Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Is Sending URLs to Tencent?

twitter.com

Post reply on HN
Print view View original

91–100 of 154 posts

Re: Apple Is Sending URLs to Tencent?

#91

Post by bidluo »

giancarlostoro wrote: post #83
eastendguy wrote: post #70

Earlier quoted context omitted.

> if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: So even for US and EU based users the data is send to Tencent just because they enabled Chinese language support? Who programmed that?

This sounds like the more dangerous story here. What the heck?

Google is blocked in China so naturally they'd need a Chinese alternative, with everything going on it's easy to fear monger but people need to chill out a bit. Locale is probably one of the least intrusive ways to determine location, using GPS would probably cause an even further problem if people realise that there's a backdoor to avoid location permission

Any company that markets/releases in China and relies on some google service (maps/safe search/safety net/google sign in/firebase/etc) need to find an alternative, not because everyone is on the Chinese payroll but more often than not these services are business critical.

Re: Apple Is Sending URLs to Tencent?

#92

Post by mrgalaxy »

jstsch wrote: post #47
kevinday wrote: post #30

Earlier quoted context omitted.

If this source is to be believed, it's either going to Google or Tencent, but never both: https://twitter.com/eromang/status/1183422784082530304/photo... You can try yourself by going to one of the IOS Safe Browsing test pages on your phone, and when the warning pops up click "Show Details". It'll either say Google or Tencent on the warning message, which should let you know which one got chosen for you. https://test…

Great. I disabled safe browsing probably back when it first appeared on my iPhone 3G or 4 and this test confirms I’m still not sending urls to anyone whilst surfing on my iPhone 11. Nice job preserving these settings over countless device upgrades.

For anyone else wanting to disable it (or at least learn more about it), the feature is labeled in iOS settings under Safari > Fraudlent Website Warning.

Re: Apple Is Sending URLs to Tencent?

#93

Post by awinter-py »

UncleMeat wrote: post #77
awinter-py wrote: post #31

Earlier quoted context omitted.

it's theoretically possible. I don't know of any tools that do it (which could be a comment on my research skills rather than the state of the art). in theory you can do dataflow analysis on all external inputs to the program (geo, filesystem, text) and monitor where that goes in the program. For something more complicated like a browser, you might want to do the analysis per component (URL bar in this case). wouldn'…

Except you'd never have a good enough dataflow analysis to work on arbitrary code without burying people with false positives. Especially in C++ code, where things like function pointers just destroy call graph precision (and therefore taint analysis precision). Linting doesn't even give you this much. All it'd be able to tell you is "where in the program are calls to networking APIs being made" and maybe determining…

Trial use case: a small FOSS codebase in a pointer-less language. The goal isn't perfect safety, it's to be safer than we are now.

Re: Apple Is Sending URLs to Tencent?

#94

Post by tialaramex »

saagarjha wrote: post #49
kevinday wrote: post #30

Earlier quoted context omitted.

If this source is to be believed, it's either going to Google or Tencent, but never both: https://twitter.com/eromang/status/1183422784082530304/photo... You can try yourself by going to one of the IOS Safe Browsing test pages on your phone, and when the warning pops up click "Show Details". It'll either say Google or Tencent on the warning message, which should let you know which one got chosen for you. https://test…

Interestingly, none of those links triggered a warning for me on my Mac…

You've probably switched off Safe Browsing. I wouldn't advise anybody to do that unless they're _so_ sure that they don't need Safe Browsing that when (most likely rather than if) they get infected by Malware or fooled by Phishing they are confident they'd tell everybody they know what an idiot they are.

I have it switched off on my home PCs (but on for work). But then I also don't carry home insurance and when I was flooded I believe my first Facebook message began "This is probably a good time for you to say 'I told you so'" because that seems like the right sentiment.

Re: Apple Is Sending URLs to Tencent?

#95

Post by saagarjha »

tialaramex wrote: post #94
saagarjha wrote: post #49

Earlier quoted context omitted.

Interestingly, none of those links triggered a warning for me on my Mac…

You've probably switched off Safe Browsing. I wouldn't advise anybody to do that unless they're _so_ sure that they don't need Safe Browsing that when (most likely rather than if) they get infected by Malware or fooled by Phishing they are confident they'd tell everybody they know what an idiot they are. I have it switched off on my home PCs (but on for work). But then I also don't carry home insurance and when I was…

I haven't.

Re: Apple Is Sending URLs to Tencent?

#96

Post by lostlogin »

deogeo wrote: post #26
pmoriarty wrote: post #20

Earlier quoted context omitted.

Yet another approach is to send the entire list of all malware URLs to each client and let the client do all the processing on their end. This way no data (hashed, anonymized, truncated, or otherwise) would need to be sent to Tencent, Apple, or Google, or anyone else.

Why is this getting downvoted? I'm also interested in why this approach isn't taken.

Local handling seems more Appley too.

Re: Apple Is Sending URLs to Tencent?

#97

Post by tialaramex »

larkeith wrote: post #44

I'm curious if, as @thefalken brought up [0], this is illegal under the GDPR, given that it's a hidden opt out and should apply to EU citizenry with browser language set to Chinese. [0] https://mobile.twitter.com/thefalken/status/1183445477645312...

Very doubtful, even with the "hidden opt out" that seems to be sufficiently poorly "hidden" that lots of people here have indeed opted out.

Safe Browsing uses very little data (pretty much the least they could get away with to make it work) and you'd have to establish either that Tencent is lying about how it uses that data AND that Apple knew or reasonably should have known that it was misused.

URLs never leave your browser, so "Apple is sending URLs" is wrong. The Update API is used, so the URLs stay on your browser but under some circumstances hash prefixes of some URLs are sent to Google/ TenCent.

If you choose to assume that Google / TenCent are bad actors then they can probably manipulate this data to target a few URLs and discover who (IP addresses) browsed those URLs. In less well designed browsers like Safari they might be able to tie that to a Google Account independent of the IP address because those browsers don't isolate Safe Browsing API calls from normal web browsing activity (this won't work in e.g. Firefox). If a bad actor did this, it would make performance worse for all users, and the accuracy of the trick would be sabotage unless the set of target URLs tracked is fairly small, if you were looking for a single PDF filename on a single web site it's definitely possible, if you want to track six thousand different articles about Xi's resemblance to Pooh Bear across tens of thousands of sites that's going to cause a lot of false positives you have to weed out somehow.

Re: Apple Is Sending URLs to Tencent?

#98

Post by tialaramex »

xenophonf wrote: post #85
teraflop wrote: post #14

Earlier quoted context omitted.

The Safe Browsing API is deliberately designed to avoid leaking the contents of URLs to Google. You can read about how it works here: https://developers.google.com/safe-browsing/v4/update-api

It's designed to avoid leaking URLs, but I'd be a lot more comfortable if Safe Browsing worked by downloading a list of hashes to my computer and checking locally. That way, data never leaves my device.

That means giving you all the hashes, which is a lot of data, and you'd need to constantly update it because the whole point of Safe Browsing is the dynamism.

Whereas today your browser only needs the prefix list, which is much shorter and so can feasibly be updated more often without awful bandwidth costs. The full hashes in a prefix are only fetched (which is where we get "Apple is sending URLs" by squinting really hard at the facts) if you visit a URL with a hash with a known-bad prefix.

Re: Apple Is Sending URLs to Tencent?

#99

Post by busymom0 »

bidluo wrote: post #91
giancarlostoro wrote: post #83

Earlier quoted context omitted.

This sounds like the more dangerous story here. What the heck?

Google is blocked in China so naturally they'd need a Chinese alternative, with everything going on it's easy to fear monger but people need to chill out a bit. Locale is probably one of the least intrusive ways to determine location, using GPS would probably cause an even further problem if people realise that there's a backdoor to avoid location permission Any company that markets/releases in China and relies on so…

Wouldn't the locale be set to CN for phones which are in non-china countries too?
Post reply on HN