Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

Post reply on HN
Print view View original

121–130 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#121

Post by bogwog »

user-the-name wrote: post #70
m463 wrote: post #57

Earlier quoted context omitted.

I believe you are trying to think about this rationally, but this is not the only thing going on. When a mac boots up or changes network location, a long list of processes on your machine (like AppleIdAuthAgent, identityservicesd, , and maybe 10 or 20 more) connect to various apple servers associating your actual identity with the ip address. It will continue to do these kinds of things while you are online. And all…

It is not possible to accurately connect an identity with an IP address. Many computers share IP addresses, and many others jump IP addresses frequently.

Let's say you're one out of 10,000 users in a large network sharing a single public IP address.

Anyone trying to identify you just needs to narrow that down from 10,000 to one. This can be done many different ways by combining data sources. You could automate it with algorithms and maybe some machine learning, but it'd also be pretty trivial for a dedicated human to do it.

Browser fingerprint, mac address, software versions, browsing behavior (https doesn't hide URLs), access times, and application hashes will all help narrow down that search.

Maybe your university requires you to install some special software (like one of those locked down browsers for exams), and the attacker knows an approximate range of time when you installed it based on your exam schedule. They could narrow their search by intercepting OCSP requests and filtering for application hashes that match the specific version of the software you most likely downloaded, based on the time you most likely downloaded it.

Re: macOS has checked app signatures online for over 2 years

#122

Post by sneak »

Apple also makes apps themselves, and, just like AmazonBasics, has a tendency to clone popular apps (such a tendency that it has a name: to be "sherlocked").

To ignore the fact that Apple receives global platform app popularity data, which provides them a competitive advantage over every other app developer, is somewhat foolish.

Gatekeeper has security benefits, yeah. But this data, just like 3P sales stats to Amazon, has commercial value, even anonymized/aggregated, that permits them benefits over everyone else they are competing with in the app market.

Let's not conflate things that are good for users with things that are good for Apple, and be careful when assigning decisions exclusively to one bucket or the other.

I spoke yesterday on the societal dangers of giving Apple such a pass on privacy violations:

https://www.youtube.com/watch?v=iG-7FpHvv-8

Re: macOS has checked app signatures online for over 2 years

#123

Post by user-the-name »

bogwog wrote: post #121
user-the-name wrote: post #70

Earlier quoted context omitted.

It is not possible to accurately connect an identity with an IP address. Many computers share IP addresses, and many others jump IP addresses frequently.

Let's say you're one out of 10,000 users in a large network sharing a single public IP address. Anyone trying to identify you just needs to narrow that down from 10,000 to one. This can be done many different ways by combining data sources. You could automate it with algorithms and maybe some machine learning, but it'd also be pretty trivial for a dedicated human to do it. Browser fingerprint, mac address, software v…

But why? Why go to these ridiculous lengths to try to extract information from an unreliable source?

Apple already has the device identifier and Apple ID. These are reliable. They do not need combining different data sources and algorithm and machine learning. They are the accurate data already. If they wanted it, they could just send it.

They don't. Why not? If they wanted this information, why on god's green earth would they not just send it?

Re: macOS has checked app signatures online for over 2 years

#124

Post by pibechorro »

nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

Ya no thanks. Top down regulation will just make startups less likely to enter new disruptive tech. The solution is choice, stop using Apple products and all their shadyness stops being an issue.

Re: macOS has checked app signatures online for over 2 years

#125

Post by ben509 »

zepto wrote: post #106
ethbr0 wrote: post #86

Earlier quoted context omitted.

The act of breaching privacy is technically difficult to prohibit in a way many of us would find palatable. What should be targeted is the product of said breaches. Something like the blood diamond approach. If your company has PII, then you by law must be able to produce a consented attestation chain all the way back to the source. If you do not, then you're charged a fine for every piece of unattested PII on every…

By the time someone is charged with a crime, the damage is already done. And, there will be many scammers who are simply out of reach of meaningful legal remedies.

That's true of virtually all criminal laws, though. If you're beat up and your assailant is charged with assault, you've already been beat up.

Re: macOS has checked app signatures online for over 2 years

#126

Post by sneak »

nickpp wrote: post #47

I sometimes wonder if the mods won't end up banning "political" talk on HN. Because these days everything becomes political, even if it really is a technical issue. Case to the point: online signature check was a technical decision, to fight malware. It was implemented similarly by other OS vendors (Microsoft) and it's been this way for years. Now we discover that it has the unfortunate side-effect that it lessens pr…

> Case to the point: online signature check was a technical decision, to fight malware.

This is an oversimplification. It also helps protect Apple's business model: you must pay Apple a fee for services (and show ID) to be able to sign your apps for distribution on this platform. Imagine if you had to show ID to get a TLS certificate for your website.

Don't conflate the issue - this is also a move to protect certain streams of Apple services revenue, in addition to protecting users from malware, and it always has been.

Re: macOS has checked app signatures online for over 2 years

#127

Post by woahAcademia »

zepto wrote: post #119
woahAcademia wrote: post #55

Earlier quoted context omitted.

Directly contradicting current Apple Marketing. I lothe Apple(and other unethical companies) for lying in their ads. Any benefits of macOS are instantly gone because you cannot Trust Apple to tell the truth. It's as unreliable as Google keeping a service around.

You don’t have any evidence to support the claim that they are lying.

First time on HN? There are like 2 new Apple security or privacy issues every week.

You know about PRISM/edward snowden?

You can verify all of this with almost no effort. Any links I post you won't believe. It's up to you.

Re: macOS has checked app signatures online for over 2 years

#128

Post by zepto »

_qulr wrote: post #58

I give up on Hacker News. Go ahead and wallow in your ignorance, downvoting experts.

It has been widely known that these checks were happening.

Not only that, this isn’t the first server problem that impacted launch performance. It’s just the most severe.

The main difference is that this time around there are people who are claiming that Apple is using the OCSP checks for some kind of nefarious tracking purposes.

These people have no evidence.

Re: macOS has checked app signatures online for over 2 years

#129

Post by sneak »

jrochkind1 wrote: post #18

Honest question I'm not an expert: The initial commments in this thread are painting it as a severe privacy violation. (The actual OP article author does not necessarily share this perspetive). How is what is being done with OCSP different in more concerning way for privacy (if it is) from Firefox or Chrome's use of OCSP?

The browsers are moving away from OCSP and using other protocols specifically because it's terrible for privacy. Also, the whole online/offline thing as someone else pointed out: it is a violation of the principle of least surprise for launching a local app to make a network request.

Re: macOS has checked app signatures online for over 2 years

#130

Post by rootusrootus »

xalava wrote: post #25

Interesting, but reading the conclusion I'm fascinated in this affaire how technically knowledgeable people loose common sense to defend their favorite brand: - Per launch verification is terrible for privacy, vis-a-vis Apple and the whole network when it happens in plain text - "They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after…

> how technically knowledgeable people loose common sense to defend their favorite brand

Someone who says this usually holds an opposing position and simply has their own tribal allegiance. Perhaps assume good faith on the part of those who do not make the same choices you do.

Post reply on HN