Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

rambo.codes

Post reply on HN
Print view View original

61–70 of 259 posts

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#61

Post by TheJoeMan »

pvg wrote: post #54
lapcat wrote: post #40

Earlier quoted context omitted.

Here are the listed payouts from the Apple Security Bounty program, starting at $25,000. https://developer.apple.com/security-bounty/payouts/

The closest is $25,000. App access to a small amount of sensitive data normally protected by a TCC prompt. In this case you get a misleading prompt, the access requires additional interactions. It's a serious bug and I'm all for reporters of serious bugs getting bigger bounties from companies that have more cash than they know what to do with. But simply dropping a random number in every single one of these threads i…

I think you missed the end of the article where any MacOS app could turn on your AirPods microphone without any permissions at all and at any time at all.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#62

Post by Kye »

dilap wrote: post #28
hazyc wrote: post #18

Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.

Occasionally I ask her (it?) to set a timer or add a reminder, but mostly I don't. Siri is quite slow and frustratingly limited. The other day in a hurry and driving somewhere, I ended up w/ both Apple Maps and Google Maps open, simultaneously giving me directions. "Hey Siri, close Google Maps" "To close an application, swipe up from the bottom of the phone..." To paraphrase a quote from Steve Jobs, if your voice ass…

Siri's performance and quality seems to depend a lot on the on-board ML cores since it switched to on-device. It was basically unusable on my 6S Plus with its early ML cores, and now it's great on the 14 Pro Max I replaced it with. It seems like they ship a Siri to match the device capability.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#63

Post by lapcat »

pvg wrote: post #54
lapcat wrote: post #40

Earlier quoted context omitted.

Here are the listed payouts from the Apple Security Bounty program, starting at $25,000. https://developer.apple.com/security-bounty/payouts/

The closest is $25,000. App access to a small amount of sensitive data normally protected by a TCC prompt. In this case you get a misleading prompt, the access requires additional interactions. It's a serious bug and I'm all for reporters of serious bugs getting bigger bounties from companies that have more cash than they know what to do with. But simply dropping a random number in every single one of these threads i…

"Full TCC Bypass on macOS"

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#64

Post by BudaDude »

dilap wrote: post #28
hazyc wrote: post #18

Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.

Occasionally I ask her (it?) to set a timer or add a reminder, but mostly I don't. Siri is quite slow and frustratingly limited. The other day in a hurry and driving somewhere, I ended up w/ both Apple Maps and Google Maps open, simultaneously giving me directions. "Hey Siri, close Google Maps" "To close an application, swipe up from the bottom of the phone..." To paraphrase a quote from Steve Jobs, if your voice ass…

It makes no sense that Siri is so stunted in what she can do.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#65

Post by pvg »

TheJoeMan wrote: post #61
pvg wrote: post #54

Earlier quoted context omitted.

The closest is $25,000. App access to a small amount of sensitive data normally protected by a TCC prompt. In this case you get a misleading prompt, the access requires additional interactions. It's a serious bug and I'm all for reporters of serious bugs getting bigger bounties from companies that have more cash than they know what to do with. But simply dropping a random number in every single one of these threads i…

I think you missed the end of the article where any MacOS app could turn on your AirPods microphone without any permissions at all and at any time at all.

I didn't, it's just that 'vulnerability that requires a malicious app on macOS' is a much less interesting one that something like that for iOS.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#67

Post by walterbell »

dontbenebby wrote: post #57
walterbell wrote: post #47

Earlier quoted context omitted.

Yes, the question is how to permanently restrict the attack surface / time windows for audio and video surveillance attacks.

It's not really a question, hardware switches work and companies refuse to put them in so they can... shrink the profile of devices in ways that rely on rare earth minerals to an unsustainable degree when combined with the typical replacement rate.

Hopefully legislated right-to-repair can open the door to aftermarket mods, including phone body with new switches that can electrically disconnect specific sensors.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#68

Post by joshstrange »

hazyc wrote: post #18

Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.

My trust of what Siri is capable of is laughably low but I do use it for reminders ("Remind me on X day...", "Remind me in X hours...", "Remind me when I get home...") and for timers. Occasionally I'll use it for unit conversions but I usually use Alexa for that since I'm in my kitchen often when I use that and it's just right there. Other than that I don't use it.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#69

Post by TheLoafOfBread »

bryceacc wrote: post #37
TheLoafOfBread wrote: post #16

Quoted post unavailable.

first sentence: "and audio from the iOS keyboard dictation feature"

And who is using that? Half of characters are misspelled, second half misunderstood. Nobody has time to argue with a phone.

Re: SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

#70

Post by pcardoso »

gleenn wrote: post #52
nanidin wrote: post #34

Earlier quoted context omitted.

Siri killer apps for me are asking for factoids via my watch, and opening my garage door as I approach while driving (my building uses an app that requires multiple taps + swipes to open the garage door, using Siri makes it palatable.)

Are you using proprietary garage door software? Would live to have any better kind of integration there so any setup details that aren't crazy specific to some manufacturer would be interesting

Not the parent, but I use Shelly devices flashed with the shelly-homekit firmware and I can control them with the HomeKit app or Siri.

I haven't bothered yet to add a open/close sensor so the current open state is lost if I use the remote. I have to invert the actions when this happens. Annoying but I only need to use it this way occasionally.

Post reply on HN