Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Is Sending URLs to Tencent?

twitter.com

Post reply on HN
Print view View original

71–80 of 154 posts

Re: Apple Is Sending URLs to Tencent?

#71

Post by pmoriarty »

mokus wrote: post #35
deogeo wrote: post #26

Earlier quoted context omitted.

Why is this getting downvoted? I'm also interested in why this approach isn't taken.

A couple possibilities I can think of: * the list may be prohibitively large * it exposes to the bad actors exactly which of their scams is detected, so they can simply refine their methods until their sites don’t make “the list”

Exactly how large is it?

OS vendors already make a habit of regularly sending gigantic OS updates. I'd have a hard time believing that a compressed list of malware URLs would be noticeably bigger, by comparison.

Also, once the list is sent the first time (or just included with the OS so it'd be already present on your device when you bought it), they could just send the deltas as the list changed, and those deltas (especially once compressed) should be relatively small even compared to the original (probably not that large) list.

Re: Apple Is Sending URLs to Tencent?

#72

Post by toxik »

eastendguy wrote: post #70
saagarjha wrote: post #33

Took a quick look, and this appears to be enabled if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: char ____ZN7Backend6Google12SSBUtilities24shouldConsultWithTencentEv_block_invoke_2(void * _block) { rax = [NSLocale currentLocale]; rax = [rax retain]; r14 = [[rax countryCode] retain]; [rax release]; rbx = [r14 isEqualToString:@"CN"] != 0x0 ? 0x1 : 0x0; [r14 release]; rax = rbx; return rax; } Update: the…

> if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: So even for US and EU based users the data is send to Tencent just because they enabled Chinese language support? Who programmed that?

I wonder if there are similar oversights with the US locale, seeing as a lot of developers prefer English interfaces to the somewhat craptastic localizations.

Re: Apple Is Sending URLs to Tencent?

#73

Post by fiddlerwoaroof »

rsync wrote: post #19
yorwba wrote: post #15

This is really a "damned if you do, damned if you don't" kind of situation. They can either use Tencent's Safe Browsing API as a drop-in replacement for Google's API, relying on k-anonymity to leak as little information as possible. That leaves them open to accusations that they allow Tencent (or, for that matter, Google) to track the browsing history of Safari users. Or they can essentially turn off Safe Browsing in…

"Or they can essentially turn off Safe Browsing in China." The OP as well as the associated blog post[1] as well as the Apple-provided fine-print language do not make it clear to me that this "feature" is exclusively enabled for Chinese users (or, perhaps Chinese IPs). Could someone point to a source that confirms a US person, in the US, with a US-purchased iphone, would not have their browsing history transformed an…

https://news.ycombinator.com/item?id=21242628

Re: Apple Is Sending URLs to Tencent?

#74

Post by derefr »

lern_too_spel wrote: post #55
Muromec wrote: post #54

Earlier quoted context omitted.

If region is set to China, not just language. Locale has two components, like in en_US.

That doesn't mean that the user is in China. It means that the user wants their interface in Chinese as it is written in mainland China. In other words, the CN means simplified Chinese instead of traditional Chinese, which is what the TW region code corresponds to.

The GP poster is incorrect; the Region setting has nothing to do with setting the region code of the Language setting (each language+region pair being its own listing in Languages.) The Region you choose during initial device setup does determine your default Language region, but you can pick a different one while keeping the same Region.

The Region setting in iOS is literally just the question "what Country [or Country-equivalent political region] would you like to be considered to be in, when we make certain OS features be dependent on your country?"

This is separate from what country the phone treats you like you're actually in, geographically, which is determined moment-to-moment by geolocation and cellular profiles. (Time zone? Geolocation. Maps domestic/foreign feature display granularity? Geolocation.)

Whereas, Region is for things like, say, whether you see certain apps or features that are in partial progressive rollout; or whether you see features offered that don't make sense outside of certain regions.

Re: the first example, the News app, which rolled out in the US first, could be made to appear in other countries by setting your Region to the US. When this was done, the News app, if launched, would still detect what country you were actually in (geolocation-wise), and would make a best-effort attempt at showing news from the few sources Apple had made agreements with so far from that country.

Re: the second example, iOS has social-network "Accounts" integration with Sina Weibo, QQ, etc. just like it has integration with Facebook/Twitter/etc. It just doesn't display these sign-in options unless your phone is set to the China "Region." Because, if you're not in China or from China, why would you ever use these networks? (Note that Apple designs iOS under the assumption that people won't bother to change their Region when they travel; so it really is more of a "where are you from" rather than "where are you now" question.)

Re: Apple Is Sending URLs to Tencent?

#75

Post by alextheparrot »

the8472 wrote: post #53
alextheparrot wrote: post #50

Earlier quoted context omitted.

The code appears to be used for fraud related purposes, meaning, to my understanding, Apple would likely argue it has a legitimate interest. There’s a lot of legal language around this exception, but fraud is directly called out as a legitimate interest and means that the group controlling the data would not need to obtain user consent. For additional reading, I’d recommend the following post: https://www.gdpreu.org/…

Is apple the data controller here since it's all happening on the users' device? And does "legitimate interests" extend beyond the data controller's interests? I.e. if it's only about fraud against apple then safe browsing (which is supposed to protect the user from fraud) would not necessarily be a legitimate interest of apple. It might have to be opt-in at least.

Great questions, which I know I'm not equipped to answer authoritatively - prior comment was just my two-cents on how I'd expect Apple to argue the issue (And even that argument may be a losing one).

In opposition to the fraud argument, one could argue they wouldn't reasonable be expected to have their data forwarded to China. The counter-argument to that would likely be along the lines of users who have their localization set to China might have more of an expectation of this. And so the lawyer fees continue to increase in what would be an incredibly interesting case, honestly.

Re: Apple Is Sending URLs to Tencent?

#76

Post by sgz »

Are those Google/Tencent API requests done only when browsing with Safari, or are they done for any SFSafariViewController? That would imply it’s also inside Brave/Firefox/Chrome...

Re: Apple Is Sending URLs to Tencent?

#77

Post by UncleMeat »

awinter-py wrote: post #31
OJFord wrote: post #21

Earlier quoted context omitted.

> we should be linting code to say whether it phones home or not Is that possible? How do you diffentiate it from expected API calls? (Not convinced black/white-listing strings is any different from code review in this case - it'll just be changed on demand if if prevents adding what was tried to be added.)

it's theoretically possible. I don't know of any tools that do it (which could be a comment on my research skills rather than the state of the art). in theory you can do dataflow analysis on all external inputs to the program (geo, filesystem, text) and monitor where that goes in the program. For something more complicated like a browser, you might want to do the analysis per component (URL bar in this case). wouldn'…

Except you'd never have a good enough dataflow analysis to work on arbitrary code without burying people with false positives. Especially in C++ code, where things like function pointers just destroy call graph precision (and therefore taint analysis precision).

Linting doesn't even give you this much. All it'd be able to tell you is "where in the program are calls to networking APIs being made" and maybe determining parameters if they are defined in the same function as the call.

Re: Apple Is Sending URLs to Tencent?

#78

Post by qafy »

lern_too_spel wrote: post #55
Muromec wrote: post #54

Earlier quoted context omitted.

If region is set to China, not just language. Locale has two components, like in en_US.

That doesn't mean that the user is in China. It means that the user wants their interface in Chinese as it is written in mainland China. In other words, the CN means simplified Chinese instead of traditional Chinese, which is what the TW region code corresponds to.

I think their point is that changing your device language is not the same thing as changing your region. Changing your language is a simple setting, but changing your region involves re-accepting the ToS for that region. So technically they would have to click Agree on the document linked in the tweet in the OP.

Re: Apple Is Sending URLs to Tencent?

#79

Post by pmoriarty »

robocat wrote: post #57
cryptonector wrote: post #37

Earlier quoted context omitted.

Downvoters who think that might be too much data don't know about Bloom filters.

Bloom filters are likely useless in this situation - following facts for phishing only: 1. Phishing sites have a lifecycle of about 15 hours. 2. Most malicious links are hidden within benign domains. 3. About 400,000 phishing sites are created each month. From: https://www.itgovernance.co.uk/blog/4-eye-opening-facts-abou... I haven't run the numbers, but I am guessing that a clientside solution would have a lot of ba…

400,000 sounds like a lot, but I wonder how many new URLs Tencent adds to its database each month. I expect they don't add every phishing URL but some small subset of them (possibly even a very small subset.. we'll proably never know).

But let's say it is 400,000. I took the URL you linked and made a file of 400,000 copies of it. The file size was 28 MB. I didn't bother compressing that particular file since the URL is the same in each instance, but I expect a file full of actual phishing URLs would probably compress pretty well, so it would probably be significantly less than 28 MB.

Considering that OS vendors regularly ship multi-gigabyte size updates, having to download less than 28 MB extra every month shouldn't even be noticeable. If updates needed to be done more frequently, the client could subscribe to get regular updates as they become available.

Re: Apple Is Sending URLs to Tencent?

#80

Post by solidangle »

eastendguy wrote: post #70
saagarjha wrote: post #33

Took a quick look, and this appears to be enabled if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: char ____ZN7Backend6Google12SSBUtilities24shouldConsultWithTencentEv_block_invoke_2(void * _block) { rax = [NSLocale currentLocale]; rax = [rax retain]; r14 = [[rax countryCode] retain]; [rax release]; rbx = [r14 isEqualToString:@"CN"] != 0x0 ? 0x1 : 0x0; [r14 release]; rax = rbx; return rax; } Update: the…

> if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: So even for US and EU based users the data is send to Tencent just because they enabled Chinese language support? Who programmed that?

Not just EU and US based users, but also Hong Kong and Taiwan based users.
Post reply on HN