7 ms·

This article fails to mention that AirDrop is only enabled for Contacts by default. Furthermore, each AirDrop session is a TLS session, where the users exchang

This article fails to mention that AirDrop is only enabled for Contacts by default. Furthermore, each AirDrop session is a TLS session, where the users exchange iCloud certificates to authenticate each other. See: https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide.... (p. 45) The phone is only as secure as the user makes it.

bri3d 7y ago
I believe that this information leak occurs BECAUSE AirDrop is only enabled for Contacts by default - you disclose your own hashed phone number when you open the Share dialog in order to allow nearby phones to decide whether you're on their Contacts list.
- randyrand 7y ago
  That doesn't make sense. It's whether they are in my contact list. If visibility is set to everyone then your phone will identify itself using its phone number so people know which device is yours and can click to share with it.
  - kube-system 7y ago
    Doesn't the statement go both ways? How do you tell that a remote phone is in your contact list?
- groovybits 7y ago
  The claimed threat vector is loss of anonyminity. There is no anonyminity designed into AirDrop, and nowhere in Apple's documentation do I see the claim for it. You iCloud account is your identity. When you choose to share things directly from your phone, you are choosing to share that identity. How else can another iPhone verify you? There is no information leak. This is a clickbait title combined with a 'Well, duh' moment.
  - bri3d 7y ago
    There’s a difference between disclosing “I am phone XYZ and I want to AirDrop” and “here is my phone number.” I would call that an information disclosure. With that said I agree with you that it’s an intuitive and non-serious disclosure, but it appears some disagree.
    - eridius 7y ago
      Except it's not "here is my phone number", it's "if you know my phone number you can tell it's me".
      - Thorrez 7y ago
        It's functionally the same, because attackers can brute force all phone numbers to reverse the hash.
        heroic 7y ago
        So basically someone trying to call all phone numbers and identify your number, when it rings falls in the same category?
        Thorrez 7y ago
        No, calling a number is expensive. It takes time, processing power, a phone plan, etc. It also alerts the victim, as well as your phone provider who will likely shut you down. Calculating a hash is cheap, a single GPU can calculate 5 billion sha256 hashes/second.
        eridius 7y ago
        I just looked up Apple's Security White Paper and it explains that the Bluetooth LE signal only includes a "short identity hash", and then the receiving device responds with its own identity info, and then the sending device establishes a peer-to-peer WiFi connection and sends its "long identity hash", which the receiver then uses to confirm that it knows the recipient before responding with its own "long identity hash". Which it to say, it sounds like you only get partial information about the sender prior to identifying yourself and establishing a direct connection. So you cannot passively identify the exact phone number of an unknown sender. The "short identity hash" itself it says is "created based on the email addresses and phone numbers associated with the user’s Apple ID", though I have to assume that it's independently hashing each piece of info because if you hash the whole set, then the receiver would have to know the whole set, which would be a problem (my device knows more email addresses for me than any of my friends do).
rolltiide 7y ago
But Airdrop for contacts only is basically broken-especially for sharing between your own devices that are supposed to be on the same apple id-so you need to set it to ‘everyone’ for it to work all the time
- newscracker 7y ago
  I use AirDrop mostly to share with my own devices quickly, and I've been baffled that I have to set sharing to everyone to see my own devices. Setting it to contacts hasn't worked, and that's a big oversight by Apple.
  - vegardx 7y ago
    I don't think that's true. I just tested it, and with Contacts Only on both phone and laptop I'm still able to share things with myself.

bri3d 7y ago

I believe that this information leak occurs BECAUSE AirDrop is only enabled for Contacts by default - you disclose your own hashed phone number when you open the Share dialog in order to allow nearby phones to decide whether you're on their Contacts list.

randyrand 7y ago
That doesn't make sense. It's whether they are in my contact list. If visibility is set to everyone then your phone will identify itself using its phone number so people know which device is yours and can click to share with it.
- kube-system 7y ago
  Doesn't the statement go both ways? How do you tell that a remote phone is in your contact list?
groovybits 7y ago
The claimed threat vector is loss of anonyminity. There is no anonyminity designed into AirDrop, and nowhere in Apple's documentation do I see the claim for it. You iCloud account is your identity. When you choose to share things directly from your phone, you are choosing to share that identity. How else can another iPhone verify you? There is no information leak. This is a clickbait title combined with a 'Well, duh' moment.
- bri3d 7y ago
  There’s a difference between disclosing “I am phone XYZ and I want to AirDrop” and “here is my phone number.” I would call that an information disclosure. With that said I agree with you that it’s an intuitive and non-serious disclosure, but it appears some disagree.
  - eridius 7y ago
    Except it's not "here is my phone number", it's "if you know my phone number you can tell it's me".
    - Thorrez 7y ago
      It's functionally the same, because attackers can brute force all phone numbers to reverse the hash.
      - heroic 7y ago
        So basically someone trying to call all phone numbers and identify your number, when it rings falls in the same category?
        Thorrez 7y ago
        No, calling a number is expensive. It takes time, processing power, a phone plan, etc. It also alerts the victim, as well as your phone provider who will likely shut you down. Calculating a hash is cheap, a single GPU can calculate 5 billion sha256 hashes/second.
      - eridius 7y ago
        I just looked up Apple's Security White Paper and it explains that the Bluetooth LE signal only includes a "short identity hash", and then the receiving device responds with its own identity info, and then the sending device establishes a peer-to-peer WiFi connection and sends its "long identity hash", which the receiver then uses to confirm that it knows the recipient before responding with its own "long identity hash". Which it to say, it sounds like you only get partial information about the sender prior to identifying yourself and establishing a direct connection. So you cannot passively identify the exact phone number of an unknown sender. The "short identity hash" itself it says is "created based on the email addresses and phone numbers associated with the user’s Apple ID", though I have to assume that it's independently hashing each piece of info because if you hash the whole set, then the receiver would have to know the whole set, which would be a problem (my device knows more email addresses for me than any of my friends do).

rolltiide 7y ago

But Airdrop for contacts only is basically broken-especially for sharing between your own devices that are supposed to be on the same apple id-so you need to set it to ‘everyone’ for it to work all the time

newscracker 7y ago
I use AirDrop mostly to share with my own devices quickly, and I've been baffled that I have to set sharing to everyone to see my own devices. Setting it to contacts hasn't worked, and that's a big oversight by Apple.
- vegardx 7y ago
  I don't think that's true. I just tested it, and with Contacts Only on both phone and laptop I'm still able to share things with myself.