5 ms·

What about things like spotlight? If I work in healthcare and I search for "Jane Doe medical records.txt" does part or all of that search end up hitting a webse

What about things like spotlight? If I work in healthcare and I search for "Jane Doe medical records.txt" does part or all of that search end up hitting a webservice somewhere?

palijer 6y ago
You can use an SSL proxy/snooper to find out. I use Charles to see what is actually happening at that level, you would be surprised (or not) at how much stuff is sent to third parties. https://www.charlesproxy.com/ https://www.charlesproxy.com/
- scalableUnicon 6y ago
  That used to be straight forward, but now most of the apps come with certificate pinning and for seeing through network request, toying with tools Frida are now needed.
  - matheusmoreira 6y ago
    Can certificate pinning be defeated?
    - tedivm 6y ago
      It's not something I'd expect your average user to be able to do, but it is possible and is regularly done for various reverse engineering purposes. The approach I've seen involve changing what certificate is pinned to one that is locally controlled. That being said I don't think it's nearly as common for certificate pinning to be present as people think- in fact it was deprecated in 2017 because it caused so many problems. Instead things like HSTS and transparency logs are used to prevent damage from malicious issuance of certificates, and organizations can typically override things with their own CA. If your software is pinned to a specific certificate (even if that certificate is a root CA) your software won't work in many corporate environments. One of the exact reasons mentioned- medical data- is a big driver in this. My company has APIs used by medical companies, and they have to whitelist our service in their firewalls because many of them MITM all traffic to ensure that PHI isn't sent out over an unapproved service by mistake.
      - jrochkind1 6y ago
        It is kind of "hilarious" that enterprises are defeating the ability of a client to prevent a MiTM eavesdropper on the net, for the sake of ensuring privacy of transmitted data.
      - jtl999 6y ago
        > in fact it was deprecated in 2017 because it caused so many problems. Instead things like HSTS and transparency logs are used to prevent damage from malicious issuance of certificates, and organizations can typically override things with their own CA. Still kinda salty that pinning was deprecated from HTTPS. It wasn't perfect (accidental/malicious pinning was far too easy seeing how it was merely controlled by an HTTP header), but the current alternatives (Certificate Transparency, CAA DNS records) aren't an adequate replacement. Sure Certificate Transparency helps to detect a misused certificate, but it doesn't actively prevent it from being used, and CAA requires that the CA isn't "lying" about the header through a "bug" or otherwise.
  - gregsadetsky 6y ago
    Is there anything that can be done with a non jailbroken iPhone to circumvent certificate pinning? I'm reading[0] that Frida can work "if you can include Frida’s libraries in the app - either via debugging an app you own, or repackaging someone else’s app and injecting the dylib." Is repackaging/injecting hard to do? Thanks! [0] https://andydavies.me/blog/2019/12/12/capturing-and-decrypting-https-traffic-from-ios-apps/ https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...
- arthurcolle 6y ago
  Interesting. I wonder if Little Snitch can do this (I bought it a while back)
sneak 6y ago
By default on iOS every single search in the app search pane hits the web, character by character. That and iCloud Backup are the first two things I disable on a vanilla iOS.
- HenryBemis 6y ago
  Fun fact. iCloud backup "conveniently" records all phone history (calls, text messages). And maybe the authorities cannot get into your phone (debatable) but Apple always gives them your backups (warrant+gag order). And that includes ALL call logs and ALL your SMS and iMessages.
  - snazz 6y ago
    I'm not condoning Apple's decision to not perform end-to-end encryption on iCloud backups, but they would be pretty useless if they didn't include call logs and text messages. If I lose my phone and restore from a backup on a new one, I want my old text messages as much as any other piece of data.
    - grawprog 6y ago
      Google, not that I typically support things they do, found a way to do both: https://support.google.com/googleone/answer/9149304?co=GENIE.Platform%3DAndroid&hl=en https://support.google.com/googleone/answer/9149304?co=GENIE... As far as I know, appleid's have some kind of password/authentication system that could be used to encrypt backups.
      - dubcanada 6y ago
        It doesn't say it stores text messages? It says it stores text messages on Android which means they are not backed up. It also says you use Android messenger which hooks up to Google's services. The text messages have to be stored somewhere.
        yencabulator 6y ago
rovr138 6y ago
By default, yes.

What about things like spotlight? If I work in healthcare and I search for "Jane Doe medical records.txt" does part or all of that search end up hitting a webservice somewhere?

palijer 6y ago

You can use an SSL proxy/snooper to find out. I use Charles to see what is actually happening at that level, you would be surprised (or not) at how much stuff is sent to third parties. https://www.charlesproxy.com/ https://www.charlesproxy.com/

scalableUnicon 6y ago
That used to be straight forward, but now most of the apps come with certificate pinning and for seeing through network request, toying with tools Frida are now needed.
- matheusmoreira 6y ago
  Can certificate pinning be defeated?
  - tedivm 6y ago
    It's not something I'd expect your average user to be able to do, but it is possible and is regularly done for various reverse engineering purposes. The approach I've seen involve changing what certificate is pinned to one that is locally controlled. That being said I don't think it's nearly as common for certificate pinning to be present as people think- in fact it was deprecated in 2017 because it caused so many problems. Instead things like HSTS and transparency logs are used to prevent damage from malicious issuance of certificates, and organizations can typically override things with their own CA. If your software is pinned to a specific certificate (even if that certificate is a root CA) your software won't work in many corporate environments. One of the exact reasons mentioned- medical data- is a big driver in this. My company has APIs used by medical companies, and they have to whitelist our service in their firewalls because many of them MITM all traffic to ensure that PHI isn't sent out over an unapproved service by mistake.
    - jrochkind1 6y ago
      It is kind of "hilarious" that enterprises are defeating the ability of a client to prevent a MiTM eavesdropper on the net, for the sake of ensuring privacy of transmitted data.
    - jtl999 6y ago
      > in fact it was deprecated in 2017 because it caused so many problems. Instead things like HSTS and transparency logs are used to prevent damage from malicious issuance of certificates, and organizations can typically override things with their own CA. Still kinda salty that pinning was deprecated from HTTPS. It wasn't perfect (accidental/malicious pinning was far too easy seeing how it was merely controlled by an HTTP header), but the current alternatives (Certificate Transparency, CAA DNS records) aren't an adequate replacement. Sure Certificate Transparency helps to detect a misused certificate, but it doesn't actively prevent it from being used, and CAA requires that the CA isn't "lying" about the header through a "bug" or otherwise.
- gregsadetsky 6y ago
  Is there anything that can be done with a non jailbroken iPhone to circumvent certificate pinning? I'm reading[0] that Frida can work "if you can include Frida’s libraries in the app - either via debugging an app you own, or repackaging someone else’s app and injecting the dylib." Is repackaging/injecting hard to do? Thanks! [0] https://andydavies.me/blog/2019/12/12/capturing-and-decrypting-https-traffic-from-ios-apps/ https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...
arthurcolle 6y ago
Interesting. I wonder if Little Snitch can do this (I bought it a while back)

sneak 6y ago

By default on iOS every single search in the app search pane hits the web, character by character. That and iCloud Backup are the first two things I disable on a vanilla iOS.

HenryBemis 6y ago
Fun fact. iCloud backup "conveniently" records all phone history (calls, text messages). And maybe the authorities cannot get into your phone (debatable) but Apple always gives them your backups (warrant+gag order). And that includes ALL call logs and ALL your SMS and iMessages.
- snazz 6y ago
  I'm not condoning Apple's decision to not perform end-to-end encryption on iCloud backups, but they would be pretty useless if they didn't include call logs and text messages. If I lose my phone and restore from a backup on a new one, I want my old text messages as much as any other piece of data.
  - grawprog 6y ago
    Google, not that I typically support things they do, found a way to do both: https://support.google.com/googleone/answer/9149304?co=GENIE.Platform%3DAndroid&hl=en https://support.google.com/googleone/answer/9149304?co=GENIE... As far as I know, appleid's have some kind of password/authentication system that could be used to encrypt backups.
    - dubcanada 6y ago
      It doesn't say it stores text messages? It says it stores text messages on Android which means they are not backed up. It also says you use Android messenger which hooks up to Google's services. The text messages have to be stored somewhere.
      - yencabulator 6y ago

rovr138 6y ago

By default, yes.