Live data from Hacker News

Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

bleepingcomputer.com

251–254 of 254 posts

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#252
post #216

Earlier quoted context omitted.

Google Play Services does need to be enabled to use many (most?) mainstream apps. Have a source for them sending less data? Even if it were true, the use of that data differs.

To install any apps on an iPhone at all, you must give Apple your billing information. Even if you install apps from the Google Play store, you do not need to give up that much privacy.

I think we might have different ideas of privacy.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#253

Zerodium ( https://zerodium.com/program.html ) pays out $2 million dollars for an iOS “full chain with persistence” exploit. $500k for an iMessage RCE. Up to $100k for an iOS “information disclosure” exploit (likely what this would have fallen under). Paid for via bank wire or Bitcoin/Monero/Zcash in 1 week or less. And legal. Next time someone finds one of these, I wonder where they will report it to….

Ah, when I read

Complete file system read access to the Core Duet database (contains a list of contacts from Mail, SMS, iMessage, 3rd-party messaging apps and metadata about all user's interaction with these contacts (including timestamps and statistics), also some attachments (like URLs and texts))

I thought it included SMS and iMessage contents, which does very much sound like what Zerodium is looking for. But reading it again it’s not actually all text messages.

Re: Apple silently fixes iOS zero-day, asks bug reporter to keep quiet

#254
post #252

Earlier quoted context omitted.

To install any apps on an iPhone at all, you must give Apple your billing information. Even if you install apps from the Google Play store, you do not need to give up that much privacy.

I think we might have different ideas of privacy.

How about this: to get your location on iOS, your location must also be sent to Apple. You can get your location on Android without sending that location to anybody.

None of the apps on Amazon App Store or F-Droid use Google Play Services.

Post reply on HN