Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Siri

applidium.com

Post reply on HN
Print view View original

51–60 of 105 posts

Re: Cracking Siri

#51

Post by coob »

kmm wrote: post #47
mbq wrote: post #36

Anyway, this is a proof that siri is a pure cloud service and as such may work even on 5-yo Sagem...

Not exactly. The text-to-speech is done in the cloud, but the hard part (algorithmically speaking) is natural language processing, which apparently (I don't know for sure) is still done on the phone. I don't know what Apple's excuse is though, but limited processing power is certainly not a problem.

From the article:

> The iPhone 4S really sends raw audio data. It’s compressed using the Speex audio codec, which makes sense as it’s a codec specifically tailored for VoIP.

Re: Cracking Siri

#52

Post by mikeash »

cjoh wrote: post #23

It'd be interesting to see whether or not Apple changed the Siri protocol since the acquisition. Was this originally how Siri worked when it was independent? Because Siri has roots in government contracting (it's named after SRI International, and was originally funded by DARPA) I wonder if the roots of the obfuscation start there rather than at Apple.

I believe the DARPA project was purely textual, and speech recognition was only added after it was spun off to make it more consumer friendly.

Re: Cracking Siri

#53

Post by trotsky »

planb wrote: post #35
pflats wrote: post #28

Earlier quoted context omitted.

Did you read the article? When the proxy failed, they "ressorted (sic) to using tcpdump on a network gateway". They eventually had to "setup a custom SSL certification authority, add it to our iPhone 4S, and use it to sign our very own certificate"

I have read that, but they used tcpdump only to detect what kind of traffic Siri sends after failing to use a normal HTTP proxy. Setting up a custom SSL certification authority is exactly what sshmitm does - but it does not (yet) support transparent proxying. Somehow they have redirected traffic for guzzoni.apple.com to a fake server that acts as a man in the middle (probably simply by using their own DNS), but what…

Not sure what they used, but this software should be suitable:

http://www.thoughtcrime.org/software/sslsniff/

Re: Cracking Siri

#54

Post by Volpe »

No one is at all concerned that this is a hack?

I know it's interesting stuff, but I'm curious what "rights" Applidium have in publishing this information.

With this information, (if I'm not wrong) it wouldn't take long to simply DDoS Siri...

Or port Siri to Android (effectively stealing IP).

(I have no bias either way, just pointing out, if someone figured out how to reverse engineer dropbox, so you could use their space, without a dropbox account, would we all be going "wow, this is so cool!" or would we be crying out "this is such an irresponsible hack!")

Re: Cracking Siri

#55

Post by aperiodic »

defen wrote: post #46
icebraining wrote: post #9

Earlier quoted context omitted.

Maybe, but then you need to manually add your own root CA to the iPhone, or the cert verification will fail, so it's not a security issue.

Might be a way to jailbreak the phone though, no?

Only if there's an exploitable bug in the Siri client.

Re: Cracking Siri

#56

Post by solutionyogi »

adamjernst wrote: post #41
jentulman wrote: post #40

The question that springs to my mind is not 'how can I play with this?' but 'Are Apple bringing Siri to the desktop?', seeing as it appears there's nothing specific to the 4S hardware in how this works. I'd quite like to be able to add calendar entries or tweet without moving to another application.

I think the 4S-specific hardware is the improved proximity detector. This allows you to raise the phone to your ear and speak to Siri instantly. I suspect the older phones' proximity sensor isn't fast enough to support that feature, so Apple figured they'd go 4S only. (It can't hurt that they sell more phones that way.)

Actually, Apple included an additional proximity detector to make sure Siri works when you bring the phone to ear. Here's iFixit report:

http://www.ifixit.com/blog/blog/2011/11/09/little-sister-sir...

This means that Siri won't provide optimum experience (pick the phone to ear and Siri is ready to take the command) for iPhone4 and older versions.

Re: Cracking Siri

#57

Post by modeless »

Volpe wrote: post #54

No one is at all concerned that this is a hack? I know it's interesting stuff, but I'm curious what "rights" Applidium have in publishing this information. With this information, (if I'm not wrong) it wouldn't take long to simply DDoS Siri... Or port Siri to Android (effectively stealing IP). (I have no bias either way, just pointing out, if someone figured out how to reverse engineer dropbox, so you could use their…

Hacks are admired here, not condemned. Reverse engineering should always be allowed. This information doesn't make it possible to DDoS Siri or port it to Android as each request requires a unique iPhone ID; Apple can easily filter out unauthorized requests.

Re: Cracking Siri

#58

Post by Volpe »

modeless wrote: post #57
Volpe wrote: post #54

No one is at all concerned that this is a hack? I know it's interesting stuff, but I'm curious what "rights" Applidium have in publishing this information. With this information, (if I'm not wrong) it wouldn't take long to simply DDoS Siri... Or port Siri to Android (effectively stealing IP). (I have no bias either way, just pointing out, if someone figured out how to reverse engineer dropbox, so you could use their…

Hacks are admired here, not condemned. Reverse engineering should always be allowed. This information doesn't make it possible to DDoS Siri or port it to Android as each request requires a unique iPhone ID; Apple can easily filter out unauthorized requests.

"As a result, we are able to use Siri’s recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri!"

Are they just lying then?

There demo said they got siri to work with no iphone involved (in the end).

Also... DDoS would still be effective, no? (the server still has to 'filter')

> Hacks are admired here

You sure about that? A lot of China-bashing happens here based around it's 'Hacking' of U.S targets, I've never seen admiration of such things.

Re: Cracking Siri

#59

Post by skore »

Volpe wrote: post #58
modeless wrote: post #57

Earlier quoted context omitted.

Hacks are admired here, not condemned. Reverse engineering should always be allowed. This information doesn't make it possible to DDoS Siri or port it to Android as each request requires a unique iPhone ID; Apple can easily filter out unauthorized requests.

"As a result, we are able to use Siri’s recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri!" Are they just lying then? There demo said they got siri to work with no iphone involved (in the end). Also... DDoS would still be effective, no? (the server still has to 'filter') > Hacks are admired here You sure about that? A lot of China-bashing happens here ba…

You are confusing cracking and hacking.

Re: Cracking Siri

#60

Post by modeless »

Volpe wrote: post #58
modeless wrote: post #57

Earlier quoted context omitted.

Hacks are admired here, not condemned. Reverse engineering should always be allowed. This information doesn't make it possible to DDoS Siri or port it to Android as each request requires a unique iPhone ID; Apple can easily filter out unauthorized requests.

"As a result, we are able to use Siri’s recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri!" Are they just lying then? There demo said they got siri to work with no iphone involved (in the end). Also... DDoS would still be effective, no? (the server still has to 'filter') > Hacks are admired here You sure about that? A lot of China-bashing happens here ba…

They're not lying. Anyone could write an Android app that uses Siri, but it would require the ID from an iPhone to work, so distributing it would be problematic.
Post reply on HN