4 ms·
Apple’s AirDrop leaks users’ PII, and there’s not much they can do about it
- coolspot 6y agoPavel Zhovner, creator of Flipper[1] had this cool post [2] in June 2020 on how he used Apple AirDrop for automated dating and fun. It included the phone number recovery component as well. 1 - https://flipperzero.one/ https://flipperzero.one/ 2 - https://m.habr.com/ru/company/ruvds/blog/505384/ https://m.habr.com/ru/company/ruvds/blog/505384/
- failwhaleshark 6y agoI wonder if doing this would be illegal in the US, a-la Aaron Swartz.
- snotrockets 6y agoI don't know what the criminal threshold for stalking and harassment is. But unlike Zhovner and yourself, I know what the normative threshold is (tip: it's DON'T THE FUCK).
- temp667 6y agoWhat a bogus headline. If you don't want to try to sync with others publically, don't airdrop in a place where you think someone is waiting to steal your information. Reality though - your email and phone number is probably already out there. I'm waiting for the headline - thieves who grab the phone you stick out in front of you while you walk / sit / eat / drink / ride bus / ride train - may get PII. They really can - and likely lots more than whatever apple is leaking. No excuse for apple's idiocy, just some perspective perhaps. You can easily avoid this - I can't remember last time I used share pane in public.
- randyrand 6y agoIt's not just email and phone. It's email and phone and location. This would be very useful info for marketing campaigns. Automated emails to people that go to specific stores, parks, etc.
- GeekyBear 6y agoThe number of people transferring files in public is so limited that it would be much more simple to buy the marketing data for everyone in a given city.
- joshmanders 6y ago> and location. Ok? AirDrop doesn't work miles away from people, so if they got your email and phone already through AirDrop, how is having your location such emphasized? "They can see you, gasp!"
- randyrand 6y agoIt shouldn't be too hard to understand... The more trackers you place, the more location data you have on that person. You could literally put thousands around a city at many different stores, gas stations, parks, etc.
- innagadadavida 6y agoThe article is sparse on how they implemented. Do you need a Mac/iPhone or can this thing run on very cheap hardware that can be deployed at scale? Given they found this almost two years ago, I wonder if there is an actual attack or exploit that has been deployed or is this one of those attacks that don’t leave the lab environment?
- lathiat 6y agoUnfortunately while you shouldn't try to sync with others publically is a good theory, in the current implementation just opening the share sheet to share via messages or some other app will trigger AirDrop discovery. So you'd need to actively turn the feature off. In some ways it seems having the "Contacts only" mode enabled is almost worse than having it set to everyone. The obvious problem with having it set to everyone though is you can easily get airdropped things by people around you. Which can be a great joke but since it displays preview of image receives can also be used in harmful or abusive ways.
- throwaway1090 6y agoDiscussion from 3 days ago: https://news.ycombinator.com/item?id=26889665 https://news.ycombinator.com/item?id=26889665
- luxuryballs 6y agonot much they can do? they could remove the feature, or why not just require some one-time iCloud handshake to happen to exchange anonymous identifiers once you confirm the contact? might gimp the feature somewhat but still, something can be done for a feature where air dropping to randos is just a cool party trick
- Jyaif 6y ago> not much they can do? If you had read the article you would have seen that the researchers implemented the same feature without leaking any data using "Private Set Intersections".