Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

rambo.codes

Post reply on HN
Print view View original

211–220 of 259 posts

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#211

Post by bredren »

lilyball wrote: post #149
lapcat wrote: post #40

Earlier quoted context omitted.

Here are the listed payouts from the Apple Security Bounty program, starting at $25,000. https://developer.apple.com/security-bounty/payouts/

Interesting that the page defines "sensitive data" as data "from Contacts, Mail, Messages, Notes, Photos, and real-time or historical precise location data — or similar user data — that would normally be prevented by the system." Notably missing is access to the microphone or camera.

I'm very surprised that Apple did not find this fell under the "or similar user data."

>The top payouts in each category are reserved for high quality reports and are meant to reflect significant effort, and as such are applicable to issues that impact all or most Apple platforms

It seems like the researcher put in significant effort, the demonstration was gold plated, or comparable exploits require far greater amounts of time and work to uncover.

The platform coverage seems broad enough to tick that box.

I would be very interested to read the internal report on how the $7k bounty figure was arrived at.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#212

Post by radicality »

walterbell wrote: post #177
Ferrotin wrote: post #174

Earlier quoted context omitted.

Do you mean to say that “slide to power off” leaves Wi-Fi radios active?

https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-fi... > With iOS 15, your iPhone is still traceable through the Find My network even when the device is powered off. It seems that with iOS 15, the phone is not really fully ‘powered off’, it stays in a low-power state and acts like an AirTag, allowing any nearby iOS device to pick up the Bluetooth signal and send back its location.

Afaik if you care about that, you should be able to fully turn off Find My integration?

The idea does have some benefit though. For example, if you enable “Express Transit” for Apple Pay and your phone runs out of battery, you still will be able to tap-to-pay for a subway / bus ride home. The payment NFC subsystem is also separate and has its own battery reserve.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#213

Post by walterbell »

radicality wrote: post #212
walterbell wrote: post #177

Earlier quoted context omitted.

https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-fi... > With iOS 15, your iPhone is still traceable through the Find My network even when the device is powered off. It seems that with iOS 15, the phone is not really fully ‘powered off’, it stays in a low-power state and acts like an AirTag, allowing any nearby iOS device to pick up the Bluetooth signal and send back its location.

Afaik if you care about that, you should be able to fully turn off Find My integration? The idea does have some benefit though. For example, if you enable “Express Transit” for Apple Pay and your phone runs out of battery, you still will be able to tap-to-pay for a subway / bus ride home. The payment NFC subsystem is also separate and has its own battery reserve.

Apple could better describe the action that will be performed, e.g. "Slide to Suspend".

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#216

Post by shivsta »

f1refly wrote: post #201
javajosh wrote: post #200

Earlier quoted context omitted.

It's a good idea, but I can imagine how frustrating it would be if someone called and I didn't have my headset. The EV of avoiding that experience seems slightly higher than the EV of avoiding risk of being eavesdropped on by a wayward smartphone process by disabling the internal mic.

> but I can imagine how frustrating it would be if someone called and I didn't have my headset. "Sorry, I don't have a headset right now, we'll have to talk later". It's not that "frustrating", really.

“Why aren’t you able to dial in with just your computer?”

“Oh, you know, I’m a bit paranoid about my microphone being hacked so I disconnected the microphone internally. If you give me 10 minutes, I can put it back together real quick”

Not the vibe I personally wanna be giving friends and colleagues.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#217

Post by concinds »

jdwithit wrote: post #98
z9znz wrote: post #75

Earlier quoted context omitted.

I use Siri to set a timer. That's it. And I do it by holding my power button to activate her. My only other use of Siri usually involved phrases like "stop", "go away", "close", "fucking close!", "you stupid f cking * ** close the **** thing" when Siri would pop up out of nowhere and interrupt whatever I was actually doing. I had it turned off, but occasionally somehow it's back on, listening. Other actual attempts a…

Same here. Even that simple task (setting a timer) only has about a 75% success rate for me. The other 25% it spins for 30 seconds then says "hmm something went wrong". Trying for anything more complex, even playing a song or album, is just asking for trouble. I honestly can't believe how bad Siri is despite years of development. I do have an older iPhone 10 and maybe it's just not up to the task of running Siri? But…

I use Type to Siri on my Mac; all I ever use it for is "Play [song]". 70-80% of the time it goes: "something went wrong..."

When I try typing "Play [song] on repeat", it never understands that; it plays it, but not on repeat.

There's zero excuse due to mishearing me, since I'm typing everything. Siri is just defective, and I think it's a great measure of how dysfunctional Apple and poorly-run is. Why are all of Apple's AI and online-service efforts amateur hour?

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#218

Post by walterbell »

shivsta wrote: post #216
f1refly wrote: post #201

Earlier quoted context omitted.

> but I can imagine how frustrating it would be if someone called and I didn't have my headset. "Sorry, I don't have a headset right now, we'll have to talk later". It's not that "frustrating", really.

“Why aren’t you able to dial in with just your computer?” “Oh, you know, I’m a bit paranoid about my microphone being hacked so I disconnected the microphone internally. If you give me 10 minutes, I can put it back together real quick” Not the vibe I personally wanna be giving friends and colleagues.

Some people use headsets to cancel environmental noise, improving the listening experience of friends and colleagues.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#220

Post by wingerlang »

girvo wrote: post #147
freeplay wrote: post #14

I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email.

> I know people that use dictation for the majority of their text messages and email. Yeah, I'm one of them. The iOS keyboard has slowly become so bad that it's easier to dictate instead, and my partner does the same while driving via CarPlay. This is horrible to read about.

I recently saw a conversation somewhere about this, people said turning off swipe-typing made a significant difference in the keyboard experience. Haven't tested it myself as I use swipe, and have no issues. But might be worth a try.
Post reply on HN