71–80 of 95 posts
Earlier quoted context omitted.
If I send a URL directly it will be hit from my phone. Big difference there.
That is not true. Messages on my iPhone shows me link previews for links sent to me via SMS, not just via iMessage. I just checked to make sure. Those are necessarily generated on the recipient's end.
Earlier quoted context omitted.
How is it malicious? “Malicious” doesn’t mean “unwanted behaviour”. You are saying that Apple intend to do harm with this. How?
On the one hand, I get where you're coming from and I agree that this specific example isn't malicious (as I've highlighted elsewhere in the thread) ...on the other hand, this is the exact same technology Apple lets China use to hunt down their religious and political minorities. Maybe they don't intend harm to Americans, but one thing is for certain; Apple doesn't treat privacy as a human right. If you can live with…
QR codes? HTTP requests? I’m not sure what technology you’re referring to.
> one thing is for certain; Apple doesn't treat privacy as a human right.
They have put a huge amount of effort into privacy technology; more than any comparable company I can think of. I don’t think your certainty is even remotely justified.
"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if…
Neither of which require, nor to be honest even makes any sense to, go to the URL that the QR code represents.
"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if…
facebookexternalhit/1.1 Facebot Twitterbot/1.0
What.
"This is the iMessages app's crawler [...] Apple has chosen to use this useragent in their iMessages app to ensure the unfurling of the URL and the rich preview works more often than not."²
Isn't this like WhatsApp, Teams, Skype and others giving you instant previews of URLs when sending them around? I really hate this feature. Impossible to share 'single hit' URLs as they'll be called already when you want to open them.
Earlier quoted context omitted.
Nobody said that.
That's exactly what happens though, and is an obvious method of attack.
If macOS really is background-scanning all images, and if Messages.app actually writes all received images out to disk as individual image files, then the background scanning could conceivably scan it. However I haven't seen anyone make this claim, it certainly doesn't seem necessary (why write it out to a file on disk?), and if this scanning is triggered by e.g. Spotlight indexing then it wouldn't be indexing cache files anyway.
So, has anyone actually demonstrated that sending a QR code over iMessage causes the recipient's device to fetch the URL? Because so far this just seems like complete speculation presented as fact.
Earlier quoted context omitted.
> Why wouldn't you get these thumbnail previews when you actually scan the QR Code? These aren't scanned, they're located inside .png image files you can download or generate locally on your computer. > You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later. No one asked the OS to fetch the favicon/fra…
That's definitely a more sane analysis of the situation, thank you for your two cents. In general, these things frustrate me just as much as they did on Windows. I don't want random processes jumping up to use 100% of my CPU for no reason. I can't even count the number of times my Mac gets pinned by mdworker processes running in the background. It's reminiscent of pulling my hair out trying to understand why OneDrive…
Earlier quoted context omitted.
No. I’m saying your information is outdated and wrong.
how can you be so confident that it's "closed"? the last time apple announced the high protection mode for state sponsored targets in new ios (whatever it's called), they disable all auto previews in that mode. if they are as confident as you are that it's "closed" that doesn't seem necessary?
Earlier quoted context omitted.
That is not true. Messages on my iPhone shows me link previews for links sent to me via SMS, not just via iMessage. I just checked to make sure. Those are necessarily generated on the recipient's end.
They could still be doing that through an Apple hosted proxy though? I believe services like discord and gmail webclient do that for links to not leak IPs.