91–100 of 111 posts
Earlier quoted context omitted.
Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
My understanding is that little snitch doesn't catch some requests by apple owned processes.
1. Copy/paste the link and send it to himself over iMessage from his laptop, perhaps to test it out on his phone or vice versa?
2. Send the QR code itself from his phone to his laptop or vice versa perhaps to test out scanning?
The fact that the user agent matches that of iMessage screams that the code is somehow in a iMessage thread and iMessage is trying to refresh a preview thumbnail, detect an app clip, or make sure a url is accessible. Add to that the fact that this requests came in the morning suggesting they happened when he turned his laptop on or unlocked his phone to check messages, etc.
Earlier quoted context omitted.
Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.
One way to exploit this is to send the QR code through email or messaging app. When I open the email or see the message, the image may be downloaded, scan starts, and it makes requests which expose my information, including IP, without realizing it.
Earlier quoted context omitted.
Well the scanning is supposed to be local. It's not uploading your photos or anything. You can turn it off in System Preferences -> Spotlight -> Privacy. Or go further and remove Spotlight https://cleanmymac.com/faq/how-to-turn-off-spotlight-search-... Not positive this works on the latest hardware.
Which results in that NOTHING works anymore. File search, email search. Literally nothing will work anymore.
>$ man locate
>$ sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.locate.plist
>$ locate brain
>$ man find
>$ find [this directory] [criteria and action]
>$ find . -name "brain" -printIt's not supposed to be happening promptly; reproducing (or not) will take a couple days AFAIK?
Earlier quoted context omitted.
Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
My understanding is that little snitch doesn't catch some requests by apple owned processes.
1. When Apple first switched from kexts to the network framework for apps like LittleSnitch, they exempted a ton of their own system processes (things like the App Store, and iCloud) from flowing through that framework. This change was reverted shortly after (I believe even before the GA release of that version, but don't quote me on that)
2. LittleSnitch ships with a bunch of default Allow rules designed to let expected first-party things like the App Store and iCloud work. I assume this is done so that the user experience for new LS users isn't "install app, entire system comes grinding to a halt". But these rules can be disabled by the user.
Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
Relatedly, searching for the url in my photos library does not return the picture as a result, indicating that the scanning is not being used for indexing currently. I was trying to test with other QR codes that I happened to have in my photos library, but every one of them has the website name in the picture.
I will keep the files on my computer and continue monitoring but I am becoming very skeptical of the Twitter thread author’s methodology.
Earlier quoted context omitted.
Similar privacy issues of URL prefetching aside, this is actually not exactly the same. URL prefetching is usually only expected to happen "on demand" while you're using stuff (e.g. generating link previews when they appear). What's described here seems to imply it is preemptively happening to files "at rest". Also, automatic prefetching can be turned off in most places that have it, so ideally the user should be abl…
> URL prefetching is usually only expected to happen "on demand" while you're using stuff I don't think this is my expectation. When I receive messages overnight, I want URLs in those messages prefetched, for example. The whole point is that when I open my mail or messages the previews are already available, instead of waiting.
Quoted post unavailable.
For the record I tried to reproduce this and so far the URL has not been visited.