Mysk🇨🇦🇩🇪

Relocated to @mysk

Public Key

npub1exwkjulsaqdh5xlplwrnzs3z0p9shf54hw3kxj4pu8eq3wc35y0qu08x90

NIP-05 Address

mysk_at_defcon.social@mostr.pub

Profile Code

nprofile1qqsvn8tfw0cwsxm6r0slhpe3gg38sjct562mhgmrf2s7rusghvg6z8spz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qhggqnz

Publishing to

relay.mostr.pub

Author Public Key

npub1exwkjulsaqdh5xlplwrnzs3z0p9shf54hw3kxj4pu8eq3wc35y0qu08x90

Show more details

Last Notes

2023-12-17 18:54:12

- reply

✅
#raspberrypi #Privacy #InfoSec #privacymatters #cybersecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/111/597/272/998/001/764/original/54a39603dcdd412e.png

2023-12-11 12:54:25

Operation Remove Philips Hue Bridge is underway.
#raspberrypi #Privacy #InfoSec #privacymatters #cybersecurity
https://defcon.social/@mysk/111097362983335713
https://files.defcon.social/dcsocial-s3/media_attachments/files/111/561/884/095/053/420/original/d2fedad23327693b.jpeg

2023-07-02 16:43:10

RIP
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/645/489/598/789/133/original/8aa1ff51772eb811.png

2023-07-02 11:59:17

Here's why you should start sharing screenshots instead of links when sharing tweets:
-Tweets can no longer be viewed anonymously
-Twitter links contain tracking tags
-You use up users' reading limits
-Link previews work randomly
-Embeds might be blocked
#privacy #TwitterLimit #Infosec
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/644/373/344/850/255/original/caad86a2eb88919d.png

2023-06-29 07:43:06

Goodbye Apollo
@npub1p9k…865w
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/626/378/028/345/857/original/0e1fc0d6538dd7be.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/626/379/036/254/535/original/7a08d0a4aa258f74.png

2023-06-27 18:46:15

iOS Developers will need to apply for access to required reason APIs. These are the APIs that can be used for fingerprinting #iOS users across apps. This is what it means when an app is denied access to them:
(Snippet taken from MS Authenticator usage data)
#privacy #Apple #iOS17
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/617/661/739/940/554/original/1c8ba0ef8a59017c.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/617/661/911/857/453/original/f828185e67e7ee91.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/617/662/078/113/016/original/b4679058695104c9.jpeg

2023-06-27 14:52:59

The name of #Instagram’s upcoming #Twitter competitor seems to be "Threads." Instagram's associated domains file lists an iOS app with the ID: MH9GU9K5PX. com.burbn.threads
This file lets #iOS associate an app with its developer's website.
Link:
instagram.com/.well-known/apple-app-site-association
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/616/744/828/283/478/original/cdc410753a5995da.jpeg

2023-06-27 12:41:09

- reply

@npub1d0q…6qzl In this case it means third-party libraries that developers include in their apps

2023-06-27 10:07:27

At #WWDC23 Apple announced that all third-party SDKs are required to specify how they handle user data in a manifest file named PrivacyInfo.xcprivacy. This will be mandatory by Spring 2024. At the moment, only one GitHub project has added this file.
#Privacy #iOS #Apple
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/615/622/009/497/396/original/b8d16f2f6b36d8d1.png

2023-06-27 09:41:20

iOS 17 will require developers to state why their apps need access to information such as device language, time zone, and active keyboards to stop fingerprinting. Yet, access to the motion sensors is still unrestricted. Here's why Apple should change that:
#privacy #apple #ios #infosec #cybersecurity
https://www.mysk.blog/2021/10/24/accelerometer-ios/

2023-06-26 23:27:07

- reply

@npub18me…vw7d The documentation is very minimal at this point. NSUserDefaults is part of the app sandbox. No idea how this can be used or abused to fingerprint users across apps!

2023-06-26 23:06:17

These properties have long been used to fingerprint users. Starting iOS 17, developers must specify why they need to access them before they are made available to their apps. This will be part of the App Review starting in Spring 2024
#Privacy #iOS17
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/613/022/129/815/117/original/8dad88380a82564f.png

2023-06-26 14:23:21

Chris Markiewicz (Senior Program Manager, App Store): There is a trusted place for users to discover apps that meet our high standards for safety, privacy, and performance, and that's the App Store.
Apple's high standards for safety and privacy: (Second part of the video)
#Apple #privacy #iOS #appStore #cybersecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/610/962/207/871/383/original/e9903449c574b74b.mp4

2023-06-26 14:20:14

2023-06-24 21:41:47

The first three search results on Google Play are ads whereas the first search result on the App Store is an ad. Either way good luck finding the app you're searching for.
#Apple #Google
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/601/364/913/241/589/original/2eb66d9822871046.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/601/365/330/664/391/original/b2d435c4c2d98af3.png

2023-06-22 20:54:46

"Send Me Location"
Just like Meta apps, the first thing they ask about is "location"
#privacy #cybersecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/589/855/848/513/011/original/a60018a5a857a4fa.jpeg

2023-06-22 11:47:45

- reply

@npub1dsl…pk6e It would be great if they do, but I never heard of that.

2023-06-22 11:31:37

- reply

@npub1dsl…pk6e In the case of this app, Apple has suspended the developer account altogether. This means all running subscriptions will be canceled. If you delete the app, you won't be able to re-install it as you won't find the app in the store or in your purchased list. Never heard of alerts or anything like that. As per Google, I'm not familiar with their store.

2023-06-21 18:11:12

- reply

And @GooglePlay seems to have taken down the #Android version of the app. It's unclear if it is a coincidence or a coordinated act by #Apple and #Google.
Awareness ✌️
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/583/550/233/520/423/original/49dd5f330567b946.jpeg

2023-06-21 17:07:57

BREAKING: The App Store has taken down the scam #2FA app that steals secrets.
We warned about this app four months ago. This wouldn't have happened without your support to spread the word. Thank you! 🙏🙏✌️
https://defcon.social/@mysk/110573066626397762
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/583/301/637/148/068/original/15d8bb0ddf31f2aa.png

2023-06-21 10:59:41

Here we have the same post on both Twitter and Mastodon. The interactions of the post on Mastodon by far exceed the numbers on Twitter 🤯
(Twitter, 11K followers) (Mastodon, 1.5K followers)
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/581/853/422/563/083/original/400254cf79be0568.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/581/853/519/170/612/original/a36610d0669371a0.jpeg

2023-06-20 22:55:06

- reply

@npub1jhw…3dyr The secrets are collected as part of the app analytics and sent to the developer's Google Analytics account.

2023-06-20 21:44:14

Some reviews from the US App Store do suggest that users were tricked to download this scam app instead of Microsoft Authenticator:
https://defcon.social/@mysk/110576091858818294
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/578/725/207/700/850/original/ddbcc2823a05ee1f.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/578/725/403/057/324/original/31fc3d3e61859489.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/578/725/667/966/877/original/cfc9fb125bb45828.png

2023-06-20 21:09:48

- reply

Just tested the latest version and it still sends scanned secrets to the developer's remote server (Version 1.10.1). Meanwhile, the app has climbed to no. 13 on the German App Store 😳

2023-06-20 19:45:49

- reply

@npub16xq…x72u Yes, but you must download the app first. Then, an option to report the app appears in the information section of the app in the App Store, more here:
https://beebom.com/how-report-bad-apps-scams-app-store-iphone/

2023-06-20 16:16:09

- reply

@npub1yck…ujmw
Read the text in the screenshots it includes in the ad. And when you search for "Google Authenticator", it uses screenshots with text suggesting it is a Google app. Also check this video out:
https://defcon.social/@mysk/110576091858818294
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/577/435/600/772/673/original/ac3030b45d6cbfc7.png

2023-06-20 15:51:24

- reply

@npub10fr…aw9l Yes, and many other users reported it, too.

2023-06-20 13:18:18

- reply

@npub1mca…yyxu This's very easy to say if you're knowledgeable about IT. But many people aren't. I tested this with multiple persons. They all picked the first app because it's highlighted and also because the screenshot says "Microsoft"

2023-06-20 11:43:10

- reply

A video showing how the app abuses search keywords to trick users:
https://defcon.social/@mysk/110576091858818294

2023-06-20 10:36:58

- reply

More on this here:
https://defcon.social/@mysk/110573066626397762

2023-06-20 10:35:09

- reply

More on this here:

2023-06-20 10:34:21

🎬 So this scam #2FA app is using custom product pages of Apple Search Ads to trick users. It has different campaigns per search keywords. When searching for "Microsoft Authenticator", it shows screenshots highlighting "Microsoft". and when searching for "Google Authenticator", it highlights "Google". Watch the video 🤯
It's worth noting that custom product pages need to be approved by @AppStore Connect and Apple Search Ads.
This app steals 2FA secrets and its model is very suspicious as noted below.
Friendly reminder: Mastodon uses no algorithms for discovering posts. The only way to spread the word is by boosting posts. If you think this post is helpful, boost it to reach others. Thank you 🙏
#Privacy #Apple #iOS #cybersecuritytips #infosec #cybersecurity #security #2FactorAuthentication
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/576/090/066/954/210/original/7ed1a9d8947a8605.mp4
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/576/090/526/097/938/original/660157ac19111a1e.png

2023-06-20 08:45:57

- reply

@npub1dus…3xj7 Thank you 🙏

2023-06-20 08:42:11

- reply

@npub1dus…3xj7 Because Apple is unable guard the App Store and examine all apps. The ranking is not decided by Apple. It's decided by the number of downloads. So it's purely based on statistics. We highlighted a list of apps that looked as if they were a copy of each other. Their design, pricing, and metadata clearly show that they're suspicious. It's all covered in the linked YouTube video. They weren't caught by Apple's strict review process. Apple reacts very slowly. They actually took down two apps of the ones we highlighted. But the others are still live and scamming users.

2023-06-20 08:32:10

- reply

@npub18u2…zmxk Apple allows developers to reset ratings. It's up to the developer to use this tool. As a developer, you can also request Apple to remove specific written reviews if you have a good reason. We exercised this option a couple times to remove reviews that contained inappropriate language.
This link describes hiw developers can reset ratings:
https://developer.apple.com/help/app-store-connect/monitor-ratings-and-reviews/reset-an-app-summary-rating/

2023-06-20 08:19:14

- reply

@npub1ng6…pghq Yes, like four months ago

2023-06-20 08:18:20

- reply

@npub1dus…3xj7 Scamming users.

2023-06-19 21:46:50

- reply

We demonstrated how this app steals secrets on Naomi Brockwell's channel, make sure you watch the episode ✌️:
https://youtu.be/cP1LVbLAcSU

2023-06-19 21:44:59

The rogue 2FA app that steals scanned secrets is now ranked 18 on the German App Store for the productivity category. No wonder! The app disguises as a Microsoft app. It is the top hit when you search for "Microsoft Authenticator" and the developer has updated the screenshots in the ad card to highlight the word "Microsoft". Surprisingly, the product page of the app shows different screenshots with the word "Microsoft" removed.
The app now has 1.2K reviews, as opposed to 18 when we first addressed the app.
#privacy #security #2FactorAuthentication #iOS #infosec
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/573/061/628/078/994/original/14dc48ce1294cf70.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/573/062/151/440/080/original/d15670332ab26d6e.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/573/063/708/284/052/original/c46d2bb85b2072d1.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/573/066/359/993/238/original/c4807d66c4e3e464.png

2023-06-19 19:02:17

Other EU rules you might like:
- The right to request a copy of your data
- Allowing 3rd-party app stores and app sideloading
- Adoption of USB Type-C
https://mastodon.online/@9to5Mac/110572317947839975

2023-06-19 13:15:53

🎬 There is a new option in macOS Sonoma that lets you show desktop items by simply clicking anywhere on the desktop wallpaper. 👍
#macOS14 #Sonoma
Demo: 👇
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/571/063/228/354/656/original/cad06d8214d9f24c.mp4

2023-06-19 11:22:07

- reply

@npub1x7n…wle4 Cool, thanks. So they must have updated the file remotely.

2023-06-19 10:01:31

🎬 Safari in #macOS 14 #iOS/#iPadOS 17 removes tracking added to URLs in private browsing. The feature didn't support Twitter links when we tested it earlier. Now it does (unclear if #Apple updated it remotely or Safari learned that through its #AI model).
In this demo, Safari opens a Twitter link with tracking added to it in this parameter:
t=rpDAfXAHMthyq-L5hTMOIA
Safari identifies and removes the tracking parameter before opening the link. This is shown by copying the link after the website is loaded and pasting it to see that the tracking parameter has been removed from the original link 👍👍🙏
#privacy #security #infosec #cybersecurity #cybersecuritytips
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/570/297/994/139/888/original/6c589986d74802d3.mp4

2023-06-19 09:55:38

🎬 Safari in #macOS 14 #iOS/#iPadOS 14 removes tracking added to URLs in private browsing. The feature didn't support Twitter links when we tested it earlier. Now it does (unclear if #Apple updated it remotely or Safari learned that through its #AI model).
In this demo, Safari opens a Twitter link with tracking added to it in this parameter:
t=rpDAfXAHMthyq-L5hTMOIA
Safari identifies and removes the tracking parameter before opening the link. This is shown by copying the link after the website is loaded and pasting it to see that the tracking parameter has been removed from the original link 👍👍🙏
#privacy #security #infosec #cybersecurity #cybersecuritytips
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/570/275/889/317/457/original/37cda2e9a68a1c99.mp4

2023-06-17 21:58:51

- reply

@npub1ypd…ekls @npub14u2…nx4k We're too nice to do that, although it actually crossed our mind that we mine Cryptocurrencies on their servers using JS code. 😂

2023-06-17 21:46:00

- reply

@npub14u2…nx4k @npub1ypd…ekls If we wanna try to be nice to their servers, we can use a web server that keeps the TCP connection open and keeps sending just one byte just before the timeout is reached. This extremely slow connection will force Facebook servers to keep the tcp connection open endlessly. This way, you just need around 65K connections to reserve all the ports on a single server. A coordinated effort might sideline their entire pool.

2023-06-17 21:00:39

- reply

Facebook security team dismissed both cases.
The issue of running JavaScript code on Facebook servers was reproducible on LinkedIn servers. YouTube took down Facebook's demo, but it was identical to this:
https://youtu.be/SLBRwZbpN2c

2023-06-17 20:59:37

- reply

In short, we found out that when you send a link through Facebook Messenger or Instagram DM:
1- If the link points to a document, their servers download it, even if it was GBs in size
2- If it points to a website, their servers execute its JavaScript code
https://youtu.be/9a_5hoBL7s0

2023-06-17 20:58:42

And when it comes to reporting #privacy issues, Facebook #security team is the worst to deal with as a researcher. It's close to impossible to convince them that they shouldn't collect data they harvest. Worse, when you publish the findings, they ask YouTube to take it down!
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/561/559/707/692/610/original/c2c0cd8391c2bbd4.mp4

2023-06-17 11:47:45

- reply

@npub1pet…ny79 I remember it was a server that generates links sent through MS Teams. We tested it, but didn't include it because we didn't want the list to be too long.

2023-06-16 22:27:40

During our research about how different platforms and apps generate link previews, we discovered a vulnerability in #Reddit and reached out to their security team. They were quick and cooperative. They treated our work very fairly. One caveat though, they don't allow disclosure of security bugs even after fixing them.
If you're curious how link previews get generated in chats and direct messages, check out our article:
https://www.mysk.blog/2020/10/25/link-previews/

2023-06-16 10:46:44

Craig Federighi: "The data that's interesting to train these [AI] models is data that is publicly available data, not personal data. We do not need your personal data to make our systems smart. And when we need to get specific data for a specific person, we're not doing that by spying on people we're gonna go out and get it the right way."
Such public statements about respecting users privacy are the reason why #Apple is facing 21 class action lawsuits for collecting exhaustive usage data in the App Store app and linking it to the user's identity without providing an option to opt out.
#Apple #iOS #privacy #WWDC23 #infosec #cybersecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/553/489/628/982/336/original/4a24881b34c4e2d6.mp4

2023-06-16 08:58:49

https://files.defcon.social/dcsocial-s3/media_attachments/files/110/553/065/283/022/161/original/197a68fe330d6809.mp4

2023-06-16 07:04:50

- reply

@npub16se…wex2
Cool, thank you! We published this on Twitter too:
https://twitter.com/mysk_co/status/1651021165727477763
The findings were also covered by several security websites, here a good article by Naked Security:
https://nakedsecurity.sophos.com/2023/04/26/google-leaking-2fa-secrets-researchers-advise-against-new-account-sync-feature-for-now/

2023-06-15 13:02:52

- reply

… 2/2🧵
Google Play shows more informative sizes. It shows the sizes of initial downloads as well as updates, and data is specific to the user's device.
Let's take DuckDuckGo as an example:
➡️The initial download size: 30 MB
➡️Update size: 14.42 MB
➡️On disk: 86.96 MB
#Google #GooglePlay #Android
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/548/363/919/270/814/original/40d4929b0590ea73.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/548/364/013/769/955/original/3cd84aa63733ab77.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/548/364/113/821/866/original/68c6aea5ec476b4f.png

2023-06-15 12:56:01

The App Store should be more precise about app sizes.
Let's take Numbers as an example:
➡️On its App Store page, the size is 519.8 MB
➡️When downloaded, the size is 210 MB
➡️When updated, the downloaded size is 23.7 MB
➡️On disk, the size is 476.9 MB
… 1/2🧵
#Apple #AppStore #iOS
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/548/336/464/252/445/original/ec11d39283efe2d3.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/548/336/914/561/455/original/b45ef1e603796282.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/548/336/998/027/329/original/0cc2989d4de24882.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/548/337/123/733/615/original/e501dceb55ed303a.png

2023-06-14 21:55:11

In iPadOS/iOS 17, Apple apps are still granted access to data such as contacts without an explicit permission from the user.
Last year Steve Moser noted that Apple had added permission strings in its apps
https://twitter.com/stevemoser/status/1486448051254435840
All these Apple apps access contacts without asking the user:
#iOS #privacy #Apple #infosec #iOS17 #cybersecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/544/794/764/491/674/original/ba272195a86f035a.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/544/794/903/091/413/original/5ea47f5f3b39c465.jpeg

2023-06-14 10:37:36

iOS 17 beta has no sideloading, but Craig Federighi says Apple might comply with EU
@filipeesposito @9to5mac
https://9to5mac.com/2023/06/13/ios-17-beta-sideloading

2023-06-14 10:36:46

iOS 17 beta has no sideloading, but Craig Federighi says Apple might comply with EU
@npub16uq…ju5p @npub17zw…xynm
https://9to5mac.com/2023/06/13/ios-17-beta-sideloading/

2023-06-13 17:47:18

- reply

For the sake of comparison, the size of Microsoft Excel is 270 MB, PowerPoint is 254.2 MB, and Word is 271.9 MB
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/538/157/186/670/303/original/b62331ca759a22c2.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/538/157/471/891/838/original/ac8a7d683c8eb4d1.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/538/157/892/156/763/original/feb7ad6061c354fc.jpeg

2023-06-13 17:34:37

Apple just updated Keynote, Numbers, and Pages. Roughly 1.5 GB of updates.
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/538/107/822/179/184/original/19881f5ec58ab3cc.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/538/107/908/913/961/original/fd3d6d43063e122f.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/538/108/011/982/547/original/acbd428007c28798.jpeg

2023-06-13 15:20:31

Apple didn't mention app sideloading at #WWDC23, except for when @npub1eee…e209 explicitly asked Craig Federighi about it during The Talk Show.
#iOS17 #iOS
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/537/580/067/379/645/original/b8ac09aef38c49e5.mp4

2023-06-13 15:09:33

https://files.defcon.social/dcsocial-s3/media_attachments/files/110/537/536/815/870/609/original/c6356ddd1218d324.mp4

2023-06-13 12:33:56

Safari in iOS 17 finally prompts for timeframe options when clearing history and website data.
#iOS17 #iPadOS17 #privacy #iOS
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/536/925/698/180/656/original/d9559b9fd8768738.mp4

2023-06-12 12:55:20

You're welcome and looking forward to getting "it's not an issue"
#Apple #privacy #security
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/531/347/481/907/424/original/2d6b99615e8d9333.png

2023-06-12 09:52:32

- reply

@npub1u0n…jkjf And if you use iCloud Private Relay, Safari web apps will also use the Private Relay tunnel and hide your IP

2023-06-11 21:25:42

- reply

@npub1u0n…jkjf Yes, this is correct. Each web app has its own storage and each web app runs in a separate process

2023-06-11 21:22:41

- reply

@npub19jz…dp8p No, not really any better. Safari now supports that too.

2023-06-11 21:21:21

- reply

@npub1rxj…q8q6 Yes, web apps seem to be segregated and have their own storage.

2023-06-11 19:59:49

A few remarks about web apps in #macOS #Sonoma:
- You can install more than one app per website
- Safari prompts to open websites in their installed web app
- Just like native apps, they have settings
- They're installed in: ~/Applications
Demo 👇
#PWA #Web
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/527/351/603/652/081/original/d564d5f82887f361.mp4

2023-06-09 22:47:03

This video demonstrates Sensitive Content Warnings, a new privacy feature in iOS and iPadOS 17 that detects sensitive photos and videos sent in Messages, AirDrop, and FaceTime.
*The photo used in the video is harmless. One can trick #AI 😬
#WWDC23 #iOS17 #privacy
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/516/686/816/554/311/original/1d9086eccf8ae1f0.mp4

2023-06-09 18:44:50

- reply

@npub18yd…h6se First check which app is draining the battery. If HomeKit is the culprit, make sure the iPad is connected to iCloud, open the Home app and remove your home. This will remove all of your HomeKit devices. It's a destructive action. Make sure your smet devices can operate without being added to HomeKit

2023-06-09 18:39:39

- reply

@npub1t5m…mmcy @npub18me…vw7d According to Apple, force-quitting apps have very minimal performance gains. As per data corruption, it's almost impossible to get an iOS app to corrupt its data/state when force-closed. By iOS design, an app is frozen once sent to the background. Unlike Android apps, iOS apps can't run background processes, except for tasks that are delegated to the OS, such as downloading large content. It should be safe to force-quit an iOS app

2023-06-09 11:40:28

iPadOS has evolved a lot. Sadly, it doesn't offer multi-user support yet.
#iPadOS17 #WWDC23

2023-06-09 11:20:21

- reply

@npub18me…vw7d Android already has this feature since ages. I see many iPhone users in public swiping up rapidly on their iPhone to close all apps.
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/513/987/107/521/897/original/26fa17bb1996d2fe.png

2023-06-09 11:15:33

- reply

@npub18me…vw7d It has nothing to do with performance. It's privacy against prying eyes when you want to show something on your iPhone. I show things on my iPhone to people all the time. I also share the screen of my iPhone in virtual meetings to demo things. When you swipe app to switch to another app, the list of your recently used apps will be visible. So, before I show things on my iPhone, I always make sure that I close all apps.

2023-06-09 11:14:00

- reply

@npub1x6t…l7wj Same feeling!

2023-06-09 10:57:04

- reply

No "Close All" button in iOS 17. You still need to swipe up repeatedly to close all apps, at least for another year when iOS 18 is out. It's a good exercise for your thumb. Fitness should add a workout for that 😬

2023-06-08 20:50:45

The previous post about Safari Private Browsing was deleted. The wording wasn't clear and caused some misunderstanding. Thank you 🙏

2023-06-08 20:40:00

- reply

@npub1x7n…wle4 I tested on iPadOS 17 and iOS 17. The behavior seems to differ based on the DNS server used or domain name being requested. I deleted the tweets and will address the issue again when things are clearer. Thanks for testing that ✌️

2023-06-08 19:45:10

- reply

@npub1928…zrrt This only happens in Private Browsing. I think for average users this is a big win. You never know which DNS server the router you're connected to is sending. This method is already in Private Relay. If Apple is interested in this data, they can obtain it using other methods.

2023-06-08 19:40:15

- reply

@npub1wmy…93xs You need to test in Private Browsing.

2023-06-08 19:38:52

- reply

@npub19qh…6w4c A very good question. This method of rerouting is already available in Private Relay. Judging from the network traffic, it is the same infrastructure.This feature seems to be bundled in Advanced Tracking and Fingerprinting Protection. Apple said little about it in the announcement.

2023-06-08 19:33:04

- reply

This behavior can be disabled in the Safari advanced settings under "Advanced Tracking and Fingerprinting Protection" It has three modes:
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/510/262/052/101/532/original/dc379b0098561860.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/510/262/225/390/873/original/58059881e494ec1b.png

2023-06-08 18:51:28

- reply

This feature boosts your private browsing experience by hiding your DNS queries from the DNS server of your internet connection. It's already available in iCloud Private Relay. But in iOS 17, Safari Private Browsing routes DNS requests for all users.

2023-06-08 17:02:01

- reply

@npub1u0n…jkjf The same. This shows the OS that the user explicitly needs to use a particular feature. And iOS respects that.

2023-06-08 16:52:25

- reply

@npub1u0n…jkjf NextDNS works as a VPN. A VPN connection overwrites all settings.

2023-06-08 16:28:21

- reply

@npub1aff…lf04 If you trust Apple, it is good. If you don't, it's not 🙃

2023-06-08 16:24:41

New in Safari 👀 :
When using private browsing on iOS 17, Safari overwrites your DNS settings and routes DNS queries to Apple even if you don't use iCloud Private Relay. DNS queries will be routed to this server 👇
#WWDC23 #iOS17 #privacy #Infosec #cybersecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/509/521/512/564/230/original/1aabfe0535181f57.png

2023-06-08 16:20:33

New in Safari 👀 :
When using private browsing on iOS 17, Safari overwrites your DNS settings and routes DNS queries to Apple even if you don't use iCloud Private Relay. DNS queries will be routes to this server 👇
#WWDC23 #iOS17 #privacy
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/509/505/209/383/919/original/c7377ab9f25c0c88.png

2023-06-08 16:07:35

For some reason iOS and iPadOS 17 add an entry for access to calendars in the settings of each third-party app. Access is set to none though. Our drawing app Canvas neither uses calendars nor requests access to them. 🤔
#WWDC23 #iOS #iPadOS #iOS17
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/509/453/024/115/054/original/99c4fc9eb8bd1c80.mp4

2023-06-07 17:17:20

- reply

@npub1xtg…xfsf This is about tracking users across platforms. So when a user is on your platform, you identify them by (login + fingerprinting). Now if you're part of a huge data lake that harvests (fingerprinting + behavior) of multiple platforms. By matching the fingerprinting that you harvest with the fingerprinting in the data lake, you can figure the behavior of your users on other platforms.

2023-06-07 17:06:34

Apple announced that "apps referencing APIs that could potentially be used for fingerprinting — a practice that is prohibited on the App Store— will now be required to select an allowed reason for usage of the API.."
Cool, will the App Store explain this?
#infosec #privacy #cybersecurity
https://youtu.be/8JxvH80Rrcw

2023-06-07 12:08:51

- reply

@npub1aff…lf04 I can't remember. But betas tend to enable and disable features before the final release.

2023-06-07 10:28:49

- reply

Offering a subscription to remove ads from the App Store isn't a bad idea. Apple could offer the option bundled with the current subscription offerings, such as iCloud+

2023-06-07 10:16:32

It seems that ads aren't connected to the App Store in the first Beta of iOS/iPadOS 17 yet. The experience without ads is great. Search results are accurate and not marred with ads.
Just searched for "2fa" on both 17 and 16. iOS 16 still shows the scam app that steals tokens
#WWDC23 #privacy #infosec #cybersecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/502/411/119/518/823/original/1811d96adabf502b.jpeg
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/502/411/513/102/710/original/2eb7591349ee112e.png

2023-06-07 10:01:55

- reply

@npub15p4…vspj Well, that has nothing to do with studies on colognes. 😂

2023-06-07 09:51:03

For a first Beta, iPadOS 17 is stable and smooth.
#WWDC23
https://files.defcon.social/dcsocial-s3/media_attachments/files/110/502/311/271/014/285/original/890a322f200da318.jpeg

2023-06-06 17:02:41

- reply

@npub1qn3…tagn 😂

2023-06-06 16:04:23

- reply

@npub1xtg…xfsf I have a shortcut for that 👍