121–130 of 259 posts
I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email.
How many people use diction? I'm surprised cause I know virtually no one who uses diction, myself included.
Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.
That's literally the only thing.
Earlier quoted context omitted.
That really depends how will judge and lawyers look on it.
So now people that discover exploits should be bullied and threatened by corporations for asking for more money? Heck, I hope Apple does this so that no one will ever want to use them again.
You will try to threaten that you will release it to black market if they won't pay you 2X? Yeah, that's blackmailing. So what else can you do? Either you will start blackmailing them (then I hope you know what you are doing) or you will outright sell it on black market and bypass communication to company altogether.
I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email.
Even worse, it looks like on MacOS you can just straight up start recording on-demand, no need for dictation or siri. > Even worse, this particular exploit would also allow the app to request DoAP audio on-demand, bypassing the need to wait for the user to talk to Siri or use dictation.
Simple kill switches would be nice to see but I doubt Apple would ever implement something like that.
Earlier quoted context omitted.
The closest is $25,000. App access to a small amount of sensitive data normally protected by a TCC prompt. In this case you get a misleading prompt, the access requires additional interactions. It's a serious bug and I'm all for reporters of serious bugs getting bigger bounties from companies that have more cash than they know what to do with. But simply dropping a random number in every single one of these threads i…
I think you missed the end of the article where any MacOS app could turn on your AirPods microphone without any permissions at all and at any time at all.
Edit: NEVER MIND, that's correct, sorry. Why the heck does the article put the most dangerous part only at the end, and not include it in the tl;dr or anywhere else at all...??
Earlier quoted context omitted.
Occasionally I ask her (it?) to set a timer or add a reminder, but mostly I don't. Siri is quite slow and frustratingly limited. The other day in a hurry and driving somewhere, I ended up w/ both Apple Maps and Google Maps open, simultaneously giving me directions. "Hey Siri, close Google Maps" "To close an application, swipe up from the bottom of the phone..." To paraphrase a quote from Steve Jobs, if your voice ass…
Seconded. I get way too many "Im sorry Dave, I just can't do that" moments
But I use siri daily for things like:
- Setting and stopping alarms and timers: ("Hey siri - set alarm for tomorrow morning at 9:25" / when the alarm goes off: "Hey siri stop")
- Turning on and off my lights. Its a delight every time to say "hey siri goodnight" when I go to bed and see all the lights in the house turn off.
If an iOS app did not have "Background App Refresh" permission, could it still have exploited this vulnerability? Can physical microphones be removed from Apple devices by a repair shop, while still allowing use of wired/wireless headsets? We need Purism-style hardware kill switches for microphones, cameras and radios.
Yes, this is what I do. The mike is actually still in the laptop but it's disconnected from the motherboard. On a 2021 M1 Macbook pro all you need to do is pop off the back cover and disconnect one cable on the right side of the motherboard. All in all takes about 10 minutes of work.
Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.
Occasionally I ask her (it?) to set a timer or add a reminder, but mostly I don't. Siri is quite slow and frustratingly limited. The other day in a hurry and driving somewhere, I ended up w/ both Apple Maps and Google Maps open, simultaneously giving me directions. "Hey Siri, close Google Maps" "To close an application, swipe up from the bottom of the phone..." To paraphrase a quote from Steve Jobs, if your voice ass…
Gold.
Earlier quoted context omitted.
Siri's performance and quality seems to depend a lot on the on-board ML cores since it switched to on-device. It was basically unusable on my 6S Plus with its early ML cores, and now it's great on the 14 Pro Max I replaced it with. It seems like they ship a Siri to match the device capability.
I had the idea that Siri could only recognize "Hey Siri", and after that it would offload the task to Apple's cloud. If it's offline now, it would be great, but I don't see how the ML cores would help. Speech-To-Text is practically solved for most devices, after that you're interacting with a regular chat bot.
https://www.theverge.com/2021/6/7/22522993/apple-siri-on-dev...
All I know is what I experienced: it got less reliable with the switch and stopped handling stuff it handled perfectly before, then got better with a newer phone.
Earlier quoted context omitted.
Blackmailing? It's called negotiating from a strong position.
That really depends how will judge and lawyers look on it.
"I feel the work done to discover this bug is worth $X"
vs
"You'll give me $X or I release it into the wild or sell it on the black market"