Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

Post reply on HN
Print view View original

41–50 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#41

Post by user-the-name »

lovelyviking wrote: post #36
user-the-name wrote: post #23

Earlier quoted context omitted.

Why would they try to identify you from your "behavioural patterns", when they already have the device identifier and your Apple ID, which identify you are your computer uniquely? Which, to be very specific, they _do not send_. They COULD identify you extremely easily, and they specifically chose not to do that.

May be they have other channels which could or already do send device identifiter and Apple ID. How do you know what _else_ they do ? Who knew they were sending hashes till the recent malfunctioning? What _esle_ we do not know now?

If they wanted that information tied together, they would send it together. Otherwise they have to keep guessing about what goes together with what. That would make no sense.

And it was known this data was being sent.

Re: macOS has checked app signatures online for over 2 years

#42

Post by user-the-name »

whatever1 wrote: post #40
user-the-name wrote: post #21

Earlier quoted context omitted.

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

What does that even mean? Of course they can identify you, you are knocking their door with the same IP with your iCloud account. Maybe the file you are giving them does not have your uid, but as long as you have connected your Mac to your Apple account you are uniquely identified.

Plenty of computers share a single public IP address. Plenty of computers jump IP addresses constantly. It is not at all reliable trying to tie IP addresses together that way.

If they wanted the information, they would need to send it.

Re: macOS has checked app signatures online for over 2 years

#43

Post by m463 »

jrochkind1 wrote: post #18

Honest question I'm not an expert: The initial commments in this thread are painting it as a severe privacy violation. (The actual OP article author does not necessarily share this perspetive). How is what is being done with OCSP different in more concerning way for privacy (if it is) from Firefox or Chrome's use of OCSP?

  [X] Query OCSP responder servers to confirm the current validity of certificates
You can uncheck this box in firefox.

You cannot uncheck anything in macos.

Arguably firefox won't let you opt-out of automatic updates and a bunch of other annoying stuff, but apple is significantly worse.

Re: macOS has checked app signatures online for over 2 years

#44

Post by lovelyviking »

user-the-name wrote: post #21
mensetmanusman wrote: post #11

The only charitable understanding of this program is that Apple has no actual table connecting software to hashes, but that they could use the information to understand outbreaks of botnets/spyware that they could then help inform ISPs/global law enforcement to help stop. Is this even reasonable?

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

>They do not contain the unique hardware identifier that Apple computers have

Different part of MacOS can send it and you would have no idea until it malfunction like in this case.

Re: macOS has checked app signatures online for over 2 years

#45

Post by raxxorrax »

satysin wrote: post #6
raxxorrax wrote: post #3

How does Windows check executables? I hope they don't do the same. Does it come with a master list of public keys from manufacturers to check the signature against? How does that work for new vendors?

Microsoft SmartScreen is very similar to Apple's approach. Although I believe you can disable SmartScreen on Windows still which, afaik, you cannot do on macOS without resorting to "hacks" such as editing the hosts file to loopback the Apple OCSP server. https://en.wikipedia.org/wiki/Microsoft_SmartScreen

Unfortunately Microsoft is that predictable that it is safe to say they already think about removing the option to disable it. Another reason not to use an MS account. I think this is a plain data leak and arguably worse than a trojan can do to your system in context of modern banking security measures. Also I doubt most users are aware that MS gets info on every app you run.

Re: macOS has checked app signatures online for over 2 years

#46

Post by DavideNL »

> "Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them."

A simple opt-out toggle, for privacy reasons, would be a good start... people should stay in control of their own data and be able to choose themselves whether or not they are willing to trade in their privacy (for security in this case).

Re: macOS has checked app signatures online for over 2 years

#47

Post by nickpp »

I sometimes wonder if the mods won't end up banning "political" talk on HN. Because these days everything becomes political, even if it really is a technical issue.

Case to the point: online signature check was a technical decision, to fight malware. It was implemented similarly by other OS vendors (Microsoft) and it's been this way for years.

Now we discover that it has the unfortunate side-effect that it lessens privacy. Apple (and probably other OS vendors) are working to improve that in the future. Also, a technical issue.

It was never about privacy. It was never a political issue. Can we please just discuss it from a technological standpoint?

Re: macOS has checked app signatures online for over 2 years

#49

Post by oauea »

user-the-name wrote: post #21
mensetmanusman wrote: post #11

The only charitable understanding of this program is that Apple has no actual table connecting software to hashes, but that they could use the information to understand outbreaks of botnets/spyware that they could then help inform ISPs/global law enforcement to help stop. Is this even reasonable?

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

The request also contains your ip address. Charitable would be distributing a bloom filter and checking matches locally.

Re: macOS has checked app signatures online for over 2 years

#50

Post by oauea »

user-the-name wrote: post #42
whatever1 wrote: post #40

Earlier quoted context omitted.

What does that even mean? Of course they can identify you, you are knocking their door with the same IP with your iCloud account. Maybe the file you are giving them does not have your uid, but as long as you have connected your Mac to your Apple account you are uniquely identified.

Plenty of computers share a single public IP address. Plenty of computers jump IP addresses constantly. It is not at all reliable trying to tie IP addresses together that way. If they wanted the information, they would need to send it.

Maybe you have a funny network situation, but my network situation is solid, and my IP address rarely changes. IP addresses are absolutely identifiable information.
Post reply on HN