Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS is background scanning and following downloaded QR codes?

twitter.com

Post reply on HN
Print view View original

81–90 of 95 posts

Re: macOS is background scanning and following downloaded QR codes?

#82

Post by hunter2_ »

martin_a wrote: post #62
numbsafari wrote: post #13

Apple should be proxying and caching these results to avoid the risk of exposing client devices, prevent incidental DDOS, as well as the obvious privacy issues.

We'll just switch to user-specific QR codes then, like unique links in spam mails to find out who clicked it.

But if every code you send out gets hit by the proxy regardless of any user action taken, then the hit doesn't tell you anything but "you got the proxy's attention" which isn't much.

Re: macOS is background scanning and following downloaded QR codes?

#83

Post by yellowapple »

grooot wrote: post #29
yellowapple wrote: post #27

Earlier quoted context omitted.

Data exfiltration is not necessary for this to be a privacy concern; data becomes a liability as soon as it's collected even locally. EDIT: in this case, however, data exfiltration is happening , by means of Apple's closed-source software blindly sending HTTP requests to unknown servers. Apple might not be the recipient of the exfiltrated data, but the exfiltration is happening nonetheless.

Quoted post unavailable.

> Frankly this is absurd.

What's absurd is Apple's software sending requests to random and entirely-unvetted servers without even so much as notifying the user, let alone obtaining consent.

> Did you know that the file system of your computer contains your personal data, including files you save?

Why yes, and that would just so happen to be the reason why I ain't exactly comfortable with closed-source software silently sifting through it and blindly following anything and everything vaguely resembling a URL or encoding thereof.

> EDIT: No, that’s not what exfiltration means. You are simply misusing the word.

https://www.fortinet.com/resources/cyberglossary/data-exfilt...:

"A common data exfiltration definition is the theft or unauthorized removal or movement of any data from a device. Data exfiltration typically involves a cyber criminal stealing data from personal or corporate devices, such as computers and mobile phones, through various cyberattack methods.

"Another data exfiltration meaning is data exportation and extrusion, data leakage, or data theft, which can pose serious problems for organizations. Failing to control information security can lead to data loss that could cause reputational and financial damage to an organization."

Thanks to this crawler, anyone who sends you even so much as a QR-encoded image of a link will know that it was successfully received, that it was a macOS machine that received it, and quite possibly the public IP address of the machine that received it. That's data that's worth preventing disclosure, for the same reasons email clients often don't load images in emails by default.

Re: macOS is background scanning and following downloaded QR codes?

#84

Post by yellowapple »

lilyball wrote: post #81

The tweet has now been deleted and the author has retracted his claim. https://twitter.com/hodgesmr/status/1577739222412312578 https://news.ycombinator.com/item?id=33100130

The explanation for the retraction doesn't explain that user agent string. It's weird enough coming from macOS; it's even weirder coming from Firefox.

The behavior's still concerning in any case, whether it's macOS silently doing it or Firefox silently doing it.

Re: macOS is background scanning and following downloaded QR codes?

#86

Post by woojoo666 »

lilyball wrote: post #81

The tweet has now been deleted and the author has retracted his claim. https://twitter.com/hodgesmr/status/1577739222412312578 https://news.ycombinator.com/item?id=33100130

The author originally made it sound like they just generated the QR code, saved it, and then left it in the downloads folder. Now they are saying the Firefox "recents" feature on the home screen triggered it. This would have to mean the author already visited the link embedded in the QR code. If the author had mentioned that fact, then internet speculation would have probably figured out the real cause a lot earlier.

Though I gotta say, this is still an attack vector that I hadn't considered. If you use a VPN and occasionally rotate IPs, this Firefox "recents" feature can leak your new IP to websites that you previously visited.

Re: macOS is background scanning and following downloaded QR codes?

#87

Post by smoldesu »

lilyball wrote: post #78
smoldesu wrote: post #65

Earlier quoted context omitted.

That's definitely a more sane analysis of the situation, thank you for your two cents. In general, these things frustrate me just as much as they did on Windows. I don't want random processes jumping up to use 100% of my CPU for no reason. I can't even count the number of times my Mac gets pinned by mdworker processes running in the background. It's reminiscent of pulling my hair out trying to understand why OneDrive…

mdworker runs at background priority though, anything else using the CPU should preempt it.

That's a very comforting thought for when my Mac is idling at 80c and I have to join a video conference.

Re: macOS is background scanning and following downloaded QR codes?

#88

Post by zimpenfish »

lilyball wrote: post #77
spicybright wrote: post #53

Earlier quoted context omitted.

That's exactly what happens though, and is an obvious method of attack.

Is it? Has anyone actually tested sending a QR code over iMessage? Because doing that does not generate a link preview, and so there is no reason for Messages.app to be decoding it and fetching the URL. If macOS really is background-scanning all images, and if Messages.app actually writes all received images out to disk as individual image files, then the background scanning could conceivably scan it. However I haven…

> Has anyone actually tested sending a QR code over iMessage?

I have, just now. Nothing happened at either end - the URL was not accessed at all. I can get it to recognise it's a QR code on my iPhone by tapping to focus the image, waiting for the OCR badge, tapping that, and then tapping the image again to bring up a small menu with the URL as a title and headed by "Open in Safari". None of those steps accesses the URL. You have to make a conscious action to access the URL...

Post reply on HN