9 ms·

Clickbait title: 'If Bluetooth is ON on your Apple device everyone nearby can understand current status of your device, get info about battery, device name, Wi-

by vdnkh 7y ago

Clickbait title: 'If Bluetooth is ON on your Apple device everyone nearby can understand current status of your device, get info about battery, device name, Wi-Fi status, buffer availability, OS version and even get your mobile phone number'

snarf21 7y ago
Agreed. It is weird that they just hash the phone number and don't salt it with something else. Even just appleid+phonenumber would be huge and prevent pre-attacks.
- aidenn0 7y ago
  It's what about an hour to calculate the SHA of all 10 digit numbers in the US?
  - bristleworm 7y ago
    I was curious: my Laptop needed 18 minutes.
    - aidenn0 7y ago
      haha, I checked my source and I had the units wrong so I was off by a factor of 1000. Looks like 8x GTX1080s can do almost 3 billion SHA256 hashes per second, so you could just brute force these with no table with the right hardware.
- Operyl 7y ago
  Then the problem is: “You’re leaking your Apple ID to everyone in your contact list!” or more, depending on how exactly they’d plan to distribute Apple IDs to everybody else. The hash of the phone number thing is to provide the “contacts only” airdrop thing.
  - snarf21 7y ago
    I'm missing what you are saying, sorry. If I know your email already, nothing is getting leaked. If I don't know your apple ID email, I have to brute force all combinations of email concatenated with your phone number to figure it out. If a stranger doesn't know either piece, they'd have to pre-image the entire space which is nigh impossible (all phone #s X all email addresses)
    - wool_gather 7y ago
      You're right, but they probably have/want to cover the case where you've given someone just your phone number (or just your email).
    - Operyl 7y ago
      It’s convenient to just have a phone number be the piece both sides know. It’s not as magical if you need to also give your AppleID to every single contact manually, and if you have some sort of Phone Number to AppleID lookup service it’d be abused just as badly is what I’m saying here.
thedanbob 7y ago
And for the phone number part, “If Bluetooth is ON on your Apple device AND you’re trying to Airdrop something (which you’d expect to send some identifying information) or connect to a new WiFi network (same)...” To be fair I wouldn’t necessarily expect those actions to send out a hash of my phone number, but the threat indicated by the title is definitely overblown.
- eridius 7y ago
  AirDrop has to send out a hash of you so that way the surrounding devices that are set to "contacts only" can use it to determine if you're in their contacts list (and therefore that it should respond). I'm not sure why WiFi has to send a hash of your phone number, I thought it just prompted nearby devices to ask if they wanted to share it. Maybe there is some functionality there relating to determining if the sender is in your address book, I'm not sure.
  - mrunkel 7y ago
    Yes, it will only share the WiFi password with devices in your contacts.
  - lloeki 7y ago
    > I'm not sure why WiFi has to send AirDrop operates on both Bluetooth and WiFi
ilikehurdles 7y ago
A part of the problem is that bluetooth is almost always ON on iPhones. The way one typically toggles it from the control center only disables bluetooth for a short period of time (24 hours), after that, it turns on again. One has to go into settings to actually disable bluetooth.
- deleted 7y ago
  [deleted]
- justwalt 7y ago
  Gotta love the dark pattern. I remember when they made the change, I was pretty frustrated with that.
  - millstone 7y ago
    "Dark pattern" seems too strong. Apple doesn't benefit from your turning Bluetooth on and isn't trying to manipulate you into doing so. It's fixing the annoying issue of today's AirPods failing because of something I did yesterday afternoon which I forgot.
    - m463 7y ago
      Apple does benefit from turning bluetooth on. Your phone will locate and report bluetooth ibeacons, and allow apple to update their crowdsourced location databases. The same thing with wifi (which has the same behavior in control panel) It would have been SO SIMPLE to have a nicer pattern. short press to disconnect, long press to turn off.
      - ilikehurdles 7y ago
        >It would have been SO SIMPLE to have a nicer pattern. short press to disconnect, long press to turn off. Indeed, this is exactly what I expected would happen when I long pressed and I was disappointed when it didn’t. There are definitely times like this when Apple’s UX gets more credit than it deserves.
    - 7y ago

by vdnkh 7y ago

snarf21 7y ago

Agreed. It is weird that they just hash the phone number and don't salt it with something else. Even just appleid+phonenumber would be huge and prevent pre-attacks.

aidenn0 7y ago
It's what about an hour to calculate the SHA of all 10 digit numbers in the US?
- bristleworm 7y ago
  I was curious: my Laptop needed 18 minutes.
  - aidenn0 7y ago
    haha, I checked my source and I had the units wrong so I was off by a factor of 1000. Looks like 8x GTX1080s can do almost 3 billion SHA256 hashes per second, so you could just brute force these with no table with the right hardware.
Operyl 7y ago
Then the problem is: “You’re leaking your Apple ID to everyone in your contact list!” or more, depending on how exactly they’d plan to distribute Apple IDs to everybody else. The hash of the phone number thing is to provide the “contacts only” airdrop thing.
- snarf21 7y ago
  I'm missing what you are saying, sorry. If I know your email already, nothing is getting leaked. If I don't know your apple ID email, I have to brute force all combinations of email concatenated with your phone number to figure it out. If a stranger doesn't know either piece, they'd have to pre-image the entire space which is nigh impossible (all phone #s X all email addresses)
  - wool_gather 7y ago
    You're right, but they probably have/want to cover the case where you've given someone just your phone number (or just your email).
  - Operyl 7y ago
    It’s convenient to just have a phone number be the piece both sides know. It’s not as magical if you need to also give your AppleID to every single contact manually, and if you have some sort of Phone Number to AppleID lookup service it’d be abused just as badly is what I’m saying here.

thedanbob 7y ago

And for the phone number part, “If Bluetooth is ON on your Apple device AND you’re trying to Airdrop something (which you’d expect to send some identifying information) or connect to a new WiFi network (same)...” To be fair I wouldn’t necessarily expect those actions to send out a hash of my phone number, but the threat indicated by the title is definitely overblown.

eridius 7y ago
AirDrop has to send out a hash of you so that way the surrounding devices that are set to "contacts only" can use it to determine if you're in their contacts list (and therefore that it should respond). I'm not sure why WiFi has to send a hash of your phone number, I thought it just prompted nearby devices to ask if they wanted to share it. Maybe there is some functionality there relating to determining if the sender is in your address book, I'm not sure.
- mrunkel 7y ago
  Yes, it will only share the WiFi password with devices in your contacts.
- lloeki 7y ago
  > I'm not sure why WiFi has to send AirDrop operates on both Bluetooth and WiFi

ilikehurdles 7y ago

A part of the problem is that bluetooth is almost always ON on iPhones. The way one typically toggles it from the control center only disables bluetooth for a short period of time (24 hours), after that, it turns on again. One has to go into settings to actually disable bluetooth.

deleted 7y ago
[deleted]
justwalt 7y ago
Gotta love the dark pattern. I remember when they made the change, I was pretty frustrated with that.
- millstone 7y ago
  "Dark pattern" seems too strong. Apple doesn't benefit from your turning Bluetooth on and isn't trying to manipulate you into doing so. It's fixing the annoying issue of today's AirPods failing because of something I did yesterday afternoon which I forgot.
  - m463 7y ago
    Apple does benefit from turning bluetooth on. Your phone will locate and report bluetooth ibeacons, and allow apple to update their crowdsourced location databases. The same thing with wifi (which has the same behavior in control panel) It would have been SO SIMPLE to have a nicer pattern. short press to disconnect, long press to turn off.
    - ilikehurdles 7y ago
      >It would have been SO SIMPLE to have a nicer pattern. short press to disconnect, long press to turn off. Indeed, this is exactly what I expected would happen when I long pressed and I was disappointed when it didn’t. There are definitely times like this when Apple’s UX gets more credit than it deserves.
  - 7y ago