4 ms·

First we have a security issue in iOS 13.0 — a lock screen bypass vulnerability which isn’t easy to exploit — that should’ve been fixed before mass release. But

First we have a security issue in iOS 13.0 — a lock screen bypass vulnerability which isn’t easy to exploit — that should’ve been fixed before mass release. But Apple wanted iOS 13 to be out for all iOS users for the launch of the new iPhones 11. So we get iOS 13.1 in a week (Sep 24) from iOS 13.0. Now we find that a much more severe issue with unexpectedly granting third party keyboards Full Access is yet to be fixed. Shouldn’t this issue take higher priority (not implying that the same teams work on all security issues)? This seems like a betrayal of trust. Nobody would expect a third party keyboard to get Full Access and transmit all keystrokes over the network unless they granted that permission. Is Apple now planning to release iOS 13.1.1 or iOS 13.2 by September 30 with the fix for this and some more fixes for stability? It seems like the beta testing cycle still going on for iOS 13.0. Apple has focused on better performance over the last two years and shown good results (older devices don’t slow down as much with newer iOS releases as in the distant past), but stability and security both seem to have taken a hit within Apple’s technical abilities and processes, as is evident from the revelations, from Google’s Project Zero and others, in the last few months or so.

olliej 7y ago
This isn’t “keyboard has access to everything” it’s “keyboard can make network requests” - now we can argue over whether that’s good or not (a lot of predictive keyboards use network requests to update for current events etc), but this seems by design whereas the seeing your contacts thing is clearly a bug. I’m still unclear why the contacts DB isn’t class A data (eg wrapped by a key that is only available when the device is actually unlocked), I assume it’s perf related. Anyway, feel free to say “accessing contacts from lock screen is a bug”, but for the keyboard stuff you need to compare to the android equivalents, which IIRC are even worse :-/
- colejohnson66 7y ago
  > I’m still unclear why the contacts DB isn’t class A data (eg wrapped by a key that is only available when the device is actually unlocked), I assume it’s perf related. It probably has to do with the actual phone part of the device. When you receive a call while locked, you can’t show the contact name associated with that number if the contacts are locked behind the lock screen.
  - judge2020 7y ago
    A good case for Face ID - I know an option allows it to hide notifications when it's locked, but I don't believe there's one to hide the contact's name.
- shuckles 7y ago
  You can get a sense of why contacts are not Class A by trying to use Notification Center after restarting your phone. The metadata is crucial for making lots of notifications useful.
bookofjoe 7y ago
13.1 released today

olliej 7y ago

This isn’t “keyboard has access to everything” it’s “keyboard can make network requests” - now we can argue over whether that’s good or not (a lot of predictive keyboards use network requests to update for current events etc), but this seems by design whereas the seeing your contacts thing is clearly a bug. I’m still unclear why the contacts DB isn’t class A data (eg wrapped by a key that is only available when the device is actually unlocked), I assume it’s perf related. Anyway, feel free to say “accessing contacts from lock screen is a bug”, but for the keyboard stuff you need to compare to the android equivalents, which IIRC are even worse :-/

colejohnson66 7y ago
> I’m still unclear why the contacts DB isn’t class A data (eg wrapped by a key that is only available when the device is actually unlocked), I assume it’s perf related. It probably has to do with the actual phone part of the device. When you receive a call while locked, you can’t show the contact name associated with that number if the contacts are locked behind the lock screen.
- judge2020 7y ago
  A good case for Face ID - I know an option allows it to hide notifications when it's locked, but I don't believe there's one to hide the contact's name.
shuckles 7y ago
You can get a sense of why contacts are not Class A by trying to use Notification Center after restarting your phone. The metadata is crucial for making lots of notifications useful.

bookofjoe 7y ago

13.1 released today