macOS is background scanning and following downloaded QR codes?
1–10 of 95 posts
Re: macOS is background scanning and following downloaded QR codes?
#2Was anyone else able to confirm this?
Re: macOS is background scanning and following downloaded QR codes?
#3This happened to me last week and I ignored it thinking maybe I did something wrong and Apple wouldn't be so silly to build in an attack vector like this in to their software.
It was between two devices on the same Apple ID though via AirDrop, so maybe it only did it because the device was "trusted".
Re: macOS is background scanning and following downloaded QR codes?
#4"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if it indexes text in images for Spotlight the way Google has already done in Drive for years.
But I wouldn't be surprised if it fetches URL's in QR codes in order to index the title text associated with the URL for Spotlight. It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. Or, if it's just a shared "preview" library used across thumbnails and iMessage.
I'm not sure what to think about it. Previews, smart text, showing URL information on hover, prefetching, indexing, etc. -- it's all pretty standard stuff. On the other hand, it does feel a little weird for previews on a local filesystem to query the internet -- we're totally used to it in e-mail and messaging though. But, I used to keep bookmarks as URL (.url) files. It would seem natural for a thumbnail of the page to show up in Finder (though I don't think it does this?).
As for it being an "attack" to get someone's IP -- seems like that ship has long since sailed, as it's common for any messaging and e-mail client to already show previews. If you need to protect yourself against all of those, you pretty much need to figure out what level of Little Snitch or turning off internet or airgapping is required for your security concerns.
Re: macOS is background scanning and following downloaded QR codes?
#5I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app.
Obviously if this is a background daemon that runs periodically then my test wouldn't catch it (unless I got "lucky") and for a longer-term test I'd probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time.
Re: macOS is background scanning and following downloaded QR codes?
#6I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was cl…
The Twitter thread says it was created "a few days ago" and was hit "this morning" so I'm guessing 10 minutes might not be enough (if it is even something time-based).
Re: macOS is background scanning and following downloaded QR codes?
#7I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was cl…
The Twitter thread says it was created "a few days ago" and was hit "this morning" so I'm guessing 10 minutes might not be enough (if it is even something time-based).
Absolutely and I called that out, I just thought that opening it in QL/Preview or even scanning on an iPhone might manually kick off the same “processing” that’s being speculated about here.
Re: macOS is background scanning and following downloaded QR codes?
#8Earlier quoted context omitted.
The Twitter thread says it was created "a few days ago" and was hit "this morning" so I'm guessing 10 minutes might not be enough (if it is even something time-based).
Absolutely and I called that out, I just thought that opening it in QL/Preview or even scanning on an iPhone might manually kick off the same “processing” that’s being speculated about here.
I guess we all regroup here in a week or so then, right?
Re: macOS is background scanning and following downloaded QR codes?
#9"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if…
I feel like there are better ways to do this, to the point that this 'feature' actually looks really out-of-place. Why wouldn't you get these thumbnail previews when you actually scan the QR Code? You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later.
It's not exactly malicious, but weird "we know better than you" behavior like this ultimately drove me away from MacOS as a daily-driver.
Re: macOS is background scanning and following downloaded QR codes?
#10No post body was provided.