Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

201–210 of 355 posts

Re: Does Apple really log every app you run? A technical look

#201

Post by kortex »

chrisoverzero wrote: post #120
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

> I don't follow the "browsers and loops" argument. To log in to my banking account, I need the correct password. No problem, I keep it in a password manager. To open the password manager, I need the correct password. No problem, I keep it in a password manager. To open the password manager, I need the correct password. No problem, I keep it in a password manager. To open the password manager, I need the correct pass…

TLS involves both cert checking (server is truly who they say they are and not MITM) and Diffie-Helman key exchange to set up session keys (messages are end-to-end encrypted).

You can DH with an untrusted cert. It might be interceptable.

HTTP is always interceptable.

But there should be zero reason not to set this connection up with a full proper cert. HTTP is just mega sloppy.

As others mentioned, you can bootstrap TLS by first checking OCSP (in the open) on your cert auth service, then use that opaque, freshly-checked connection to check the rest.

Re: Does Apple really log every app you run? A technical look

#202

Post by clankyclanker »

WesolyKubeczek wrote: post #117
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

Most "alarmist" articles have two points you cannot really ignore, not if you don't want to end up living in interesting times one day. 1) Even plain access logs — basically what a HTTP request, or a TCP connection can tell you — is a lot . Gather those for a couple of days, and you have a good map of the user. More so if you have an ID of machine and the actual executable hash. 2) "But we are the good guys" is a non…

If you have #1 and the ability to collect #3, then you’re already an intermediary between the user and Apple.

At that point, what’s to prevent you from providing unacceptably slow service for the certs of those apps you don’t like and soft-locking the user out of particular apps on their own device?

Re: Does Apple really log every app you run? A technical look

#203

Post by samatman »

lowendbeholder wrote: post #192
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

The loop argument makes no sense at all. HTTP is being used as a transport for a base64-encoded payload, the actual process of veryfing the validity of the developer certificate is done by the service behind that Apple URL - not by the HTTP stack. There is no justification not to switch to HTTPS here.

Yeah, that confused me as well.

Even if there was some wrinkle about the loop argument that I didn't understand, and HTTPS is out: Apple could encrypt the base64 payload, and the sniffable info is reduced to which computer is phoning home, which is something that someone with the ability to middle comms probably knows already.

"roll your own encryption and send it over HTTP" is a bad idea in general but... this is Apple, they can and do implement encryption. Why not here?

Re: Does Apple really log every app you run? A technical look

#204

Post by _qulr »

zepto wrote: post #199
ethbr0 wrote: post #189

Earlier quoted context omitted.

The risk of launching malware a second+ time seems substantially less than the privacy leak caused by more frequent checks.

https://www.zdnet.com/article/apple-update-kills-off-zoom-we... This was a seriously exploitable issue that was a problem every time it was run. I agree that this certificate mechanism is absurdly problematic. That doesn’t justify dismissing the security risks it was intended to prevent.

Zoom isn't malware, Apple did not revoke Zoom's Developer ID certificate, and indeed Zoom still exists on the Mac.

Zoom had a serious uninstaller bug, but that's all it was, and it's not relevant to the current discussion.

Re: Does Apple really log every app you run? A technical look

#206

Post by est31 »

remram wrote: post #200
est31 wrote: post #133

Earlier quoted context omitted.

As the set of certificates is bounded and known by apple, they can also adopt crlite and just push all CRLs they have to all users, using CRLite. https://github.com/mozilla/crlite

I assumed there were too many revoked certificates for something like this to be viable, but I'm not surprised it is. You probably can't update the whole list that often though, compared to Apple's current OCSP revalidate time of 5 min. [edit: seems "delta patches" are supported by crlite so maybe that can work too]

> I assumed there were too many revoked certificates for something like this to be viable, but I'm not surprised it is.

Given that Apple currently doesn't even encrypt the requests during transit, I think they just didn't pay much attention to the problem, which I think the main reason is why they haven't adopted it yet. As for the number of revoked certificates, I'm not sure it's larger than the number of revoked TLS certificates, given that there are way more websites out there than there are registered apple developers.

Re: Does Apple really log every app you run? A technical look

#208

Post by musicale »

banachtarski wrote: post #65

There will be a day when all apps on a mac will only be installable from the app store. Developers will be forced to buy macs and subscribe to Apple’s developer program to support it. Customers will be trained to not care. And HN Apple fanboys and fangirls will try to justify why this is a Good Thing(TM).

> Developers will be forced to buy macs

Yeah, what's up with that, having to buy a Mac just to run XCode! And having to register as a developer to get a certificate.

Apple should bring back Lisas and the UCSD Pascal/Clascal for Mac development like it was in the 1980s. And they should also bring back 4-letter developer signatures. ;-)

Re: Does Apple really log every app you run? A technical look

#210

Post by dpacmittal »

theodric wrote: post #84

By default, Android logs every app you use. You have to disable - bafflingly - features including saving locations in Google Maps and fully-functional voice recognition to (supposedly) disable that behavior. What I'm saying is: don't look so surprised.

Why compare a phone OS which is much more tightly controlled to a desktop OS?
Post reply on HN