Mysk🇨🇦🇩🇪

We're two #iOS developers and occasional #security researchers on two continents. #CyberSecurity 🇨🇦🇩🇪

Public Key

npub1hl9dtxzw26qmafjsrg0kjnp82d5lq7e70axmea8qw2qxwv9acfqs6cll68

NIP-05 Address

mysk@mastodon-social.mostr.pub

Profile Code

nprofile1qqstljk4np89dqd75egp58mffsn4x60s0vl87ndu7ns89qr8xz7uysgpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxg7j4g7q

Publishing to

relay.nostr.band

Author Public Key

npub1hl9dtxzw26qmafjsrg0kjnp82d5lq7e70axmea8qw2qxwv9acfqs6cll68

Show more details

Last Notes

2025-06-17 17:49:35

- reply

@nprofile…gqp6 @nprofile…zfzh Psylo already has a DNS-level ad-blocking in place. Thanks a lot for using Psylo. We have interesting features in the pipeline ✌️

2025-06-17 16:29:38

🚀🤘Introducing Psylo: A New Kind of Private Browser
After 9 months of development, we're super excited to finally launch Psylo, a new kind of private web browser for iOS and iPadOS.
In Psylo, each tab is its own “silo” with isolated storage, cookies, and even its own IP address. Psylo introduces advanced anti-tracking and anti-fingerprinting features that go beyond what a VPN can offer.
Full announcement: https://mysk.blog/2025/06/17/introducing-psylo/
#infoSec #privacy #iOS
https://files.mastodon.social/media_attachments/files/114/699/628/464/365/176/original/02983d13d917f738.png

2025-06-16 10:21:24

On to Round 3.
This is ridiculous. They rejected the app because the redeem screen that comes from the App Store didn't load. Either the tester had a bad internet connection or the App Store Sandbox environment was down. Psylo has nothing to do with this bug. 🤬🤬🤬
https://files.mastodon.social/media_attachments/files/114/692/534/433/510/729/original/426131391603ebe8.png

2025-04-01 14:53:36

- reply

This option appears to enhance the Assisted GPS (aGPS) network by providing more precise GPS coordinates of nearby Wi-Fi networks and cell towers. Apple and Google devices use rely on the aGPS database in areas where the GPS signal is weak.

2025-03-31 23:54:09

iOS 18.4 introduced a new option in System Location Services called "Improve Location Accuracy" and it is enabled by default. You can find it under:
Settings > Privacy& Security > Location Services > System Services
#Privacy #infoSec
https://files.mastodon.social/media_attachments/files/114/259/729/799/200/309/original/7af73f5ac2419e71.png
https://files.mastodon.social/media_attachments/files/114/259/730/215/787/826/original/8485bdca605d8931.jpeg

2025-03-28 00:16:56

A major privacy issue with Signal is its constant request for access to contacts. It might sound convenient, but this access increases the risk of accidentally choosing the wrong contact (such as The Atlantic journalist) when adding someone to a group or forwarding texts. We have been critical of this "we'll remind you later" pattern that Signal adopts when access to contacts is denied. An app "built for privacy" should respect its user's #privacy choices.
#infoSec #privacyMatters
https://files.mastodon.social/media_attachments/files/114/237/159/498/868/703/original/ed49311c3063cd56.jpeg
https://files.mastodon.social/media_attachments/files/114/237/160/197/987/690/original/665683012a2e7c01.jpeg
https://files.mastodon.social/media_attachments/files/114/237/161/053/710/739/original/850552e2baace73f.jpeg

2025-03-24 16:24:50

We are now compliant with the Digital Services Act (DSA). Our apps are available in the EU.
https://files.mastodon.social/media_attachments/files/114/218/333/175/340/354/original/1e092b970613394c.jpeg

2025-03-20 00:10:09

"Google says changes to the Play Store may expose users to malware and fraud"
Does this mean that Google isn't aware of the massive amount of malware and fraud in the Play Store? Or did Google borrow that line from Apple?
https://techcrunch.com/2025/03/19/google-search-play-store-falling-foul-of-digital-markets-act-rules-says-eu/

2025-03-19 13:05:15

Small correction: iPhone users were vulnerable to phishing attacks for years, not months.
Apple Passwords had been using insecure HTTP by default since the feature to detect compromised passwords was introduced in iOS 14. The dedicated Passwords app in iOS 18 was essentially a repackaging of the old password manager that was in the Settings, and it carried along all of its bugs.
https://www.macrumors.com/2025/03/19/apple-passwords-app-phishing-vulnerability/

2025-02-18 13:50:23

Apple has removed all apps from the App Store in the EU that failed to comply with the Digital Services Act (DSA) by the February 17, 2025, deadline. We haven't complied with the DSA yet. Our apps are no longer available in the EU. We apologize to our customers.
The DSA rules require Apple to verify and display trader contact information for all traders distributing apps on the App Store in the EU. ..(1/2)
#Apple #AppStore #EU #DSA
https://files.mastodon.social/media_attachments/files/114/025/178/510/130/203/original/00238f3cf382e0bc.jpeg
https://files.mastodon.social/media_attachments/files/114/025/179/519/756/858/original/4b74fbd976ae9cf6.png
https://files.mastodon.social/media_attachments/files/114/025/179/548/819/955/original/fd03ea405640d104.png
https://files.mastodon.social/media_attachments/files/114/025/180/536/726/556/original/44af6c4ee45834c9.png

2025-02-12 15:11:39

We will close Wave 2 today. If you want to test our new app, drop a message in the DMs:
https://mastodon.social/@mysk/113984260118125499

2025-02-11 08:16:21

🚀 Exciting news! We're now inviting users to Wave 2 of our closed beta test of our privacy-focused iOS app! Your feedback is highly appreciated, and we can't wait to hear from you. If you missed the first round, now's your chance!
DMs are open 📩
#Privacy #PrivacyMatters #iOS
https://files.mastodon.social/media_attachments/files/113/984/255/855/342/558/original/a5bbe6821ac1a988.jpeg

2025-01-22 21:41:46

- reply

We realized this behavior first on a device running #iOS 18.3. Surprisingly, devices running iOS 18.1.1 and 18.2.1 also showed the new behavior.
iOS still doesn't provide an option to disable downloading the icons, which is the best way to tackle this issue.
#Apple

2025-01-22 21:41:15

The Passwords app now categorizes the network requests to download the icons as "websites visited in app" and this way the number of requests sent isn't included in the main count in the #privacy report.
This new categorization makes the requests less visible to privacy-conscious as the app won't show spikes of 130+ requests as we demonstrated before in iOS 18 and iOS 18.2. However the app is clearly making those requests directly as shown in the network traffic.
#privacy #Apple #iOS
https://files.mastodon.social/media_attachments/files/113/874/153/891/166/372/original/809a0baaa1d9477f.jpeg
https://files.mastodon.social/media_attachments/files/113/874/154/604/058/198/original/b5d4e012390f3049.png
https://files.mastodon.social/media_attachments/files/113/874/155/127/220/107/original/5440e77a0edabd01.jpeg
https://files.mastodon.social/media_attachments/files/113/874/155/863/478/776/original/aa67a21fae2f36b6.jpeg

2024-12-12 23:41:44

The severity level of this bug is critical, 9.8 out of 10. Upgrade your devices.
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2024-54492&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1&source=CISA-ADP
#iOS #iPhone #security #infosec #Apple #cybersecurity
https://mastodon.social/@mysk/113636630798700926

2024-12-11 22:49:39

Since iOS 18 launched, the new Passwords app has been using unencrypted HTTP to download icons for password entries—a serious #security risk. We reported this bug to #Apple in September, and it’s finally fixed in #iOS 18.2 (CVE-2024-54492).
The bug also impacts iPadOS and #macOS
Why does this matter? Watch 🎬 :
#cybersecurity #privacy #infosec
https://youtu.be/1vr2e6YeNuc

2024-11-22 15:12:29

This is an example of what the App Store app shares with #Apple when you search for an app. Everything you type in the search field is recorded as an event and associated with your Apple ID before it is sent to Apple. When I search for "Google Authenticator," events are recorded as I type character by character. The leap between rows 78 and 79 is when I picked a suggestion. The timestamp of every event is recorded, i.e. Apple can calculate my typing speed 🙃.
#Privacy
#infosec #privacymatters
https://files.mastodon.social/media_attachments/files/113/527/248/183/357/706/original/624f74d7194b1596.png
https://files.mastodon.social/media_attachments/files/113/527/248/458/492/357/original/73f232a3431b5ad5.png
https://files.mastodon.social/media_attachments/files/113/527/248/759/793/170/original/966bbde2510881d1.png
https://files.mastodon.social/media_attachments/files/113/527/249/010/910/421/original/d26be0b261460cd1.png

2024-11-22 15:12:29

2024-08-27 11:44:59

🚨 Mainstream media spreads misinformation about Telegram encryption while covering the arrest of Pavel Durov in France.
In this report, CNN puts #Telegram ahead of #WhatsApp in terms of strong encryption 🤯
This will definitely lead many users to pick wrong #privacy options.
#InfoSec #privacymatters
https://files.mastodon.social/media_attachments/files/113/033/811/597/584/633/original/373bdc80357689ee.mp4

2024-07-26 23:10:57

It's final. This bug won't be fixed. #Apple just closed the report because there's no known exploit for it.
As we reported earlier, if a bad actor inserts a SIM card into a locked iPhone, the phone number of the SIM card will be immediately associated with the iPhone's Apple ID and iMessage while the iPhone is locked. The iPhone shouldn't have an active eSIM for this to happen.
#security #cybersecurity #privacy #infosec #Apple
https://youtu.be/ln-8KnwtdSw?feature=shared

2024-07-22 22:44:31

Google's blog about introducing a new experience in Chrome that "lets people make an informed choice" regarding browser cookies has one button on its cookie banner. It's labeled "Hide."
https://privacysandbox.com/intl/en_us/news/privacy-sandbox-update/
#Privacy
#Google
https://files.mastodon.social/media_attachments/files/112/832/562/361/084/074/original/6386018e966d2df0.jpeg

2024-07-11 21:24:33

Signal downplays encryption key flaw, fixes it after X drama
https://www.bleepingcomputer.com/news/security/signal-downplays-encryption-key-flaw-fixes-it-after-x-drama/

2024-07-09 23:32:17

The security bug about storing the encryption key in plain text wasn't considered a bug by Signal in 2018, wasn't considered a bug by Signal's president today, and even demanded responsible disclosure for it. Well, that not bug thing is getting a fix now:
https://github.com/signalapp/Signal-Desktop/pull/6849#issuecomment-2218845070

2024-07-04 18:18:17

So does #WhatsApp and #Apple iMessage, and likely many other apps. Open a terminal on a Mac and check:
strings ~/Library/Group\ Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite
strings ~/Library/Messages/chat.db
https://www.macrumors.com/2024/07/04/chatgpt-mac-app-stored-chats-plain-text/
On macOS, iMessage stores the chat history locally in plain text, but the data is sandboxed and no other process can access it without permission. …🧵
#privacy #infosec #macos

2024-06-20 21:48:59

On #Android, several #Google services bypass an active VPN connection. As a result, a #VPN connection won't hide your IP address from Google. And since YouTube is a first-party app on Android, it will get your real IP address and roughly determine your location despite using a VPN.
https://www.androidauthority.com/youtube-targeting-vpn-subscription-3453186/

2024-06-11 09:03:56

Don't use the new Calculator app in iOS 18 to solve equations with two variables 🙈
It doesn't get it right 😁
#iOS18
https://files.mastodon.social/media_attachments/files/112/597/180/930/795/829/original/76d68df8c54c2e2a.png

2024-04-29 10:18:52

- reply

@npub1dfe…yx8m I openen a Safari private tab and carried out the tests. And that didn't prevent cross-site tracking

2024-04-29 09:32:15

- reply

@npub1dfe…yx8m cross-site tracking gets stricter in private browsing.

2024-04-28 20:23:27

Apple's implementation of installing marketplace apps from #Safari is heavily flawed and can allow a malicious marketplace to track #EU users across websites, even in private browsing mode. This blog details our findings:
https://www.mysk.blog/2024/04/28/safari-tracking/
#privacy #security #iOS #iPhone #Apple #InfoSec

2024-03-26 00:04:01

While @npub1qml…mdus works to hide phone numbers, Telegram adds a new OTP feature that exposes phone numbers to strangers.
#PrivacyMatters #Privacy #infoSec
https://www.theverge.com/2024/3/25/24111818/telegram-peer-to-peer-login-otp-two-factor-volunteer

2024-03-10 14:32:15

Connected devices offer great convenience, but often at the expense of #security and #privacy. Pressured by the competition, teams fail to thoroughly test their systems. The following is a great example of convenience vs. security:
#Tesla #cybersecurity #infoSec #IoT #EV
https://youtu.be/7IBg5uNB7is

2024-03-06 22:01:56

LinkedIn is down. We previously found out that it was possible to run JavaScript code on their servers. Hopefully, no one is using this "feature" to do some crypto mining. Not sure if they have fixed it. They never replied.
https://youtu.be/SLBRwZbpN2c?feature=shared

2024-03-04 10:07:08

Google Authenticator still syncs two-factor authentication secrets without E2EE. If you enable cloud syncing, this means:
1️⃣ Google can read the secrets and generate one-time passwords for your accounts
2️⃣ Google knows the services you use
3️⃣ #Google knows your usernames
4️⃣ Given a court order, Google is obliged to hand over this data to law enforcement
#Privacy #privacymatters #CyberSecurity #infosec
https://defcon.social/@mysk/110262313275622023

2024-03-01 16:25:32

Great news: PWAs are back in the EU, albeit only on WebKit.
Thanks a lot for everyone who echoed the concerns of many developers around the world. Your voice matters, and Apple has listened to it.
#Apple #PWA #WebApps #iOS
https://9to5mac.com/2024/03/01/apple-home-screen-web-apps-ios-17-eu/

2024-02-20 10:24:01

- reply

2/4
They have invested two years in their PWA app. Now the service is telling customers in the FAQ that PWAs won't work in iOS 17.4. The information is short and confusing. It doesn't tell iPhone customers what other alternatives they have, leaving them lost in a cycle of confusion. This is because Magenta Musik themselves don't even know what to do. This confusion is caused by #Apple.
#iOS #Android #PWA

2024-02-20 10:22:13

Example of PWA disruption in the EU:
Magenta Musik is an entertainment service -part of the German telecom company - offering information about concerts and festivals. In 2022, Magenta Musik shut down their native apps on both #iOS and #Android and replaced them with a single Progressive Web App (PWA).
#PWA #Web
🧵
1/4
https://www.magentamusik.de/faq-neue-bei-magentamusik

2024-02-15 18:34:06

It's official. Staring Version 17.4, iOS will not support Progressive Web Apps in the EU.
It would be great if Apple provides the basis of this claim:
"We expect this change to affect a small number of users"
#iOS #PWA #WebApp #Apple #EU #DMA
https://files.mastodon.social/media_attachments/files/111/936/932/607/153/598/original/4065ab6e434c7985.jpeg

2024-02-10 14:39:25

In ads: Our apps mind their business. Not yours.
In court: Given Apple’s extensive privacy disclosures, no reasonable user would expect that their actions in Apple’s apps would be private from Apple.
#Privacy #Security #Cybersecurity #Apple #iPhone #InfoSec #dataprivacy
https://files.mastodon.social/media_attachments/files/111/907/698/235/164/888/original/a47c55aa788ca343.png

2024-02-10 01:21:29

This statement is from a court document submitted by Apple's lawyers regarding the App Store data privacy class action lawsuit:
"Given Apple’s extensive privacy disclosures, no reasonable user would expect that their actions in Apple’s apps would be private from Apple."
#Privacy #Security #Cybersecurity #Apple #iPhone #InfoSec #dataprivacy
https://files.mastodon.social/media_attachments/files/111/904/560/585/252/553/original/e4e71cc8f1f85d2f.png

2024-01-28 12:25:24

Security Tip: If you use a VPN to hide your real IP address from an app, say TikTok, make sure the VPN connection is configured to use the "Always on" option. Because if you receive a push notification from TikTok while the VPN is off, Your IP will leak.
More here: 👇
https://mastodon.social/@mysk/111816751385137545
#Privacy #Security #Cybersecurity #Apple #iPhone #TikTok #InfoSec #iOS

2024-01-25 13:10:23

🚨🎬 Privacy Concerns about Apple Push Notifications
TL;DR: data-hungry apps use push notifications as a trigger to send app analytics and device information to their remote servers, even if the apps aren't running at all on your iPhone. Such apps include TikTok, Facebook, FB Messenger, Instagram, Threads, X, and many more.
Watch this video to see it in action:
https://youtu.be/4ZPTjGG9t7s
🧵 1/9
#Privacy #Security #Cybersecurity #Apple #iPhone #Facebook #TikTok #InfoSec #iOS

2024-01-18 13:37:29

App sideloading can open the door for #privacy invasive apps. But the App Store app itself has become one of these apps.
Every iPhone user is invited to do the following:
- Open https://privacy.apple.com
- Sign in and request a copy of your data
- When you get the data, open the file highlighted in the screenshot.
Skim through the activities that the App Store app has collected about you. Worse, you can't disable this massive data harvesting. Is this ok?
#cybersecurity #iOS #Apple #infosec
https://files.mastodon.social/media_attachments/files/111/777/221/558/459/672/original/786dcc7f5d8e7ce4.png

2024-01-04 14:40:33

🚨🎬 🧵 1/4
Here is what happens when you insert an unlocked SIM card into a locked iPhone:
- The #iPhone accepts the SIM card and connects to the internet 😳
- Apple immediately adds the phone number of the SIM card to the Apple ID of the iPhone owner 😲
- #Apple accepts the new phone number as a username to sign in with the Apple ID of the iPhone owner 😱
- iOS activates the new phone number for iMessage 🤯
The video:
https://youtu.be/ln-8KnwtdSw
#privacy #security #iOS #iPhone #cybersecurity #infosec

2024-01-03 19:14:02

We relocated to this instance. ✌️
Hopefully, all followers and following accounts are restored and no one is left behind.
Also, a new video is going to drop soon. 😎
#Privacy #Security #InfoSec