macOS is background scanning and following downloaded QR codes? • Hacker News Board

Re: macOS is background scanning and following downloaded QR codes?

#91

Post by ec109685 » Wed, Oct 05, 2022, 10:23 PM UTC

nickphx wrote: post #14

joshstrange wrote: post #5

I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was cl…

They may have received it through iMessage, which will hit a url and grab the 'opengraph' meta tags to generate a preview.

That's not how it works. The metadata is captured on the sender side and sent with the message.

Re: macOS is background scanning and following downloaded QR codes?

#92

Post by ec109685 » Wed, Oct 05, 2022, 10:26 PM UTC

crazygringo wrote: post #66

paxys wrote: post #61

Earlier quoted context omitted.

If I send a URL directly it will be hit from my phone. Big difference there.

That is not true. Messages on my iPhone shows me link previews for links sent to me via SMS, not just via iMessage. I just checked to make sure. Those are necessarily generated on the recipient's end.

Are you sure it auto expands the preview of a link without any user interaction? https://www.tatango.com/blog/ios-10-what-sms-marketers-need-...

This could be due to it being sent from someone in your contact list: https://support.twilio.com/hc/en-us/articles/360013199334-Ho...

Re: macOS is background scanning and following downloaded QR codes?

#93

Post by __ryan__ » Wed, Oct 05, 2022, 11:50 PM UTC

yellowapple wrote: post #84

lilyball wrote: post #81

The tweet has now been deleted and the author has retracted his claim. https://twitter.com/hodgesmr/status/1577739222412312578 https://news.ycombinator.com/item?id=33100130

The explanation for the retraction doesn't explain that user agent string. It's weird enough coming from macOS; it's even weirder coming from Firefox. The behavior's still concerning in any case, whether it's macOS silently doing it or Firefox silently doing it.

The original tweets explained it. The user agent is impersonating a shared Facebook/Twitter/etc link preview/thumbnail. Many sites respond with markup more appropriate for a thumbnail when using that user agent, and if not, it’s unlikely that they serve anything worse, so it’s little harm done.

Re: macOS is background scanning and following downloaded QR codes?

#94

Post by yellowapple » Thu, Oct 06, 2022, 12:12 AM UTC

93po wrote: post #85

yellowapple wrote: post #10

Quoted post unavailable.

The author removed their tweet and retracted their claim. Yet another reason to not believe everything we see posted online.

My comment stands if you s/Apple/Mozilla/.

Re: macOS is background scanning and following downloaded QR codes?

#95

Post by martin_a » Thu, Oct 06, 2022, 8:41 AM UTC

hunter2_ wrote: post #82

martin_a wrote: post #62

Earlier quoted context omitted.

We'll just switch to user-specific QR codes then, like unique links in spam mails to find out who clicked it.

But if every code you send out gets hit by the proxy regardless of any user action taken, then the hit doesn't tell you anything but "you got the proxy's attention" which isn't much.

So far only actively downloaded codes seem to trigger this. Put in a dynamically generated "instructions.pdf" which you have to download before opening. I'm sure someone will find a way...