Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

261–270 of 355 posts

Re: Does Apple really log every app you run? A technical look

#261

Post by tsimionescu »

Spivak wrote: post #157
saagarjha wrote: post #68

Earlier quoted context omitted.

5 minutes is an absurdly short cache time…

If you catch malware in the wild you don’t want to wait half a day for the cache to expire. Negative responses are typically cached for short periods of time. Can you imagine if people cached NXDOMAIN for half a day and someone creating a record had to wait 12 hours for it to go live because someone queried it?

If you care about user privacy, you don't upload stuff from the user side, you download the list of trusted&untrusted certificates to the user's machine and take the decision there.

This is how antiviruses have always worked, without affecting user privacy (of course, most antiviruses also did other things that DID affect user privacy, but malware detection at least worked perfectly fine without it).

Re: Does Apple really log every app you run? A technical look

#262

Post by tsimionescu »

zepto wrote: post #183
zamalek wrote: post #116

Earlier quoted context omitted.

> [article] editing your /etc/hosts file. Personally, I wouldn’t suggest doing that as it prevents an important security feature from working. Exactly the apologetic that you are talking about. Everyone has a different security update cadence (e.g. patch Tuesday for Microsoft), but each application launch is not a reasonable one. Given Apple's recent propensity for banning developers who stand against them (whether y…

Apple hasn’t banned any developers who stand against them.

They have used security features of their OSs to ban developers who were simply in breach of contract with Apple, but not distributing malware or any other kind of content harmful to users.

Sure, Apple was completely in the right to stop distributing Epic software after they breached their contract with Apple. But Epic didn't breach any contract with their users, so there was no reason to remove Epic's software from user devices, or affect companies redistributing Epic software. Those are obvious overreach.

Re: Does Apple really log every app you run? A technical look

#263

Post by neurostimulant »

dabeeeenster wrote: post #47
musicale wrote: post #21

> You should be aware that macOS might transmit some opaque information about the developer certificate of the apps you run. This information is sent out in clear text on your network. Wow, that is bad from a privacy perspective! Since certificate revocation is rare, it makes more sense to simply periodically update a list of revoked certificates instead of repeatedly checking each certificate. That would solve the p…

I don't quite understand why anyone would send data in clear text anymore, let alone Apple.

Maybe there is a bizzare reason why they don't use https on their ocsp endpoint. Perhaps they want to avoid situation where the ocsp server's certificate itself is revoked, or anticipated that the ocsp server would still be in use 10 years later where the currently used crypto could have been marked as insecure and removed and thus prevent older clients from working. Or it could be laziness, but come on...

Re: Does Apple really log every app you run? A technical look

#264

Post by open-source-ux »

izacus wrote: post #256

When it comes to these article, you should really apply the following "smell" test: Replace "Apple" with "Google", "Facebook", "Verizon". Re-read the article. If it sounds horrifying, then it's also horrifying if Apple does it. There's no such thing as "trust" into a single corporation - especially the one which just argued that you not paying 30% to them is "theft". Applying this test helps weed out the marketing bi…

The tech industry is rife with hypocrisy when it comes to matters of privacy and online tracking. It's something rotten at the very heart of this profession. Developers are more likely to rush to defend companies - rather than scrutinise them. We'd all be better off if we stopped defending these companies. You can like - even love - a company product without feeling you owe the company any loyalty or defence. And we'd all be better off for it.

Re: Does Apple really log every app you run? A technical look

#265

Post by feralimal »

the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

> But Apple simply has to find a more privacy-aware system designs for this problem which does not leak this kind of data without an opt-in and also does not impact application startup times. (revocation lists?)

The idea that you need apple to certify the developer over the software you run on your phone is nonsense though. You don't do that on your computer, so why do you need to be nannied on your phone?

Re: Does Apple really log every app you run? A technical look

#266

Post by WesolyKubeczek »

pushrax wrote: post #234
clankyclanker wrote: post #202

Earlier quoted context omitted.

If you have #1 and the ability to collect #3, then you’re already an intermediary between the user and Apple. At that point, what’s to prevent you from providing unacceptably slow service for the certs of those apps you don’t like and soft-locking the user out of particular apps on their own device?

The fact that this slows down devices boils down to a rushed or simply incompetent implementation. It's sensible to require waiting for a certificate check the first time an app is launched, but after that, the cache validity should be indefinite, and updates should occur asynchronously in batches. The timeout settings were also excessive. Can't forget the blatant lack of encryption. They either forgot or thought it…

When you have a good broadband, it gets so easy to assume that internets grow on them trees, latency is negligible, and servers are fast and always up.

Re: Does Apple really log every app you run? A technical look

#268

Post by polack »

The request obviously sends lots more information than just the serial number of the developer certificate. Is it "harmless" data or could they have more info about the executable in there?

Why don't the author post the OCSP request of Thunderbird too? And how about another request for Firefox so we can compare the data? This article really doesn't clear anything up for me...

Re: Does Apple really log every app you run? A technical look

#269

Post by angry_octet »

WesolyKubeczek wrote: post #266
pushrax wrote: post #234

Earlier quoted context omitted.

The fact that this slows down devices boils down to a rushed or simply incompetent implementation. It's sensible to require waiting for a certificate check the first time an app is launched, but after that, the cache validity should be indefinite, and updates should occur asynchronously in batches. The timeout settings were also excessive. Can't forget the blatant lack of encryption. They either forgot or thought it…

When you have a good broadband, it gets so easy to assume that internets grow on them trees, latency is negligible, and servers are fast and always up.

Yes it is ridiculous that an internet query is in the path of starting a local app for the first time in X hours. If it has to be done, it could be done in a daily batch for all apps when the connection is idle, and on install. Using bloom filters to check for recent invalidations would be even better.

Re: Does Apple really log every app you run? A technical look

#270

Post by angry_octet »

theginger wrote: post #258
_qulr wrote: post #59

Earlier quoted context omitted.

> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic: https://lapcatsoftware.com/articles/ocsp.html

Any idea how they changed the cache time remotely? If the OS is honouring the cache control headers of a plain text response this has its own security implications.

The response is signed by Apple, and presumably (!) your Mac is validating that signature correctly. I haven't checked if they are using stapling, but that would be the sensible way to do it, in which case it is a server side parameter (though possibility with client side limits too, but you'd need to disassemble the binary).
Post reply on HN