while, but last I checked, updates worked fine. It's not necessary to download apps from the App Store to use an iPhone. I'm not sure what was the need for you to call me a liar. If anything I've said is inaccurate, I guess it has changed in the last few months, and I would love to know that.

[deleted]

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#443
post #398

Earlier quoted context omitted.

Of course you don't need an Apple ID.

Really? This post makes it sound otherwise: https://gist.github.com/iosecure/357e724811fe04167332ef54e73...

Doesn't matter what the page says. You can buy an iPhone and just press "Skip" during set up. Easy.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#444
post #394

Earlier quoted context omitted.

Yes, you can use an iPhone without signing into any account.

Well, that's a plain and simple lie, since you can't download apps from the App Store without an Apple account, nor do I believe you can install software updates.

An iPhone is what you buy, not the 3rd party apps. Don't be so aggressive.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#445

Earlier quoted context omitted.

For this? I seriously doubt that this would require binary patching. A simple recompile with the fix should be good enough.

Not for this one, no.

Why would you need to patch the binary? If you're pushing out an update to fix the issue, the update may as well push out a rebuilt app than a binary diff.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#446
post #210

Earlier quoted context omitted.

How would E2E encryption stop a modified client? E2E protects against MITM. But we're not talking about MITM.

It could send the data but only on call accept give a session key

I wouldn't call it E2E encryption if only one party in the world has the key. E2E generally means both sides have the encryption key. But lolc points out the real problem with that scheme.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#447
post #398

Earlier quoted context omitted.

Really? This post makes it sound otherwise: https://gist.github.com/iosecure/357e724811fe04167332ef54e73...

Doesn't matter what the page says. You can buy an iPhone and just press "Skip" during set up. Easy.

You can't install apps though, which for many people may as well be "you can't use the phone"

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#448
post #381

Earlier quoted context omitted.

This seems like a state machine bug to me. If you consider what happens when you add a third person to a call: You start sending them everyone's audio! That's the desired behavior and exactly what happened here. Except the client should have probably checked if the call had been accepted first. That's why I say it's a state machine bug: The "Send audio" function should have never been activated in state "waiting to a…

> If you consider what happens when you add a third person to a call: You start sending them everyone's audio! Not before they accept the call connection request you don't.

Well clearly. That's the bug.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#449
post #362

Earlier quoted context omitted.

I'll take a stab at that, although I don't think it's stupid per-se. Everyone I talk to, I talk to via WhatsApp, LINE, or FB Messenger, and generally I only use that method to talk to them, whatever else they're on. All of those have easy one-press buttons to initiate video call. Using some kind of Apple-only technology? I mean I think most people I know are probably on an iPhone, but having to remember everyone's de…

But isn't everyone being on WhatsApp or FB Messenger or whatever just elevating the device uncertainty to platform uncertainty? You still have to remember or check who is on what. It seems like if they generally are all on iPhone, FaceTime is the one thing you could reliably call them on, and it will even tell you right in the messages app if you can FaceTime them.

> You still have to remember or check who is on what.

For some reason this comes pretty naturally to me. I guess I'm only talking to 15-20 people pretty regularly...

> it will even tell you right in the messages app

Maybe this is the disconnect. The last time I sent a message from Messages was apparently in November.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#450
post #186

Earlier quoted context omitted.

Again, are there examples that show it will “definitely” hurt their reputation at all? I’ll broaden my example set: are there any examples of consumer devices where the company suffered clear damage to their brand as a result of a security issue?

As an information security professional I wish security breaches would permanently damage a company's reputation, and even put some companies out of business if the breach demonstrates they have no business handling sensitive personal information. But if that was the case, Target and Home Depot and Equifax wouldn't exist, and no one would dare touch an Android phone or a Windows computer. The sad fact is consumers do…

Caring about an issue isn’t the same as having the power to do anything about it.
Post reply on HN