Zero click vulnerability in Apple’s macOS Mail • Hacker News Board

Re: Zero click vulnerability in Apple’s macOS Mail

#51

Post by rogerbinns » Thu, Apr 01, 2021, 10:10 PM UTC

petra wrote: post #38

Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?

A big difference is that the software running on Apple devices is less complex. For example there is significantly less hardware support. iMessage only talks to other iMessage instances (eg no browser support). There is only one web browser engine. Third party apps can't do JIT code generation. Older APIs are actively removed, breaking existing apps (vs providing backwards compatibility).

In general less complexity is better, but it also constrains things. For example it took until recently for third party iOS to be able to do NFC. Android had it since ~2012.

Re: Zero click vulnerability in Apple’s macOS Mail

#52

Post by turmio » Thu, Apr 01, 2021, 10:11 PM UTC

microtherion wrote: post #43

Thanks for an exceptionally clear writeup. Pay that person their bounty!

Thanks!

Re: Zero click vulnerability in Apple’s macOS Mail

#53

Post by zakki » Thu, Apr 01, 2021, 10:12 PM UTC

wahern wrote: post #16

ratww wrote: post #6

Earlier quoted context omitted.

That's not what the statistics say: https://emailclientmarketshare.com

Wow, Mail.app has more market share than Outlook. I'm pleasantly surprised. Ditto for GMail only having ~30%. Although, > Since determining the client in which an email is opened requires images to be displayed, the data for some email clients and mobile devices might be over- or under-represented due to automatic image blocking. Outlook doesn't display external images by default, while Mail.app does, so....

Does Apple excluded Mail.app from their privacy focused strategy?

Re: Zero click vulnerability in Apple’s macOS Mail

#54

Post by _xnmw » Thu, Apr 01, 2021, 10:13 PM UTC

Ok, remind me never to approach Apple directly if I happen to find a vulnerability. Zerodium (or a 3-letter agency) it is!

Re: Zero click vulnerability in Apple’s macOS Mail

#55

Post by Aloisius » Thu, Apr 01, 2021, 10:15 PM UTC

veselin wrote: post #24

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

A new Mac comes with something like 30 apps in the bar. I clicked and disabled every single one of them except Finder and used Safari to download another browser. If it was any other manufacturer, this mess would be quickly denounced by reviewers as crapware. But because it is by Apple, it is not a problem at all. I am not expecting this to fix by itself. Maybe some major review blogs should first not parrot how magi…

I'm not sure I could classify any of 23 items in the default dock as as crapware.

None are demos or trialware. Hell, I use all of them except for FaceTime, Podcasts, Pages, TV and Launchpad.

I do remove most of them from the dock since I use spotlight to launch things, but removing System Preferences from my dock hardly makes it crapware.

Re: Zero click vulnerability in Apple’s macOS Mail

#56

Post by nvahalik » Thu, Apr 01, 2021, 10:19 PM UTC

Use MailMate!

https://freron.com/

Re: Zero click vulnerability in Apple’s macOS Mail

#57

Post by wunderflix » Thu, Apr 01, 2021, 10:20 PM UTC

rogerbinns wrote: post #51

petra wrote: post #38

Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?

A big difference is that the software running on Apple devices is less complex. For example there is significantly less hardware support. iMessage only talks to other iMessage instances (eg no browser support). There is only one web browser engine. Third party apps can't do JIT code generation. Older APIs are actively removed, breaking existing apps (vs providing backwards compatibility). In general less complexity i…

> Android had it since ~2012.

I seriously wonder: what difference did it make? Was there any groundbreaking thing iOS users missed for 8 years?

Apple is just great in omitting things and keeping focus to deliver a great product and then expand on that basis.

Most famous example: First iPhones didn’t have MMS

Re: Zero click vulnerability in Apple’s macOS Mail

#58

Post by rvz » Thu, Apr 01, 2021, 10:22 PM UTC

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

Your comment is about to become dead. I'll preserve the context here:

> That's gonna be devastating to the three people who use Mail.app

Multiply that by 100,000,000

Re: Zero click vulnerability in Apple’s macOS Mail

#59

Post by LegitShady » Thu, Apr 01, 2021, 10:23 PM UTC

uncledave wrote: post #18

ratww wrote: post #6

Earlier quoted context omitted.

That's not what the statistics say: https://emailclientmarketshare.com

Am I the only one using outlook and loving it?

its gotten better but its still not great.

Re: Zero click vulnerability in Apple’s macOS Mail

#60

Post by wahern » Thu, Apr 01, 2021, 10:24 PM UTC

uberduper wrote: post #47

wahern wrote: post #16

Earlier quoted context omitted.

Wow, Mail.app has more market share than Outlook. I'm pleasantly surprised. Ditto for GMail only having ~30%. Although, > Since determining the client in which an email is opened requires images to be displayed, the data for some email clients and mobile devices might be over- or under-represented due to automatic image blocking. Outlook doesn't display external images by default, while Mail.app does, so....

As far as I know and recall from the years I've been using Mail.app, it does not download external images by default.

It does. I even provided a citation several weeks ago in another thread, though a quick Google search seems to bring up ample support of its own.

Like me you may have disabled it and forgotten. Whenever I get a new laptop at work I tend to go through and change all the defaults, such as reverting to plaintext composition, and habitually disable external image loading as part of the process.

The iPhone Mail app may have saner defaults, however, but I don't have an iPhone and have never used its e-mail client.