7 ms·

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifyi

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

beervirus 6y ago
Is it even app hashes, or developer certificate hashes?
- jtbayly 6y ago
  The larger the program, the longer it takes to verify the first time you run it. I can only interpret that as meaning they are basing the whole program. Source: me, downloading and running various apps
  - jtbayly 6y ago
    Apparently the initial launch delay is Gatekeeper, which is something different.
whatever1 6y ago
What does that even mean? Of course they can identify you, you are knocking their door with the same IP with your iCloud account. Maybe the file you are giving them does not have your uid, but as long as you have connected your Mac to your Apple account you are uniquely identified.
- user-the-name 6y ago
  Plenty of computers share a single public IP address. Plenty of computers jump IP addresses constantly. It is not at all reliable trying to tie IP addresses together that way. If they wanted the information, they would need to send it.
  - oauea 6y ago
    Maybe you have a funny network situation, but my network situation is solid, and my IP address rarely changes. IP addresses are absolutely identifiable information.
    - user-the-name 6y ago
      They are SOMETIMES identifiable information. They are not RELIABLE for identification. If you are going to be collecting information, you are not going to choose unreliable information when you have the option to collect reliable information. That would not make sense.
      - whatever1 6y ago
        I can right now open my vpn, change my ip address, go to my apple account and it will report that my Mac is "Online", meaning that apple knows that my particular machine is on with a given IP address. It would be completely useless (redundant at the very least) to also include the uid in the signature file.
        user-the-name 6y ago
        There might ten other, a hundred other people with the same public IP visible to Apple, if you ISP is running you through a NAT. That fact that you have connected from an IP recently in no way guarantees that the next connection from that IP will be coming from you. That is exactly why you need to send an identifier for any data being collected.
  - whatever1 6y ago
    And Apple updates your ip continuously in their server as evidenced in the “find my” service.
  - m463 6y ago
    Every time you change network locations, all of these daemons contact apple again. There are plenty of push services on your machine and apple keeps track of where you are. also ipv6
lovelyviking 6y ago
>They do not contain the unique hardware identifier that Apple computers have Different part of MacOS can send it and you would have no idea until it malfunction like in this case.
- user-the-name 6y ago
  They would not be accurately tied together, though, since these requests are not sent with any kind of identifier.
  - lovelyviking 6y ago
    Who knows, may be they can start to send id too by a special request from the server or send those hashes by other channels in addition to this one, but much later. And server can make such request based on some heuristics or based on some 'black list' of hashes. How can you know for sure? We can only guess to the certain degree without looking into sources.
    - user-the-name 6y ago
      Why would they NOT want the data now but would want it in some unspecified future?
      - lovelyviking 6y ago
        To avoid being caught could be one reason. Why would they hide the feature without option in GUI to turn it off? We do not know. Possibly they are hiding something else, something bigger, who knows.
oauea 6y ago
The request also contains your ip address. Charitable would be distributing a bloom filter and checking matches locally.
- user-the-name 6y ago
  Your IP address is a very weak and unreliable way to identify you. If they actually wanted to identify you, they have much better ways to do it, and those ways are not used.
m463 6y ago
I believe you are trying to think about this rationally, but this is not the only thing going on. When a mac boots up or changes network location, a long list of processes on your machine (like AppleIdAuthAgent, identityservicesd, , and maybe 10 or 20 more) connect to various apple servers associating your actual identity with the ip address. It will continue to do these kinds of things while you are online. And all this is interleaved with oscp requests.
- cdubzzz 6y ago
  Do you have sources for this? I don’t doubt you, I’d just be interested to read some details about what exactly those services are doing/sending.
  - m463 6y ago
    this is from observations of my own machines. I would suggest you install little snitch, turn off everything, and then boot your machine. Maybe switch from ethernet to wifi and observe the kinds of popups you get. Another method, though hard to associate with specific processes, would be to run tcpdump -i <interface>. Sometimes it's more useful to run tcpdump and do a capture, then play it back later because DNS lookups by tcpdump itself make it more chatty than it should be. You could also run it with -n but you get less information.
- user-the-name 6y ago
  It is not possible to accurately connect an identity with an IP address. Many computers share IP addresses, and many others jump IP addresses frequently.
  - makeworld 6y ago
    Many computers don't share IP addresses too. And there are times when there is only one macOS under an IP. This is not something to just wave away.
    - user-the-name 6y ago
mensetmanusman 6y ago
Your IP address can be pretty accurately matched to an identity due to PRISM. Has a third party verified they don’t keep track of IP addresses?
- user-the-name 6y ago
  An Apple ID is tied to an identity right now. They don't use it. Why?
athms 6y ago
>The requests contain only app hashes. No, application hashes are never sent. People are confusing OCSP and notarization. The requests sent via OCSP check the developer certificate. Notarization checks are done over HTTPS.

beervirus 6y ago

Is it even app hashes, or developer certificate hashes?

jtbayly 6y ago
The larger the program, the longer it takes to verify the first time you run it. I can only interpret that as meaning they are basing the whole program. Source: me, downloading and running various apps
- jtbayly 6y ago
  Apparently the initial launch delay is Gatekeeper, which is something different.

whatever1 6y ago

What does that even mean? Of course they can identify you, you are knocking their door with the same IP with your iCloud account. Maybe the file you are giving them does not have your uid, but as long as you have connected your Mac to your Apple account you are uniquely identified.

user-the-name 6y ago
Plenty of computers share a single public IP address. Plenty of computers jump IP addresses constantly. It is not at all reliable trying to tie IP addresses together that way. If they wanted the information, they would need to send it.
- oauea 6y ago
  Maybe you have a funny network situation, but my network situation is solid, and my IP address rarely changes. IP addresses are absolutely identifiable information.
  - user-the-name 6y ago
    They are SOMETIMES identifiable information. They are not RELIABLE for identification. If you are going to be collecting information, you are not going to choose unreliable information when you have the option to collect reliable information. That would not make sense.
    - whatever1 6y ago
      I can right now open my vpn, change my ip address, go to my apple account and it will report that my Mac is "Online", meaning that apple knows that my particular machine is on with a given IP address. It would be completely useless (redundant at the very least) to also include the uid in the signature file.
      - user-the-name 6y ago
        There might ten other, a hundred other people with the same public IP visible to Apple, if you ISP is running you through a NAT. That fact that you have connected from an IP recently in no way guarantees that the next connection from that IP will be coming from you. That is exactly why you need to send an identifier for any data being collected.
- whatever1 6y ago
  And Apple updates your ip continuously in their server as evidenced in the “find my” service.
- m463 6y ago
  Every time you change network locations, all of these daemons contact apple again. There are plenty of push services on your machine and apple keeps track of where you are. also ipv6

lovelyviking 6y ago

>They do not contain the unique hardware identifier that Apple computers have Different part of MacOS can send it and you would have no idea until it malfunction like in this case.

user-the-name 6y ago
They would not be accurately tied together, though, since these requests are not sent with any kind of identifier.
- lovelyviking 6y ago
  Who knows, may be they can start to send id too by a special request from the server or send those hashes by other channels in addition to this one, but much later. And server can make such request based on some heuristics or based on some 'black list' of hashes. How can you know for sure? We can only guess to the certain degree without looking into sources.
  - user-the-name 6y ago
    Why would they NOT want the data now but would want it in some unspecified future?
    - lovelyviking 6y ago
      To avoid being caught could be one reason. Why would they hide the feature without option in GUI to turn it off? We do not know. Possibly they are hiding something else, something bigger, who knows.

oauea 6y ago

The request also contains your ip address. Charitable would be distributing a bloom filter and checking matches locally.

user-the-name 6y ago
Your IP address is a very weak and unreliable way to identify you. If they actually wanted to identify you, they have much better ways to do it, and those ways are not used.

m463 6y ago

I believe you are trying to think about this rationally, but this is not the only thing going on. When a mac boots up or changes network location, a long list of processes on your machine (like AppleIdAuthAgent, identityservicesd, , and maybe 10 or 20 more) connect to various apple servers associating your actual identity with the ip address. It will continue to do these kinds of things while you are online. And all this is interleaved with oscp requests.

cdubzzz 6y ago
Do you have sources for this? I don’t doubt you, I’d just be interested to read some details about what exactly those services are doing/sending.
- m463 6y ago
  this is from observations of my own machines. I would suggest you install little snitch, turn off everything, and then boot your machine. Maybe switch from ethernet to wifi and observe the kinds of popups you get. Another method, though hard to associate with specific processes, would be to run tcpdump -i <interface>. Sometimes it's more useful to run tcpdump and do a capture, then play it back later because DNS lookups by tcpdump itself make it more chatty than it should be. You could also run it with -n but you get less information.
user-the-name 6y ago
It is not possible to accurately connect an identity with an IP address. Many computers share IP addresses, and many others jump IP addresses frequently.
- makeworld 6y ago
  Many computers don't share IP addresses too. And there are times when there is only one macOS under an IP. This is not something to just wave away.
  - user-the-name 6y ago

mensetmanusman 6y ago

Your IP address can be pretty accurately matched to an identity due to PRISM. Has a third party verified they don’t keep track of IP addresses?

user-the-name 6y ago
An Apple ID is tied to an identity right now. They don't use it. Why?

athms 6y ago

>The requests contain only app hashes. No, application hashes are never sent. People are confusing OCSP and notarization. The requests sent via OCSP check the developer certificate. Notarization checks are done over HTTPS.