Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

rambo.codes

Post reply on HN
Print view View original

41–50 of 259 posts

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#41

Post by plugin-baby »

gtvwill wrote: post #19
gw99 wrote: post #10

Earlier quoted context omitted.

The scary thing is it's the least bad option when it comes to overall reliability.

Ooo that's a big depends on the situation. Making only phone calls. Sure iPhones are great. Running LOB apps. Lol have fun passing that crap through apples store. Androids way easier for LOB. Remote MDM? Lol nightmare using apples gear. Warranty services? Also a nightmare. Fleet level warranty support? Ahahhahhaha have fun paying folks like IBM out the kazoo. No thanks. iPhones are rock solid if you played w Fischer…

What are LOB and MDM?

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#43

Post by codalan »

gw99 wrote: post #10
QuackyTheDuck wrote: post #4

Sigh … I so much want Apple to get their shit together. To me it feels like software quality reached a new low.

The scary thing is it's the least bad option when it comes to overall reliability.

I think it depends on the phone.

The Google Pixel series seems pretty solid for reliability. I have a Pixel 7 Pro and it's been really good so far in terms of software and build quality. I strongly prefer it to my iPhone 13 Pro, which I'm currently selling off.

But iPhone vs Samsung Galaxy? iPhone wins by a mile. I never got used to the custom interface Samsung loaded onto those phones, and hated that it included Samsung-specific apps that just duplicated those already available by default on stock Android.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#44

Post by TheFreim »

hazyc wrote: post #18

Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.

> I know who loves using Siri is my 70yr old dad.

My mother loves using Siri, she always uses it when she wants to look things up. It seems quite useful for people who aren't proficient at typing quickly, easier to ask Siri.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#45

Post by dangerwill »

pvg wrote: post #35
henriquez wrote: post #8

Seems like $70,000 would have been a more fair bounty. This is a really nasty bug.

$70,000 would have been more fair There's really no basis for this beyond its reflexive repetition on messageboards. You might as well type 'million dollar logout CSRF' in every vulnerability report thread.

It is definitely arbitrary but part of me does think that surfacing such a bug is pretty important and if the monetary incentive was higher then we would have more white hat pentesters out there.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#46

Post by MBCook »

yazzku wrote: post #13

Quoted post unavailable.

So he should have sold this? He’s always seemed like a good person to me who would do that.

Sit on it knowing others may find it and users are at risk?

Who cares he got paid. That’s not why he did it, he found it while developing one of his apps and reported it. Good for him.

It’s nice Apple paid him. I can understand thinking it should have been more. But what ethical alternative is there to reporting it?

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#47

Post by walterbell »

MBCook wrote: post #39
walterbell wrote: post #17

If an iOS app did not have "Background App Refresh" permission, could it still have exploited this vulnerability? Can physical microphones be removed from Apple devices by a repair shop, while still allowing use of wired/wireless headsets? We need Purism-style hardware kill switches for microphones, cameras and radios.

Note this Bluetooth only.

Yes, the question is how to permanently restrict the attack surface / time windows for audio and video surveillance attacks.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#48

Post by walterbell »

lapcat wrote: post #32

Don't forget that iOS and macOS silently re-enable Bluetooth on every software update. https://lapcatsoftware.com/articles/bluetooth.html

Even worse, Control Panel buttons only "suspend" BT/WiFi, you have to go into Settings to turn them off again ... and again ... and again.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#49

Post by Ntrails »

hazyc wrote: post #18

Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.

I disabled it all the day it came out.

I briefly enabled so I could text mum to say when I was nearly home. Avoids sneaking a traffic light text. Turns out it was waaaaaaaay more distracting and time consuming to get siri to text a single word, so back into the box it went

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#50

Post by aparks517 »

hazyc wrote: post #18

Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.

For sure. I stood in line for the original iPhone, owned every model (except the 5C) up through the 6, then an SE, X, and now an 11 Pro since it came out. I played around with Siri when it debuted, but didn't use it much. I turned it off at some point (I think it was when Apple was catching grief for keeping recordings or something like that) and haven't missed it. I'm not against it especially -- it just never really became part of my life.
Post reply on HN