61–70 of 78 posts
Earlier quoted context omitted.
I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.
Fraud detection happens on the server side. The IP address is more reliable than GPS, because the client can fake GPS at any time.
Earlier quoted context omitted.
Completely different situation. The iPhone falls back to mobile data if it can't get to the internet over WiFi.
It’s also optional (called “Wi-Fi Assist”).
Earlier quoted context omitted.
I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.
> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. I don't think contactless Apple Pay actually uses device geo[1] for authorization, but it's still worth noting that iOS devices without cell connectivity (ie WiFi-only iPads) don't have GPS anyway. You can use Apple Pay on websites in Safari, though, which IIRC doesn't require location permissions to…
Apple's statement was "to prevent the sharing of fraud prevention assessments with your payment card network, you may select another card". I removed my Visa cards from Apple Pay.
Last that I heard, Raspberry Pi with VPN installed along with PiHole that you SSH/VNC (via iOS app) in to is your best option.
This doesn't stop apps using things like DNS over HTTPS etc. PiHole works pretty great today, but developers are getting sneakier and sneakier about how to obtain outbound DNS. It's not just unencrypted port 53 all the time anymore. Eventually devices will get the IP for the DNS record they want just fine, if they really want to. PiHole arguably is getting less effective with each passing year as alternate DNS resolu…
Earlier quoted context omitted.
Spoofing GPS is trivial. Getting caught or not is a toss of the coin
Cheating the location on my phone is gravy. Broadcasting an RF signal to spoof GPS (and especially across a campus), that my friend, is not trivial or cheap.
From your previous comment, it sounds like your experience may have been from a while ago? In 2022, it is fairly trivial and cheap: https://github.com/osqzss/gps-sdr-sim
I can not ;^) personally confirm that this works with a HackRF, which is like $300, but probably also with any other reasonable tx-capable sdr.
Earlier quoted context omitted.
Android only leaks connection checks. While on IOS any system app doesn't use the VPN or DNS requests. VPNs are useless on iOS, and its made to be this way, again the "privacy OS" isn't privacy focused at all. https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php
From TFA: "Apple also said that the Always On VPN feature of MDM offers a fix. Mobile Device Management is over my head. […] According to Apple, MDM lets the corporate IT techies force all data leaving an iOS device to go to the company. But, MDM is is not available to consumers." There appear to be several easy-to-use MDM solutions that cater to small businesses that would also work fine for families. Apple even has…
Earlier quoted context omitted.
> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. I don't think contactless Apple Pay actually uses device geo[1] for authorization, but it's still worth noting that iOS devices without cell connectivity (ie WiFi-only iPads) don't have GPS anyway. You can use Apple Pay on websites in Safari, though, which IIRC doesn't require location permissions to…
Some Visa cards do [1] now, https://pbs.twimg.com/media/FQyVcUHXEAMSKbt?format=jpg&name=... and can refuse authorisation if it's not sent. Apple's statement was "to prevent the sharing of fraud prevention assessments with your payment card network, you may select another card". I removed my Visa cards from Apple Pay.
"For cards with certain enhanced fraud prevention, when you attempt an online or in-app transaction, your device will evaluate information about your Apple ID, device, and location (if you have enabled Location Services), to develop fraud prevention assessments, which are used by Apple to identify and prevent fraud."
Earlier quoted context omitted.
> some radios and antennas Still an impressive feat.
I'm calling shenanigans. I used to work in a lab where we had GPS repeaters to test consumer equipment. That alone costs big bucks. And, we had the FAA come down on us big time, because our GPS repeater broadcast outside the building too far and we got into some hot water. If you were spoofing GPS campus wide over 1.544 GHz and had all your GPS sentences correct, with simple radios and antennas... and you hadn't got…
Still, it was illegal and could get everyone expelled, so I wouldn't do it again.
But over the LTE connection, which is far harder to sniff without very expensive equipment, it could be doing almost anything. And you can't even check what it's doing.
Always-on VPN that tunnels everything requires MDM commissioning. It's documented by Apple. See the section "Always On VPN": https://support.apple.com/guide/deployment/vpn-overview-depa... Is it dubious that Apple doesn't let VPN apps do this as well? Maybe. But this is known and documented.
That would then mean the app maker can effectively steal control of the phone from Apple.