16 ms·

Apple Addresses Privacy Concerns Surrounding App Authentication in macOS

209 points by robin_reala 6y ago

skekaeeeww 6y ago
It’s a good security feature, but the current design was leaking a too much info. I’m glad they are adressing this.
- tsimionescu 6y ago
  It's really not. Antiviruses had a much better solution to this ~20 years ago: download malware signatures, store them locally, and check every program run against the signature DB. Works while offline and completely respects user privacy. Also, doesn't really work that great for security, as there are always relatively easy ways to fool the signature detection. That's why AVs usually moved to include much more complex behavioral checking. Note: not claiming that AVs usually respected user privacy - a lot of them could be conisdered malware in and of themselves. But the malware protection scheme was simple and it did guarantee privacy - it's other parts of the AV that then went behind your back and sold your data more directly.
bredren 6y ago
This seems like a pretty good outcome.
- tsimionescu 6y ago
  It's not, it's whitewashing of a solution that doesn't respect privacy in any way. There are already solutions where this data is not (1) sent in plain text over the internet, where your ISP and anyone else along the way can see it, and (2) don't give even the endpoint information about the specific certificate you are checking.
  - notamy 6y ago
    ...Did you perhaps forget to add your (1) link?
    - xvector 6y ago
      Just look up CRLite.
- elitan 6y ago
  Agreed.
doomrobo 6y ago
Instead of just giving their word that they won’t log IPs, I t’d be nicer if they used a privacy preserving revocation lookup scheme like CRLite https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...
- isomorphic 6y ago
  Ironically, CRLite seems similar to the approach Apple was (is?) forcing for "content blocker" extensions to Safari--pre-supplying a canned declarative blacklist to Safari, instead of Safari allowing extensions algorithmic access to the current URL.* Their motivation was supposedly to increase user privacy. Funny how they didn't think of that in the CRL and app-blacklist cases. Perhaps they were worried the locally-cached lists themselves would be subject to attack? *In my opinion, in the content-blocker instance the result is a much poorer user experience (ad-blocking effectiveness, flexibility) when compared with e.g. uBlock Origin, and one of the reasons I continue to use Firefox instead.
1vuio0pswjnm7 6y ago
They will not stop logging or delete the logs that they have collected. This suggests they want the data that is collected in the logs, and, in fact, they were collecting IP addresses previously, despite their statements about respecting user privacy. Will they tell the public exactly how they are using the data that they will continue to collect in the logs? Is it commercial use that benefits the company? Does that data belong to the user? Do users grant Apple a license to use such data for such purposes? Who pays for the battery and bandwidth to keep transmitting the data to Apple? Does Apple pay? If Apple makes promises to do something in the future, e.g., in a press release, are those promises enforceable? If so, how? https://web.archive.org/web/20201114024313if_/https://regmedia.co.uk/2020/11/13/taylor-v-google.pdf https://web.archive.org/web/20201114024313if_/https://regmed...
- sschueller 6y ago
  In that case someone in the EU with a static IP should file a data request. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/how-can-i-access-my-personal-data-held-company-organisation_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
nubela 6y ago
Why should I trust Apple, or Facebook, or Google, or any company but myself with my privacy? Why do I care about what they say? Its marketing speak. Why not just not do it at all? Let me decide how I want my data to be sent. Which ideally, is zero.
- elitan 6y ago
  You don't need to trust Apple on this. That's why they'll add this feature: - a new preference for users to opt out of these security protections
  - fsflover 6y ago
    How can you check that this option is respected? Where is the source code?
    - dewey 6y ago
      There won't be 100% security or certainty, at some point you'll have to trust someone. Do you have the schematics or your network controller, your CPU? What about your ISP's router?
      - fsflover 6y ago
        1. Your goal should be to have maximal verifiability. See Precursor: https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor. 2. https://en.wikipedia.org/wiki/Defense_in_depth https://en.wikipedia.org/wiki/Defense_in_depth
- grishka 6y ago
  Apple has some double standards, too. When it's third-party iOS apps, it now requires user consent for tracking, which is a good thing. When it's its own operating systems, it sends too many questionable requests to various Apple servers with you having very little recourse — you basically have to reverse engineer the thing to some degree to prevent it from phoning home.
supernova87a 6y ago
I was asking in previous threads if we could look at some info directly from Apple before declaring the end of the world, and I was downvoted to hell for seeking more clarification amidst the outrage. Sometimes, waiting to hear a response isn't unreasonable, don't you think? Maybe rethink the plan to abandon Mac for the rest of your life based on the story of the minute?
- tsimionescu 6y ago
  Why would you not only believe, but actively look for the PR spin on an obvious violation of trust? The technical facts are not interpretable: Apple chose to build the new MacOS in such a way that they leaked information about every app you chose to run on your system, in plaintext, over the internet, sending it to a third party. Whether they did this out of malice or bungling, the only conclusion is that you should not trust the new MacOS with caring about your privacy. Whatever PR spin Apple would choose to put on this is mostly irrelevant. That they chose to simply pinky swear that they wouldn't log IPs as the main defense is even worse.
- totalZero 6y ago
  The reason for outrage is that this problem is so glaringly obvious that we can't dismiss it as an oversight, especially with a company as advanced as Apple claims to be. They boast about the T2 chip and all of their security measures. So for them to leave the gate unlocked on something like this is problematic. It means they made the choice to expose and log users' activity, to some degree or another, on purpose. To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs. Why would they ever have logged IP addresses, if the goal is simply to verify the user-side authenticity of an app?
  - evercast 6y ago
    It may be worth noting that we do not really know what do they mean by "logs". These can be either database records or simply text logs generated by a web server sitting in front of the OCSP backend and logging the requests, regardless of what those requests are referring to. In other words, it does not have to be a conscious decision to "harvest IP addresses" but could easily be a side-effect of what the infrastructure does. Still, it is no excuse for them as one would expect clear and thorough security/privacy audits before rolling out such features. Especially from companies like Apple.
yyyk 6y ago
One of the hallmarks of Apple news and commentary is how whenever Apple merely announces it will do something, Apple is treated like it already did it, while exactly matching its own promises. The current headline* hints Apple has already made changes, while the article only says Apple 'plans' on making changes over the next year. Any other company would have been torn to shreds on HN if it kept sending cleartext logs and merely 'planned' to sometime patch this out. The plan is odd too - why does Apple need 'a new encrypted protocol for Developer ID certificate revocation checks' when existing encryption protocols can do this? * "Apple Addresses Privacy Concerns Surrounding App Authentication in macOS"
- mosselman 6y ago
  I am not saying it isn’t true what you are saying, but do you have links to the companies that were collectively ‘torn to shreds’ over similar issues? I have seen this argument a few times now without any references. Were, for instance, Microsoft or Amazon torn to shreds over similar claims?
  - yyyk 6y ago
    Think MS telemetry which AFAIK is encrypted and less invasive than the current Apple solution.
- Veen 6y ago
  According to my dictionary, "addresses" means: > think about and begin to deal with (an issue or problem) It doesn't imply that the solution has been fully implemented.
  - yyyk 6y ago
    It implies Apple has 'begun to deal' with the issue when the only thing we may have is a plan to do this sometimes in the near future. [EDIT: every definition of 'address' I've found suggests it's a synonym for 'deal with' not 'begin to deal with']
    - 6y ago
oriesdan 6y ago
They're basically just promising they won't be bad guys, which solves nothing. The proper way to implement their feature without causing privacy issues would be to periodically update a list of authorized certificates and check against that list locally when launching apps. That would probably also increase performances.
- elitan 6y ago
  How big would such a list be and how quick would a local lookup be?
  - oriesdan 6y ago
    Not any bigger than package repositories on linux distributions, which include the list of all known software and sometimes even rules how to build them. It's just plain text. If I can have a local dump of wikipedia, I'm pretty sure I can store a list of developer IDs. Especially when I'm a company controlling the hardware and knowing what is the minimum amount of space the hard drives have in my computers.
  - dimator 6y ago
    This is what Bloom filters would solve. I believe another poster said that Firefox uses them to quickly check valid certs.
  - actuator 6y ago
    Implementation wise, there are probablilistic DSs like bloom filters which solve this very easily with further checks necesssary for false positives.
  - tsimionescu 6y ago
    Extremely small - probably in the megabytes range I would guess. Think about antivirus definitions - those are many, many times larger, and still they have been kept up to date over the internet for decades.
    - tgv 6y ago
cblconfederate 6y ago
"Trust us, We are the good guys" - Apple Inc. 2020
- qz2 6y ago
  https://www.youtube.com/watch?v=9Z31ExCe0I4 https://www.youtube.com/watch?v=9Z31ExCe0I4
DiabloD3 6y ago
I don't see how Apple can address this: they already collected the data as an unavoidable function of having performed the intended action. Any attempt to claim that they do nothing with this data, and choose not to store it for future use, are red herrings: they will do whatever what their shareholders, the government, et al. tell them to do with it, and will do so without notifying users, and do so retroactively if possible. There is also no way to audit their backend to prove that they are, indeed, doing exactly what they claim to be doing, ergo, the only safe OSX system is one that has Gatekeeper entirely disabled in leu of a local-only switch. Due to enterprise security concerns with leaking attack targets via signed binaries cert chain/OCSP checking, Windows since Vista already allowed disabling of this obvious hole. I know a lot of Cult of Apple are going to climb up my ass for saying this, but this continues to highlight that OSX is not, and probably never will be, enterprise ready. Apple needs their own Nadella-type of CEO before I'll change my opinion on this.
- goatinaboat 6y ago
  this, but this continues to highlight that OSX is not, and probably never will be, enterprise ready Apple clearly signalled its lack of interest in enterprise offerings when it canned Xserve back in 2010, so don’t hold your breath waiting for these features.
devwastaken 6y ago
The problem should have never existed. Phoning home in this manner should never have existed. This problem is not a bug, it's a fundamental problem with the culture of software development apple curates. They don't believe you should own your computer, that apple always knows better, and if you don't use it the way they force you to, it's unsupported behavior. To them this is natural, they get away doing anything with the Iphone. Doing it to macos is the natural result of that precedent. There's a downvote brigade in this thread. The downvote button is not a "I disagree" button.
- deepstack 6y ago
  I would like to see mac that does not phone home at all out of box! And if you chose to use internet then it phone home for authentication like icloud.
  - grishka 6y ago
    I think you can still complete the initial setup on a mac without ever connecting it to the internet?
    - totalZero 6y ago
      Ok, but what do you do after that? I don't think most people can realistically use a Mac (or PC) without ever connecting to the internet.
      - dvfjsdhgfv 6y ago
        The Windows community reacted to similar behavior by Microsoft by creating several scripts and lists of servers being used to phone home. I guess something similar will be created for macOS although the actual packet filtering will have to be implemented on the router rather than the host.
      - deepstack 6y ago
        I want a computer that I can use for music without internet. Only connect for software upgrade. Very simple. And I don't want to use linux or freebsd. Mac used to be for pros, not it is just for hispsters.
varispeed 6y ago
Is this even legal? Should any personal information be opt in by default? Should Apple present you with the details of what they send and why and an option to opt in to each separately if you want to? Does Apple inform the user where they can download their data that has been collected and who had access to it? Does Apple use a loophole in GDPR that it only applies to websites?
vertis 6y ago
The problem with this kind of "we don't do it" disclaimer, is that they send the information in a way that can be intercepted (OCSP is over HTTP). Even if the information from those requests is only a partial picture, you can be certain that entities like the US intelligence services can slurp it and combine it with other data. If Snowden taught us anything it's that seemingly innocent metadata can be used at scale for a variety of unexpected things. This combined with Apple system services avoiding Little Snitch / Lulu and VPN software in Big Sur is a very dangerous step. How long is it going to be a until a journalist/activist is arrested or killed in an Authoritarian state because the VPN was sending most of the information except the Apple information?
- totalZero 6y ago
  I'm not even worried about US intelligence. They're deep in all of our butts anyway. What concerns me is that I can't travel with confidence that my non-web activity is obscured from host governments and ISPs.
  - vertis 6y ago
    Ah, but I'm not from the US. The US intelligence is just an example anyway. You could insert any relatively competent and well resourced nation state.
- mlindner 6y ago
  It's more than a "we don't do it" disclaimer. They said they're changing the revocation detection to an encrypted protocol later this year and also giving users an option to opt out entirely. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 (See section "Privacy protections")
  - vertis 6y ago
    It's good that they are making these changes, but they're only making them to save face, rather than proactively. Also (nitpick) it's 'over the next year' not 'later this year' given how late we are in the year those are two very different things. It could be 12 months of being vulnerable. This also does nothing for privilege they are affording their own apps to avoid VPNs and Firewalls, which has already been shown to be a security flaw (malicious software will then masquerade as the privileged software).
Lammy 6y ago
> To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs. Serious question as somebody who is not an Apple developer and has zero clue: does the wording "Developer ID certificate checks" here mean locally-built binaries only? Would a 'Release' binary still be logged? Not trying to spread FUD, but I haven't touched Xcode since it was called Project Builder and legitimately don't quite understand. I guess to phrase as a question: Does this stop the hypothetical logging of anyone who has downloaded and ran Tor Browser without compiling it themselves?
newbie578 6y ago
Replace Apple with any other company in the title and all hell would break loose, but since it is about HN's personal toy, you are not allowed to criticize them.. Just look at the heavy brigading happening here or any other Apple related thread. As soon as there is one negative article two positive must pop out to calm the Apple fanboys. And no, saying "if you don't like the platform then don't use it" is not a valid argument. Thank God that it is not up to us on HN to decide what Apple can do, but to the court of law, at least I am putting my trust in the EU..
cute_boi 6y ago
"Apple clarifies that user-specific data is not harvested during the security check and that they plan in removing all IP information from the logs" So they were harvesting IP information in their logs. Just wow this is what i expect from company that advocates privacy. Privacy is just marketing game for them. Bypassing vpn etc has made all your privacy claims invalid apple? We want less trust more truth. If you cannot do that you are not privacy friendly you are hypocrite.
- cdubzzz 6y ago
  > So they were harvesting IP information in their logs. I don’t get to that conclusion from the text you cited. Sure, it’s possible. But I give Apple the benefit of the doubt here that what they are doing is logging IP addresses of HTTP requests like pretty much any other HTTP server does and now they are going to stop doing even that in response to privacy concerns. Seems reasonable.
  - Silhouette 6y ago
    That is my expectation as well. The other, arguably bigger, problem here is that the data is apparently being sent unencrypted, so regardless of whether Apple discards some of the data after receiving it, others might not.
    - cdubzzz 6y ago
      Absolutely agreed. I am by no means defending Apple’s entire position here — just the pretty mundane operation of logging IP addresses associated with HTTP requests.
- mlindner 6y ago
  Web servers log requests with IP addresses kind of by default. Unless they went out of their way to make sure ip addresses were purged (which they are now) they're probably going to be there.
  - ric2b 6y ago
diebeforei485 6y ago
It's crazy that there was no official opt-out for this. It does create this risk of people opting out and spreading malware to others, but after last week's debacle Apple probably thought they should come clean here.
tannhaeuser 6y ago
How can "notarization" be advertised as anything else than locking down the platform towards absolute uselessness in the name of security? Not going to use Mac OS, period. Mac users also can say goodbye to F/OSS on their platform, unless Apple themselves release signed versions of apps for the command line and web servers, DNS servers, file servers and the like. Which they're not going to do as can be seen in the outdated (as in 10-20 years old) versions on Darwin ports.
- fierarul 6y ago
  I literally paid Apple $99 so I can give its users for free an Open Source app. The free developer account does not allow you to notarize apps. And Apple gives no free passes to open-source apps. Everybody must pay. I'm still debating if I'll renew the certificate.
  - m_st 6y ago
    Windows dev here. Not to disagree with you, but I also have to buy an Authenticode certificate just to sign my assemblies so that Windows doesn't show a scary popup when the user starts my application. Ah, and I also have to buy another certificate for HTTPS so that the browsers don't show a scary popup when the user opens my website.
    - fierarul 6y ago
      Yes, my app is Java so I would also have to pay for a Windows cert. I have none right now and would love to not feel so attached to the $300 a fancy cert would be. For HTTPS I manage with LetsEncrypt. Wouldn't that work for you?
  - tannhaeuser 6y ago
    I guess EFF should check if any GPL-licensed software is shipped with Mac OS (such as Apple's antique bash version). Because AFAICT, a requirement for notarization, or any other condition on top of GPL for that matter, is incompatible with GPL.
nly 6y ago
Android is getting just as bad lately. My primary banking app (Barclays) just stopped working on my phone because they've started to use Android hardware attested SafetyNet[0][1] to check to see if the phone is rooted. This can't be easily bypassed. Magisk Hide is useless. For now I've had to disable auto-updates in the Play Store and manually install an older app APK, but it's only a matter of time before they deprecate that version. I do essentially all of my banking via my phone, so when this happens I intend to close all my accounts and move banks. The sooner someone leaks a hardware key (preferably one that Google can't revoke without cripplingly bad PR for breaking millions of products) the better. I honestly think 'appification', app stores, and locked down hardware via key chains will be the end of an era in hacker-friendly consumer electronics. Perhaps the end of personal computing entirely. [0] https://developer.android.com/training/safetynet/attestation.html https://developer.android.com/training/safetynet/attestation... [1] https://groups.google.com/g/safetynet-api-clients/c/lpDXBNeV7Fg https://groups.google.com/g/safetynet-api-clients/c/lpDXBNeV...
- aequitas 6y ago
  > hacker-friendly consumer electronics Both white and black hat hackers friendly? The vast majority of consumers don't want to 'hack' their device. They just want to watch Youtube and do bank payments without getting hacked and robbed of their savings. Recently there was another case in the news where someone was phished via an insecure platform (PC). I get that a lot of rights are taken away from us, but we should fight this with proper consumer protection laws. As it is demonstrated times again most consumers are to naive to take responsability of their security and criminals get away with it to easily.
  - nly 6y ago
    Several other apps I use simply display a warning when used on a rooted device. Ultimately, the problem here is one of recommendation vs enforcement. Would you tolerate a bank that insisted on coming in to your house and forcing you to install Norton Antivirus on your computer before they allowed you to log on to your online banking via their website? Banking security should be implemented on the server side. I shouldn't have to choose between running my own code as root on my device and being able to bank.
deleted 6y ago
[deleted]
swiley 6y ago
"Apple promises to fuck over it's users slightly less in the future." How do people tolerate this stuff?
- xvector 6y ago
  Because their ecosystem is just that smooth. Nothing comes close in terms of polish.
xvector 6y ago
Does not address Big Sur bypassing VPNs.
musicale 6y ago
Like any corporation, we'll be the first to admit that this mistake should never have happened, we should have communicated it differently, and we're very sorry that we got caught. Going forward, we can promise a quick return to business as usual as we work to regain your confidence, starting today with the announcement of several meaningless token gestures alongside a new and more effective PR and marketing campaign.

209 points by robin_reala 6y ago

skekaeeeww 6y ago

It’s a good security feature, but the current design was leaking a too much info. I’m glad they are adressing this.

tsimionescu 6y ago
It's really not. Antiviruses had a much better solution to this ~20 years ago: download malware signatures, store them locally, and check every program run against the signature DB. Works while offline and completely respects user privacy. Also, doesn't really work that great for security, as there are always relatively easy ways to fool the signature detection. That's why AVs usually moved to include much more complex behavioral checking. Note: not claiming that AVs usually respected user privacy - a lot of them could be conisdered malware in and of themselves. But the malware protection scheme was simple and it did guarantee privacy - it's other parts of the AV that then went behind your back and sold your data more directly.

bredren 6y ago

This seems like a pretty good outcome.

tsimionescu 6y ago
It's not, it's whitewashing of a solution that doesn't respect privacy in any way. There are already solutions where this data is not (1) sent in plain text over the internet, where your ISP and anyone else along the way can see it, and (2) don't give even the endpoint information about the specific certificate you are checking.
- notamy 6y ago
  ...Did you perhaps forget to add your (1) link?
  - xvector 6y ago
    Just look up CRLite.
elitan 6y ago
Agreed.

doomrobo 6y ago

Instead of just giving their word that they won’t log IPs, I t’d be nicer if they used a privacy preserving revocation lookup scheme like CRLite https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...

isomorphic 6y ago
Ironically, CRLite seems similar to the approach Apple was (is?) forcing for "content blocker" extensions to Safari--pre-supplying a canned declarative blacklist to Safari, instead of Safari allowing extensions algorithmic access to the current URL.* Their motivation was supposedly to increase user privacy. Funny how they didn't think of that in the CRL and app-blacklist cases. Perhaps they were worried the locally-cached lists themselves would be subject to attack? *In my opinion, in the content-blocker instance the result is a much poorer user experience (ad-blocking effectiveness, flexibility) when compared with e.g. uBlock Origin, and one of the reasons I continue to use Firefox instead.

1vuio0pswjnm7 6y ago

They will not stop logging or delete the logs that they have collected. This suggests they want the data that is collected in the logs, and, in fact, they were collecting IP addresses previously, despite their statements about respecting user privacy. Will they tell the public exactly how they are using the data that they will continue to collect in the logs? Is it commercial use that benefits the company? Does that data belong to the user? Do users grant Apple a license to use such data for such purposes? Who pays for the battery and bandwidth to keep transmitting the data to Apple? Does Apple pay? If Apple makes promises to do something in the future, e.g., in a press release, are those promises enforceable? If so, how? https://web.archive.org/web/20201114024313if_/https://regmedia.co.uk/2020/11/13/taylor-v-google.pdf https://web.archive.org/web/20201114024313if_/https://regmed...

sschueller 6y ago
In that case someone in the EU with a static IP should file a data request. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/how-can-i-access-my-personal-data-held-company-organisation_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

nubela 6y ago

Why should I trust Apple, or Facebook, or Google, or any company but myself with my privacy? Why do I care about what they say? Its marketing speak. Why not just not do it at all? Let me decide how I want my data to be sent. Which ideally, is zero.

elitan 6y ago
You don't need to trust Apple on this. That's why they'll add this feature: - a new preference for users to opt out of these security protections
- fsflover 6y ago
  How can you check that this option is respected? Where is the source code?
  - dewey 6y ago
    There won't be 100% security or certainty, at some point you'll have to trust someone. Do you have the schematics or your network controller, your CPU? What about your ISP's router?
    - fsflover 6y ago
      1. Your goal should be to have maximal verifiability. See Precursor: https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor. 2. https://en.wikipedia.org/wiki/Defense_in_depth https://en.wikipedia.org/wiki/Defense_in_depth
grishka 6y ago
Apple has some double standards, too. When it's third-party iOS apps, it now requires user consent for tracking, which is a good thing. When it's its own operating systems, it sends too many questionable requests to various Apple servers with you having very little recourse — you basically have to reverse engineer the thing to some degree to prevent it from phoning home.

supernova87a 6y ago

I was asking in previous threads if we could look at some info directly from Apple before declaring the end of the world, and I was downvoted to hell for seeking more clarification amidst the outrage. Sometimes, waiting to hear a response isn't unreasonable, don't you think? Maybe rethink the plan to abandon Mac for the rest of your life based on the story of the minute?

tsimionescu 6y ago
Why would you not only believe, but actively look for the PR spin on an obvious violation of trust? The technical facts are not interpretable: Apple chose to build the new MacOS in such a way that they leaked information about every app you chose to run on your system, in plaintext, over the internet, sending it to a third party. Whether they did this out of malice or bungling, the only conclusion is that you should not trust the new MacOS with caring about your privacy. Whatever PR spin Apple would choose to put on this is mostly irrelevant. That they chose to simply pinky swear that they wouldn't log IPs as the main defense is even worse.
totalZero 6y ago
The reason for outrage is that this problem is so glaringly obvious that we can't dismiss it as an oversight, especially with a company as advanced as Apple claims to be. They boast about the T2 chip and all of their security measures. So for them to leave the gate unlocked on something like this is problematic. It means they made the choice to expose and log users' activity, to some degree or another, on purpose. To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs. Why would they ever have logged IP addresses, if the goal is simply to verify the user-side authenticity of an app?
- evercast 6y ago
  It may be worth noting that we do not really know what do they mean by "logs". These can be either database records or simply text logs generated by a web server sitting in front of the OCSP backend and logging the requests, regardless of what those requests are referring to. In other words, it does not have to be a conscious decision to "harvest IP addresses" but could easily be a side-effect of what the infrastructure does. Still, it is no excuse for them as one would expect clear and thorough security/privacy audits before rolling out such features. Especially from companies like Apple.

yyyk 6y ago

One of the hallmarks of Apple news and commentary is how whenever Apple merely announces it will do something, Apple is treated like it already did it, while exactly matching its own promises. The current headline* hints Apple has already made changes, while the article only says Apple 'plans' on making changes over the next year. Any other company would have been torn to shreds on HN if it kept sending cleartext logs and merely 'planned' to sometime patch this out. The plan is odd too - why does Apple need 'a new encrypted protocol for Developer ID certificate revocation checks' when existing encryption protocols can do this? * "Apple Addresses Privacy Concerns Surrounding App Authentication in macOS"

mosselman 6y ago
I am not saying it isn’t true what you are saying, but do you have links to the companies that were collectively ‘torn to shreds’ over similar issues? I have seen this argument a few times now without any references. Were, for instance, Microsoft or Amazon torn to shreds over similar claims?
- yyyk 6y ago
  Think MS telemetry which AFAIK is encrypted and less invasive than the current Apple solution.
Veen 6y ago
According to my dictionary, "addresses" means: > think about and begin to deal with (an issue or problem) It doesn't imply that the solution has been fully implemented.
- yyyk 6y ago
  It implies Apple has 'begun to deal' with the issue when the only thing we may have is a plan to do this sometimes in the near future. [EDIT: every definition of 'address' I've found suggests it's a synonym for 'deal with' not 'begin to deal with']
  - 6y ago

oriesdan 6y ago

They're basically just promising they won't be bad guys, which solves nothing. The proper way to implement their feature without causing privacy issues would be to periodically update a list of authorized certificates and check against that list locally when launching apps. That would probably also increase performances.

elitan 6y ago
How big would such a list be and how quick would a local lookup be?
- oriesdan 6y ago
  Not any bigger than package repositories on linux distributions, which include the list of all known software and sometimes even rules how to build them. It's just plain text. If I can have a local dump of wikipedia, I'm pretty sure I can store a list of developer IDs. Especially when I'm a company controlling the hardware and knowing what is the minimum amount of space the hard drives have in my computers.
- dimator 6y ago
  This is what Bloom filters would solve. I believe another poster said that Firefox uses them to quickly check valid certs.
- actuator 6y ago
  Implementation wise, there are probablilistic DSs like bloom filters which solve this very easily with further checks necesssary for false positives.
- tsimionescu 6y ago
  Extremely small - probably in the megabytes range I would guess. Think about antivirus definitions - those are many, many times larger, and still they have been kept up to date over the internet for decades.
  - tgv 6y ago

cblconfederate 6y ago

"Trust us, We are the good guys" - Apple Inc. 2020

qz2 6y ago
https://www.youtube.com/watch?v=9Z31ExCe0I4 https://www.youtube.com/watch?v=9Z31ExCe0I4

DiabloD3 6y ago

I don't see how Apple can address this: they already collected the data as an unavoidable function of having performed the intended action. Any attempt to claim that they do nothing with this data, and choose not to store it for future use, are red herrings: they will do whatever what their shareholders, the government, et al. tell them to do with it, and will do so without notifying users, and do so retroactively if possible. There is also no way to audit their backend to prove that they are, indeed, doing exactly what they claim to be doing, ergo, the only safe OSX system is one that has Gatekeeper entirely disabled in leu of a local-only switch. Due to enterprise security concerns with leaking attack targets via signed binaries cert chain/OCSP checking, Windows since Vista already allowed disabling of this obvious hole. I know a lot of Cult of Apple are going to climb up my ass for saying this, but this continues to highlight that OSX is not, and probably never will be, enterprise ready. Apple needs their own Nadella-type of CEO before I'll change my opinion on this.

goatinaboat 6y ago
this, but this continues to highlight that OSX is not, and probably never will be, enterprise ready Apple clearly signalled its lack of interest in enterprise offerings when it canned Xserve back in 2010, so don’t hold your breath waiting for these features.

devwastaken 6y ago

The problem should have never existed. Phoning home in this manner should never have existed. This problem is not a bug, it's a fundamental problem with the culture of software development apple curates. They don't believe you should own your computer, that apple always knows better, and if you don't use it the way they force you to, it's unsupported behavior. To them this is natural, they get away doing anything with the Iphone. Doing it to macos is the natural result of that precedent. There's a downvote brigade in this thread. The downvote button is not a "I disagree" button.

deepstack 6y ago
I would like to see mac that does not phone home at all out of box! And if you chose to use internet then it phone home for authentication like icloud.
- grishka 6y ago
  I think you can still complete the initial setup on a mac without ever connecting it to the internet?
  - totalZero 6y ago
    Ok, but what do you do after that? I don't think most people can realistically use a Mac (or PC) without ever connecting to the internet.
    - dvfjsdhgfv 6y ago
      The Windows community reacted to similar behavior by Microsoft by creating several scripts and lists of servers being used to phone home. I guess something similar will be created for macOS although the actual packet filtering will have to be implemented on the router rather than the host.
    - deepstack 6y ago
      I want a computer that I can use for music without internet. Only connect for software upgrade. Very simple. And I don't want to use linux or freebsd. Mac used to be for pros, not it is just for hispsters.

varispeed 6y ago

Is this even legal? Should any personal information be opt in by default? Should Apple present you with the details of what they send and why and an option to opt in to each separately if you want to? Does Apple inform the user where they can download their data that has been collected and who had access to it? Does Apple use a loophole in GDPR that it only applies to websites?

vertis 6y ago

The problem with this kind of "we don't do it" disclaimer, is that they send the information in a way that can be intercepted (OCSP is over HTTP). Even if the information from those requests is only a partial picture, you can be certain that entities like the US intelligence services can slurp it and combine it with other data. If Snowden taught us anything it's that seemingly innocent metadata can be used at scale for a variety of unexpected things. This combined with Apple system services avoiding Little Snitch / Lulu and VPN software in Big Sur is a very dangerous step. How long is it going to be a until a journalist/activist is arrested or killed in an Authoritarian state because the VPN was sending most of the information except the Apple information?

totalZero 6y ago
I'm not even worried about US intelligence. They're deep in all of our butts anyway. What concerns me is that I can't travel with confidence that my non-web activity is obscured from host governments and ISPs.
- vertis 6y ago
  Ah, but I'm not from the US. The US intelligence is just an example anyway. You could insert any relatively competent and well resourced nation state.
mlindner 6y ago
It's more than a "we don't do it" disclaimer. They said they're changing the revocation detection to an encrypted protocol later this year and also giving users an option to opt out entirely. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 (See section "Privacy protections")
- vertis 6y ago
  It's good that they are making these changes, but they're only making them to save face, rather than proactively. Also (nitpick) it's 'over the next year' not 'later this year' given how late we are in the year those are two very different things. It could be 12 months of being vulnerable. This also does nothing for privilege they are affording their own apps to avoid VPNs and Firewalls, which has already been shown to be a security flaw (malicious software will then masquerade as the privileged software).

Lammy 6y ago

> To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs. Serious question as somebody who is not an Apple developer and has zero clue: does the wording "Developer ID certificate checks" here mean locally-built binaries only? Would a 'Release' binary still be logged? Not trying to spread FUD, but I haven't touched Xcode since it was called Project Builder and legitimately don't quite understand. I guess to phrase as a question: Does this stop the hypothetical logging of anyone who has downloaded and ran Tor Browser without compiling it themselves?

newbie578 6y ago

Replace Apple with any other company in the title and all hell would break loose, but since it is about HN's personal toy, you are not allowed to criticize them.. Just look at the heavy brigading happening here or any other Apple related thread. As soon as there is one negative article two positive must pop out to calm the Apple fanboys. And no, saying "if you don't like the platform then don't use it" is not a valid argument. Thank God that it is not up to us on HN to decide what Apple can do, but to the court of law, at least I am putting my trust in the EU..

cute_boi 6y ago

"Apple clarifies that user-specific data is not harvested during the security check and that they plan in removing all IP information from the logs" So they were harvesting IP information in their logs. Just wow this is what i expect from company that advocates privacy. Privacy is just marketing game for them. Bypassing vpn etc has made all your privacy claims invalid apple? We want less trust more truth. If you cannot do that you are not privacy friendly you are hypocrite.

cdubzzz 6y ago
> So they were harvesting IP information in their logs. I don’t get to that conclusion from the text you cited. Sure, it’s possible. But I give Apple the benefit of the doubt here that what they are doing is logging IP addresses of HTTP requests like pretty much any other HTTP server does and now they are going to stop doing even that in response to privacy concerns. Seems reasonable.
- Silhouette 6y ago
  That is my expectation as well. The other, arguably bigger, problem here is that the data is apparently being sent unencrypted, so regardless of whether Apple discards some of the data after receiving it, others might not.
  - cdubzzz 6y ago
    Absolutely agreed. I am by no means defending Apple’s entire position here — just the pretty mundane operation of logging IP addresses associated with HTTP requests.
mlindner 6y ago
Web servers log requests with IP addresses kind of by default. Unless they went out of their way to make sure ip addresses were purged (which they are now) they're probably going to be there.
- ric2b 6y ago

diebeforei485 6y ago

It's crazy that there was no official opt-out for this. It does create this risk of people opting out and spreading malware to others, but after last week's debacle Apple probably thought they should come clean here.

tannhaeuser 6y ago

How can "notarization" be advertised as anything else than locking down the platform towards absolute uselessness in the name of security? Not going to use Mac OS, period. Mac users also can say goodbye to F/OSS on their platform, unless Apple themselves release signed versions of apps for the command line and web servers, DNS servers, file servers and the like. Which they're not going to do as can be seen in the outdated (as in 10-20 years old) versions on Darwin ports.

fierarul 6y ago
I literally paid Apple $99 so I can give its users for free an Open Source app. The free developer account does not allow you to notarize apps. And Apple gives no free passes to open-source apps. Everybody must pay. I'm still debating if I'll renew the certificate.
- m_st 6y ago
  Windows dev here. Not to disagree with you, but I also have to buy an Authenticode certificate just to sign my assemblies so that Windows doesn't show a scary popup when the user starts my application. Ah, and I also have to buy another certificate for HTTPS so that the browsers don't show a scary popup when the user opens my website.
  - fierarul 6y ago
    Yes, my app is Java so I would also have to pay for a Windows cert. I have none right now and would love to not feel so attached to the $300 a fancy cert would be. For HTTPS I manage with LetsEncrypt. Wouldn't that work for you?
- tannhaeuser 6y ago
  I guess EFF should check if any GPL-licensed software is shipped with Mac OS (such as Apple's antique bash version). Because AFAICT, a requirement for notarization, or any other condition on top of GPL for that matter, is incompatible with GPL.

nly 6y ago

Android is getting just as bad lately. My primary banking app (Barclays) just stopped working on my phone because they've started to use Android hardware attested SafetyNet[0][1] to check to see if the phone is rooted. This can't be easily bypassed. Magisk Hide is useless. For now I've had to disable auto-updates in the Play Store and manually install an older app APK, but it's only a matter of time before they deprecate that version. I do essentially all of my banking via my phone, so when this happens I intend to close all my accounts and move banks. The sooner someone leaks a hardware key (preferably one that Google can't revoke without cripplingly bad PR for breaking millions of products) the better. I honestly think 'appification', app stores, and locked down hardware via key chains will be the end of an era in hacker-friendly consumer electronics. Perhaps the end of personal computing entirely. [0] https://developer.android.com/training/safetynet/attestation.html https://developer.android.com/training/safetynet/attestation... [1] https://groups.google.com/g/safetynet-api-clients/c/lpDXBNeV7Fg https://groups.google.com/g/safetynet-api-clients/c/lpDXBNeV...

aequitas 6y ago
> hacker-friendly consumer electronics Both white and black hat hackers friendly? The vast majority of consumers don't want to 'hack' their device. They just want to watch Youtube and do bank payments without getting hacked and robbed of their savings. Recently there was another case in the news where someone was phished via an insecure platform (PC). I get that a lot of rights are taken away from us, but we should fight this with proper consumer protection laws. As it is demonstrated times again most consumers are to naive to take responsability of their security and criminals get away with it to easily.
- nly 6y ago
  Several other apps I use simply display a warning when used on a rooted device. Ultimately, the problem here is one of recommendation vs enforcement. Would you tolerate a bank that insisted on coming in to your house and forcing you to install Norton Antivirus on your computer before they allowed you to log on to your online banking via their website? Banking security should be implemented on the server side. I shouldn't have to choose between running my own code as root on my device and being able to bank.

deleted 6y ago

[deleted]

swiley 6y ago

"Apple promises to fuck over it's users slightly less in the future." How do people tolerate this stuff?

xvector 6y ago
Because their ecosystem is just that smooth. Nothing comes close in terms of polish.

xvector 6y ago

Does not address Big Sur bypassing VPNs.

musicale 6y ago

Like any corporation, we'll be the first to admit that this mistake should never have happened, we should have communicated it differently, and we're very sorry that we got caught. Going forward, we can promise a quick return to business as usual as we work to regain your confidence, starting today with the announcement of several meaningless token gestures alongside a new and more effective PR and marketing campaign.