Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

281–290 of 355 posts

Re: Does Apple really log every app you run? A technical look

#281

Post by WesolyKubeczek »

tsimionescu wrote: post #257
sebastien_b wrote: post #186

Earlier quoted context omitted.

I think that's one of the big problems with public companies, especially those that have "regular people" as their main money maker (the "consumers") - invariably, the company's needs (duty) to make money for their real customers (the shareholders) will take precedence over what would be "the best thing" for consumers. I wish we could do away with the whole "public company" thing - just imagine how much better Facebo…

Privately owned companies are not accountable to their users, they are accountable to their owners, just like publically traded ones. It's just that they have fewer owners, and you sometimes get owners with really nice ideas. Other times, you get even more tyrannical owners. Instead, what would be really nice is imagining how those companies would fare as worker-owned companies. Especially with these big internet beh…

Or not, as Soviet Union with its workers-owned factories can tell. Ever rode a Soviet car that wasn’t copypasted from Fiat?

Re: Does Apple really log every app you run? A technical look

#282

Post by topranks »

the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

Clear-text is the OSCP mechanics. This is nothing to do with Apple or MacOS.

Potentially it could now be tackled with DNSSEC + DoH similar to the records ESNI/ECH puts in the DNS to encrypt initial HTTPS client hellos.

But the loop issue is quite real. How can you validate the certificate the OSCP server gives you has not been revoked, using OSCP???

Re: Does Apple really log every app you run? A technical look

#283

Post by topranks »

lowendbeholder wrote: post #192
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

The loop argument makes no sense at all. HTTP is being used as a transport for a base64-encoded payload, the actual process of veryfing the validity of the developer certificate is done by the service behind that Apple URL - not by the HTTP stack. There is no justification not to switch to HTTPS here.

Ok say we switch OSCP to HTTPS.

How to we know the certificate presented by the OSCP server has not been revoked? We can’t ask the OSCP server cos that’s what we’re trying to handshake with!

The loop is very real and non trivial to solve. I’d expect something similar to what ESNI/ECH does leveraging DNSSEC + DoH may be possible NOW, but that’s a recent development.

Re: Does Apple really log every app you run? A technical look

#284

Post by topranks »

marcan_42 wrote: post #247
lowendbeholder wrote: post #192

Earlier quoted context omitted.

The loop argument makes no sense at all. HTTP is being used as a transport for a base64-encoded payload, the actual process of veryfing the validity of the developer certificate is done by the service behind that Apple URL - not by the HTTP stack. There is no justification not to switch to HTTPS here.

It's convention. With browsers, you wouldn't want to introduce a recursion point in TLS (we already have certificate chains, and now we'd get OCSP check chains and where does that terminate?). Apple just did what everyone else does for OCSP, in a way which is accepted practice for good reasons. Now in this specific instance, OCSP is being used in quite a different use case. For one, the plaintext issue is not a probl…

Correct.

Want to point out that certs are encrypted with TLS1.3, and DNSSEC+DoT/DoH makes ESNI/ECH possible by putting keys in the DNS.

Ultimately maybe OSCP could do something similar, or fall back to DANE or some alternate validation method that wouldn’t cause a “loop.”

Re: Does Apple really log every app you run? A technical look

#285

Post by znpy »

the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

> this one is way too Apple apologetic for my taste.

I'm not surprised. Apple fanatics routinely deny evidence to support their sorta-religion.

Re: Does Apple really log every app you run? A technical look

#286

Post by WesolyKubeczek »

angry_octet wrote: post #269
WesolyKubeczek wrote: post #266

Earlier quoted context omitted.

When you have a good broadband, it gets so easy to assume that internets grow on them trees, latency is negligible, and servers are fast and always up.

Yes it is ridiculous that an internet query is in the path of starting a local app for the first time in X hours. If it has to be done, it could be done in a daily batch for all apps when the connection is idle, and on install. Using bloom filters to check for recent invalidations would be even better.

How many false positives are possible with bloom filters? In the described use case, you don’t want even one.

Re: Does Apple really log every app you run? A technical look

#288

Post by d0mine »

izacus wrote: post #256

When it comes to these article, you should really apply the following "smell" test: Replace "Apple" with "Google", "Facebook", "Verizon". Re-read the article. If it sounds horrifying, then it's also horrifying if Apple does it. There's no such thing as "trust" into a single corporation - especially the one which just argued that you not paying 30% to them is "theft". Applying this test helps weed out the marketing bi…

Better replace "Apple" with "TikTok", "Zoom" otherwise people might think about "Google", "Facebook" that (paraphrasing) «they may be sons of bitches, but they are our sons of bitches» (regardless the reality).

Re: Does Apple really log every app you run? A technical look

#289

Post by bogomipz »

_qulr wrote: post #59
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic: https://lapcatsoftware.com/articles/ocsp.html

This was a good read as was the HP OSCP incident you linked to in the post. With regards to HP cert being revoked I'm amazed that this didn't get more attention. You would think there would be checks in place to calculate something like "well there's been 100 million OSCP checks for this printer driver in the last 24 hours so we might not want to revoke its cert."

Re: Does Apple really log every app you run? A technical look

#290

Post by Matt3o12_ »

topranks wrote: post #283
lowendbeholder wrote: post #192

Earlier quoted context omitted.

The loop argument makes no sense at all. HTTP is being used as a transport for a base64-encoded payload, the actual process of veryfing the validity of the developer certificate is done by the service behind that Apple URL - not by the HTTP stack. There is no justification not to switch to HTTPS here.

Ok say we switch OSCP to HTTPS. How to we know the certificate presented by the OSCP server has not been revoked? We can’t ask the OSCP server cos that’s what we’re trying to handshake with! The loop is very real and non trivial to solve. I’d expect something similar to what ESNI/ECH does leveraging DNSSEC + DoH may be possible NOW, but that’s a recent development.

Well, the problem is that OSCP is leaking which applications you open (and when you open them) which is the big deal IMO. One solution would be that the OSCP is checking the HTTPs certificate in cleartext once upon startup (and maybe once every day or so thereafter), and is using HTTPs for all subsequent application requests.

I don't really see a problem here how that could cause a loop. This way, an attacker can only see:

- When you boot your Mac because it verifies the HTTPs certificate once.

- When the OSCP daemon makes a clear text request to check that the HTTPs cert is still ok

- That you have just opened an application (but not which application)

IMO that still leaks an unacceptable amount of meta data but it is miles better then using cleartext. Maybe a bloom filter here would be a much better solution + make the daemon regularly fetch bad signature that are not added the the filter yet instead of pulling. Sure the filter may hit false positives sometimes but in that case, the OSCP server could be checked and apple could see if a certificate has a high rate of false positives and adjust the bloom filter accordingly.

Post reply on HN