Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Siri

applidium.com

Post reply on HN
Print view View original

31–40 of 105 posts

Re: Cracking Siri

#31

Post by icebraining »

jakubw wrote: post #22

I wonder if there are any characteristics about the microphone in Apple devices that the servers could check the audio against to prevent this sort of a thing. There should be a way to somewhat distinguish the device used to record a stream given Apple's control over the devices on which Siri runs and overcoming that would be hard enough for anyone to bother.

Maybe, but what's the point? If you try to run a service on top of this, you'll have to make so many requests that you'll either have your ID banned or you'll need to buy so many iPhones that you might as well contract a speech-to-text service to some company.

If you're just using it for personal reasons, why should Apple care?

Re: Cracking Siri

#34

Post by jakubw »

icebraining wrote: post #31
jakubw wrote: post #22

I wonder if there are any characteristics about the microphone in Apple devices that the servers could check the audio against to prevent this sort of a thing. There should be a way to somewhat distinguish the device used to record a stream given Apple's control over the devices on which Siri runs and overcoming that would be hard enough for anyone to bother.

Maybe, but what's the point? If you try to run a service on top of this, you'll have to make so many requests that you'll either have your ID banned or you'll need to buy so many iPhones that you might as well contract a speech-to-text service to some company. If you're just using it for personal reasons, why should Apple care?

What I had in mind were not services but rather Siri clients for non-Apple hardware, which I assume Apple would not be particularly happy about. When Siri comes to iPads and Macs, owners of a much broader range of devices could take an ID and use it, for instance, in an unofficial Siri client (should one be created) on an Android device. But then again, I may be way overthinking this.

Re: Cracking Siri

#35

Post by planb »

pflats wrote: post #28
planb wrote: post #18

Earlier quoted context omitted.

Unfortunately, Siri does not use the system wide proxy. At least it does not on my iPhone. I tried intercepting the traffic with sshmitm which did work for all other iOS services (e.g. game center) but not for Siri. I'm wondering how these guys sniffed the traffic.

Did you read the article? When the proxy failed, they "ressorted (sic) to using tcpdump on a network gateway". They eventually had to "setup a custom SSL certification authority, add it to our iPhone 4S, and use it to sign our very own certificate"

I have read that, but they used tcpdump only to detect what kind of traffic Siri sends after failing to use a normal HTTP proxy. Setting up a custom SSL certification authority is exactly what sshmitm does - but it does not (yet) support transparent proxying. Somehow they have redirected traffic for guzzoni.apple.com to a fake server that acts as a man in the middle (probably simply by using their own DNS), but what I wanted to know is what software they used to fake that server.

Re: Cracking Siri

#36

Post by mbq »

Anyway, this is a proof that siri is a pure cloud service and as such may work even on 5-yo Sagem...

Re: Cracking Siri

#37

Post by hmottestad »

LaGrange wrote: post #30
hmottestad wrote: post #20

Earlier quoted context omitted.

Hmm. That sounds like a big security hole. Phishing attacks in particular. Though I guess the extra clicks should discourage users.

It is necessary — some places have custom non-public CA's, for things like S/MIME and internal servers. On the other hand, I'm pretty sure Siri doesn't have to communicate with your company's internal servers (and my paranoia already suggests a malicious IT department, reckless — and probably illegal — as that would be), so the code should, in my opinion, accept only specific CAs.

Compartmentalization would make sense. Installing a root CA in the email app would only work for the email app.

Re: Cracking Siri

#38

Post by schiffern »

jakubw wrote: post #34
icebraining wrote: post #31

Earlier quoted context omitted.

Maybe, but what's the point? If you try to run a service on top of this, you'll have to make so many requests that you'll either have your ID banned or you'll need to buy so many iPhones that you might as well contract a speech-to-text service to some company. If you're just using it for personal reasons, why should Apple care?

What I had in mind were not services but rather Siri clients for non-Apple hardware, which I assume Apple would not be particularly happy about. When Siri comes to iPads and Macs, owners of a much broader range of devices could take an ID and use it, for instance, in an unofficial Siri client (should one be created) on an Android device. But then again, I may be way overthinking this.

Duplicating Siri involves much more than just speech-to-text -- the language understanding is the hard part. Heck, Google has its own speech-to-text servers.

Re: Cracking Siri

#39

Post by hmottestad »

jakubw wrote: post #34
icebraining wrote: post #31

Earlier quoted context omitted.

Maybe, but what's the point? If you try to run a service on top of this, you'll have to make so many requests that you'll either have your ID banned or you'll need to buy so many iPhones that you might as well contract a speech-to-text service to some company. If you're just using it for personal reasons, why should Apple care?

What I had in mind were not services but rather Siri clients for non-Apple hardware, which I assume Apple would not be particularly happy about. When Siri comes to iPads and Macs, owners of a much broader range of devices could take an ID and use it, for instance, in an unofficial Siri client (should one be created) on an Android device. But then again, I may be way overthinking this.

Probably. Take note of the fact that OS X editions don't use a serial number. You can very easily share them with friends and family and online. Same goes for iWork, however some of the more expensive software does use SN.

If you already bought an iphone/mac/ipad (in the future) that has Siri, then I don't think apple will care much if you use siri on other devices. However what is really useful with siri is where it talks to the os layer and other applications. That kind of integration isn't all that easy to do.

So if someone writes an app with the integration to the os and apps (calendar, sms, phone, phonebook...) and decide to use Siri (illegally), then I think they deserve a medal or soemthing for their hard work for porting the siri front end to another platform.

Re: Cracking Siri

#40

Post by jentulman »

The question that springs to my mind is not 'how can I play with this?' but 'Are Apple bringing Siri to the desktop?', seeing as it appears there's nothing specific to the 4S hardware in how this works.

I'd quite like to be able to add calendar entries or tweet without moving to another application.

Post reply on HN