231–240 of 355 posts
By default, Android logs every app you use. You have to disable - bafflingly - features including saving locations in Google Maps and fully-functional voice recognition to (supposedly) disable that behavior. What I'm saying is: don't look so surprised.
Earlier quoted context omitted.
It clearly shows that Apple is getting fed the dev certificate info for each application being launched. For developers with multiple applications, then sure, that's not going to be as clear as individually identifying the application. But there are plenty of developers around with just one popular application. Sending the dev certificate for them is effectively the same as sending the application hash itself.
They already know they exist (they sign them) and most of those are downloaded via the AppStore (they run that) and people tend to log in using iCloud (which they own). I get it, we're all supposed to trust nobody and have 7 billion independent islands where you don't have to trust anyone or work with anyone. I have not seen any solution, just people piling on. Having PKI and signatures using a central authority is t…
Earlier quoted context omitted.
Most "alarmist" articles have two points you cannot really ignore, not if you don't want to end up living in interesting times one day. 1) Even plain access logs — basically what a HTTP request, or a TCP connection can tell you — is a lot . Gather those for a couple of days, and you have a good map of the user. More so if you have an ID of machine and the actual executable hash. 2) "But we are the good guys" is a non…
If you have #1 and the ability to collect #3, then you’re already an intermediary between the user and Apple. At that point, what’s to prevent you from providing unacceptably slow service for the certs of those apps you don’t like and soft-locking the user out of particular apps on their own device?
It's sensible to require waiting for a certificate check the first time an app is launched, but after that, the cache validity should be indefinite, and updates should occur asynchronously in batches.
The timeout settings were also excessive.
Can't forget the blatant lack of encryption. They either forgot or thought it would be too much effort to set up.
Earlier quoted context omitted.
They backup the private key to iCloud unless you manually disable backups. So even though iMessage is advertised as E2E encrypted, for the vast majority of users, Apple can read each and every message. (And even if you disable backups, Apple can still read most if not all of your messages, because the persons on the other side of the conversations have not disabled backups)
Can Apple read your iCloud storage? I’m not saying that it is, but shouldn’t that be encrypted at rest with a customer-specific key?
https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/
They were going to actually encrypt it, but suddenly had a change of heart after the FBI had a chat with them:
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Earlier quoted context omitted.
Apple has programmed macOS to make it appear to users as if un-Notarized apps either don't work or are malicious. This is bad for users that download apps to solve problems, or to get work done, because then they can't those apps without having an expert tell them what the magic ritual to run un-Notarized apps is. If they don't have an expert around to show them how to perform the magic ritual, then they just think t…
Most mainstream apps are notarized already.
> You should be aware that macOS might transmit some opaque information about the developer certificate of the apps you run. This information is sent out in clear text on your network. Wow, that is bad from a privacy perspective! Since certificate revocation is rare, it makes more sense to simply periodically update a list of revoked certificates instead of repeatedly checking each certificate. That would solve the p…
I don't quite understand why anyone would send data in clear text anymore, let alone Apple.
If there's a hit, a subsequent request can be sent to Apple to verify the same - reducing the impact.
Earlier quoted context omitted.
I've noticed you have a very apple apologetic stance about this issue and are very active in replying to these articles, far more than the typical HN user. It's gotten to the point where I've noticed your username now. Why is that?
You'd be more aligned with HN values by refuting parent's point with examples than making ad hom attacks.
Earlier quoted context omitted.
> "But we are the good guys" is a non-defense. Good guys can turn bad, they can be coerced by the bad guys, That’s true, but not very useful, since if Apple turns bad or is coerced by the bad guys, they could just issue an OS update that begins doing new bad things anyway.
A couple of problems: - This give Apple access to data right now. If they turn evil in the future, they have access to data from the past, which gives them more leverage. - The security industry (overall) pays attention to Apple updates. If Apple turned evil in the future by issuing an OS update, someone might notice it happening. But if they start organizing this data and handing it off to the government, they don't…
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
> [article] editing your /etc/hosts file. Personally, I wouldn’t suggest doing that as it prevents an important security feature from working. Exactly the apologetic that you are talking about. Everyone has a different security update cadence (e.g. patch Tuesday for Microsoft), but each application launch is not a reasonable one. Given Apple's recent propensity for banning developers who stand against them (whether y…
It’s not each application launch. It’s from time to time. It’s for each application as it might be detected to have malware in the future. Also if the app isn’t signed there is no check.