3 ms·

>Every OS on the planet will verify developer certificates ... In plain text? I know how this shit works, I digitally signed things before, and for this verifi

>Every OS on the planet will verify developer certificates ... In plain text? I know how this shit works, I digitally signed things before, and for this verification there is no need for internet. So copy pasted a lot of tech stuff there but it is complexly wrong. I could explain it how it works and why intenet is not needed but you could use google and figure it out, then find out what exactly Apple was checking(it was not the developer signiture). >Understandable for three reasons: 1. It would cause major unwarranted panic that could cause additional attacks. I.e. A phishing scam saying "click here to be protected from the iPhone attack!" Tim could hire some competent guy to write a clear email to prevent this. Also your point insinuates that you can cause a lot of damage to an iOS device with just an email and a link!! be careful Apple might not like you insinuating iOs is such terrible at security. >2. The malware in question did not have any known function and didn't actually do anything or send anything to anyone. In other words, despite being prevalent, it was completely harmless. Cure, malware sending data over the intenet behind the users back is harmless. The conclusion is that Apple care more about PR, if Facebook would have sent one single bit of the users data Apple is putting a big article in the newspaper, if some malware is sending the exact same bit of data Apple changes it's mind last minute and keeps it hidden from the user. >Android quickly copied Apple a Ah, OK so Apple and Google shit stinks as bad, nothing new... Apple and Google are in the same boat, just one has some better PR and a big army of fanboys. Luckily the users found out and a judge forced this assholes companies to confess, otherwise next time the storage would say 500Gb but in reality would be half.

gjsman-1000 5y ago
"In plain text? I know how this shit works, I digitally signed things before, and for this verification there is no need for internet. So copy pasted a lot of tech stuff there but it is complexly wrong. I could explain it how it works and why intenet is not needed but you could use google and figure it out, then find out what exactly Apple was checking(it was not the developer signiture)." Actually, you do need the internet to ensure that the certificate was not revoked. This is partly why Apple put in the whole App Notarization thing in Catalina, because when you Notarize the app, MacOS can check if the Notarization was revoked whereas a simple Developer Certificate from a security company is a harder thing to revoke on demand or to check the authenticity of. Notarization gives Apple, for better or worse, to immediately revoke a Developer Certificate without the need to check in with the Developer and have the developer signing certificate revoked from GeoTrust or whoever issued it. The Mac then checks in with Apple servers if the notarization is valid, and if it is valid, the app runs; and if it isn't valid, it knows it's been tampered with and revokes the app. One benefit of Notarization is that it helps protect Apple and MacOS users from developer supply-side attacks like XcodeGhost. If the developer was compromised resulting in the code's legitimate source being poisoned and a hacked update was distributed, Apple could still immediately revoke that app because the Mac checks in when online. "Tim could hire some competent guy to write a clear email to prevent this. Also your point insinuates that you can cause a lot of damage to an iOS device with just an email and a link!! be careful Apple might not like you insinuating iOs is such terrible at security." I said Phishing Scam. A scam where you enter your credit card info for a fictional security software. Not all scams require a software hack. "Cure, malware sending data over the intenet behind the users back is harmless." Researchers analyzed it and concluded that it sent nothing back to the hackers. So it was indeed harmless. Apple also knew that their updates have a 90%+ opt-in rate, so when the next update went out, most users would have it automatically removed, and anyone who didn't update would likely restart their iPhone at some point, in which case AppleMobileFileIntegrity would detect and kill it. "Ah, OK so Apple and Google shit stinks as bad, nothing new... Apple and Google are in the same boat, just one has some better PR and a big army of fanboys. Luckily the users found out and a judge forced this assholes companies to confess, otherwise next time the storage would say 500Gb but in reality would be half." What BS are you spouting?
- simion314 5y ago
  Even if you don't like it Apple already admitted it was a bad implementation and they are fixing it. (maybe next time they put more competent people and give them what they need to implement things right especially when it is about privacy, the thing Apple is screening this days) >What BS are you spouting? Big companies downgrading your hardware capabilities behind your back, then denying it until a judge forces them to admit and pay the users. If Apple would not have been caught with the CPu downclockingm, storage would be next for sure.

gjsman-1000 5y ago

"In plain text? I know how this shit works, I digitally signed things before, and for this verification there is no need for internet. So copy pasted a lot of tech stuff there but it is complexly wrong. I could explain it how it works and why intenet is not needed but you could use google and figure it out, then find out what exactly Apple was checking(it was not the developer signiture)." Actually, you do need the internet to ensure that the certificate was not revoked. This is partly why Apple put in the whole App Notarization thing in Catalina, because when you Notarize the app, MacOS can check if the Notarization was revoked whereas a simple Developer Certificate from a security company is a harder thing to revoke on demand or to check the authenticity of. Notarization gives Apple, for better or worse, to immediately revoke a Developer Certificate without the need to check in with the Developer and have the developer signing certificate revoked from GeoTrust or whoever issued it. The Mac then checks in with Apple servers if the notarization is valid, and if it is valid, the app runs; and if it isn't valid, it knows it's been tampered with and revokes the app. One benefit of Notarization is that it helps protect Apple and MacOS users from developer supply-side attacks like XcodeGhost. If the developer was compromised resulting in the code's legitimate source being poisoned and a hacked update was distributed, Apple could still immediately revoke that app because the Mac checks in when online. "Tim could hire some competent guy to write a clear email to prevent this. Also your point insinuates that you can cause a lot of damage to an iOS device with just an email and a link!! be careful Apple might not like you insinuating iOs is such terrible at security." I said Phishing Scam. A scam where you enter your credit card info for a fictional security software. Not all scams require a software hack. "Cure, malware sending data over the intenet behind the users back is harmless." Researchers analyzed it and concluded that it sent nothing back to the hackers. So it was indeed harmless. Apple also knew that their updates have a 90%+ opt-in rate, so when the next update went out, most users would have it automatically removed, and anyone who didn't update would likely restart their iPhone at some point, in which case AppleMobileFileIntegrity would detect and kill it. "Ah, OK so Apple and Google shit stinks as bad, nothing new... Apple and Google are in the same boat, just one has some better PR and a big army of fanboys. Luckily the users found out and a judge forced this assholes companies to confess, otherwise next time the storage would say 500Gb but in reality would be half." What BS are you spouting?

simion314 5y ago
Even if you don't like it Apple already admitted it was a bad implementation and they are fixing it. (maybe next time they put more competent people and give them what they need to implement things right especially when it is about privacy, the thing Apple is screening this days) >What BS are you spouting? Big companies downgrading your hardware capabilities behind your back, then denying it until a judge forces them to admit and pay the users. If Apple would not have been caught with the CPu downclockingm, storage would be next for sure.