Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Is Sending URLs to Tencent?

twitter.com

Post reply on HN
Print view View original

31–40 of 154 posts

Re: Apple Is Sending URLs to Tencent?

#31

Post by awinter-py »

OJFord wrote: post #21
awinter-py wrote: post #18

every form of software phone-home is sleazy we should be linting code to say whether it phones home or not, and what it uploads when it does. plain language privacy policies and ever-changing browser settings are leaving huge gaps. when the US government bought chinese drones they hired a consultant to prove that the drones never call home.

> we should be linting code to say whether it phones home or not Is that possible? How do you diffentiate it from expected API calls? (Not convinced black/white-listing strings is any different from code review in this case - it'll just be changed on demand if if prevents adding what was tried to be added.)

it's theoretically possible. I don't know of any tools that do it (which could be a comment on my research skills rather than the state of the art).

in theory you can do dataflow analysis on all external inputs to the program (geo, filesystem, text) and monitor where that goes in the program. For something more complicated like a browser, you might want to do the analysis per component (URL bar in this case).

wouldn't be perfect, but it's a starting point.

linting is tougher on closed-source software than open-source, but if a company certified a linter output and was found to be lying I'm comfortable with using the law to resolve that.

Re: Apple Is Sending URLs to Tencent?

#32

Post by wolfgke »

yorwba wrote: post #15

This is really a "damned if you do, damned if you don't" kind of situation. They can either use Tencent's Safe Browsing API as a drop-in replacement for Google's API, relying on k-anonymity to leak as little information as possible. That leaves them open to accusations that they allow Tencent (or, for that matter, Google) to track the browsing history of Safari users. Or they can essentially turn off Safe Browsing in…

> This is really a "damned if you do, damned if you don't" kind of situation.

Why? Simply, when setting up the device/browser, let the user choose what safe browsing API the browser shall use (both, one of them, or none).

Letting the user make a conscious choice is the best way to handle "damned if you do, damned if you don't" kind of situation. To make the choice as conscious as possible for the user, provide additional material that explains the advantages and disadvantages of each option for the user so that the user is well-informed before he/she makes his/her choice.

Re: Apple Is Sending URLs to Tencent?

#33

Post by saagarjha »

Took a quick look, and this appears to be enabled if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]:

  char ____ZN7Backend6Google12SSBUtilities24shouldConsultWithTencentEv_block_invoke_2(void * _block) {
      rax = [NSLocale currentLocale];
      rax = [rax retain];
      r14 = [[rax countryCode] retain];
      [rax release];
      rbx = [r14 isEqualToString:@"CN"] != 0x0 ? 0x1 : 0x0;
      [r14 release];
      rax = rbx;
      return rax;
  }
Update: the code for Tencent Safe Browsing seems to be very similar to that which talks to Google, down to it being under a "Google" namespace, the API endpoints being named the same, and performing hashing which seems to match the "Update API" here: https://developers.google.com/safe-browsing/v4/update-api. I think this is just "whatever Google could see before, Tencent can see now, if you're in China". I'm no expert, so I have no idea if that's k-anonymous or whatever if Tencent/Google decide they want to track you, but in either case it's just shifting who's getting your hashes.

Re: Apple Is Sending URLs to Tencent?

#34

Post by jhgg »

deogeo wrote: post #26
pmoriarty wrote: post #20

Earlier quoted context omitted.

Yet another approach is to send the entire list of all malware URLs to each client and let the client do all the processing on their end. This way no data (hashed, anonymized, truncated, or otherwise) would need to be sent to Tencent, Apple, or Google, or anyone else.

Why is this getting downvoted? I'm also interested in why this approach isn't taken.

Chrome does something like this, you can learn more about it here: https://codereview.chromium.org/6286072/

Re: Apple Is Sending URLs to Tencent?

#35

Post by mokus »

deogeo wrote: post #26
pmoriarty wrote: post #20

Earlier quoted context omitted.

Yet another approach is to send the entire list of all malware URLs to each client and let the client do all the processing on their end. This way no data (hashed, anonymized, truncated, or otherwise) would need to be sent to Tencent, Apple, or Google, or anyone else.

Why is this getting downvoted? I'm also interested in why this approach isn't taken.

A couple possibilities I can think of:

* the list may be prohibitively large

* it exposes to the bad actors exactly which of their scams is detected, so they can simply refine their methods until their sites don’t make “the list”

Re: Apple Is Sending URLs to Tencent?

#36

Post by ddtaylor »

yorwba wrote: post #15

This is really a "damned if you do, damned if you don't" kind of situation. They can either use Tencent's Safe Browsing API as a drop-in replacement for Google's API, relying on k-anonymity to leak as little information as possible. That leaves them open to accusations that they allow Tencent (or, for that matter, Google) to track the browsing history of Safari users. Or they can essentially turn off Safe Browsing in…

Do you think a decentralized database of unsafe URLs could exist?

Re: Apple Is Sending URLs to Tencent?

#37

Post by cryptonector »

deogeo wrote: post #26
pmoriarty wrote: post #20

Earlier quoted context omitted.

Yet another approach is to send the entire list of all malware URLs to each client and let the client do all the processing on their end. This way no data (hashed, anonymized, truncated, or otherwise) would need to be sent to Tencent, Apple, or Google, or anyone else.

Why is this getting downvoted? I'm also interested in why this approach isn't taken.

Downvoters who think that might be too much data don't know about Bloom filters.

Re: Apple Is Sending URLs to Tencent?

#38

Post by cryptonector »

mokus wrote: post #35
deogeo wrote: post #26

Earlier quoted context omitted.

Why is this getting downvoted? I'm also interested in why this approach isn't taken.

A couple possibilities I can think of: * the list may be prohibitively large * it exposes to the bad actors exactly which of their scams is detected, so they can simply refine their methods until their sites don’t make “the list”

Bloom filters take care of the first. There will always be an arms race between attack and defense, so I'm not concerned about the second issue.

Re: Apple Is Sending URLs to Tencent?

#39

Post by [deleted] »

saagarjha wrote: post #33

Took a quick look, and this appears to be enabled if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: char ____ZN7Backend6Google12SSBUtilities24shouldConsultWithTencentEv_block_invoke_2(void * _block) { rax = [NSLocale currentLocale]; rax = [rax retain]; r14 = [[rax countryCode] retain]; [rax release]; rbx = [r14 isEqualToString:@"CN"] != 0x0 ? 0x1 : 0x0; [r14 release]; rax = rbx; return rax; } Update: the…

[deleted]
Post reply on HN