3 ms·

For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actual

For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actually your own network devices if you're connected on wifi. For instance sending a custom DNS query to the wifi advertised DNS server (if it's the router) will cause that dialog. Same thing happens if you happen to have a router redirect certain resources to itself. The latter typically at this point only happens for non encrypted HTTP traffic and that's basically no longer permitted. So why it happens exactly would be interesting.

uniqueuid 5y ago
Thanks for the details! That opens new questions; for example, what's a "custom" DNS query? One that doesn't use mDNSResponder (or whatever iOS uses right now)?
- the_mitsuhiko 5y ago
  I am not sure under which circumstances it flags. If you write your own DNS client for sure it will happen, but there seem to be more things that cause this to trigger. After that dialog was introduced I saw it pop up on stack overflow for some relatively common libraries (for instance with unity) even if they did not attempt to access the local network.
stingraycharles 5y ago
Interesting. I initially denied the permission, but Tiktok seemed to not be able to make any Internet requests. The kind of behavior I would expect if DNS didn’t work anymore. Maybe it’s just as innocent as this, but OTOH, it’s tiktok we’re talking about.
nicce 5y ago
More context, especially resolving link-local DNS names (those ending with local, per RFC 6762) requires local network access. For iOS devices, Apple has summed this pretty well[1]. Yes, if permission required on below: Making an outgoing TCP connection — yes Listening for and accepting incoming TCP connections — no Sending a UDP unicast — yes Sending a UDP multicast — yes Sending a UDP broadcast — yes Receiving an incoming UDP unicast — no Receiving an incoming UDP multicast — yes Receiving an incoming UDP broadcast — yes And finally usage of Bonjour operations. [1] https://developer.apple.com/forums/thread/663874 https://developer.apple.com/forums/thread/663874
- yc12340 5y ago
  This sounds like it might help against DNS rebinding attacks, — at the cost of breaking interchangeability between DNS names and IP addresses. Not sure, if such policy is a good idea, especially if the permission prompt automatically appears upon network activity without explicit developer intention. This will simply condition users to click "OK" without understanding what's going on.
kall 5y ago
I‘ve had many apps, even very trustworthy ones, show me this permission prompt when my internet connection was down and the router was directing all requests to an error page. So it‘s possible for this prompt to appear without the app developer doing anything bad. Not giving TikTok much benefit of doubt though.

uniqueuid 5y ago

Thanks for the details! That opens new questions; for example, what's a "custom" DNS query? One that doesn't use mDNSResponder (or whatever iOS uses right now)?

the_mitsuhiko 5y ago
I am not sure under which circumstances it flags. If you write your own DNS client for sure it will happen, but there seem to be more things that cause this to trigger. After that dialog was introduced I saw it pop up on stack overflow for some relatively common libraries (for instance with unity) even if they did not attempt to access the local network.

stingraycharles 5y ago

Interesting. I initially denied the permission, but Tiktok seemed to not be able to make any Internet requests. The kind of behavior I would expect if DNS didn’t work anymore. Maybe it’s just as innocent as this, but OTOH, it’s tiktok we’re talking about.

nicce 5y ago

More context, especially resolving link-local DNS names (those ending with local, per RFC 6762) requires local network access. For iOS devices, Apple has summed this pretty well[1]. Yes, if permission required on below: Making an outgoing TCP connection — yes Listening for and accepting incoming TCP connections — no Sending a UDP unicast — yes Sending a UDP multicast — yes Sending a UDP broadcast — yes Receiving an incoming UDP unicast — no Receiving an incoming UDP multicast — yes Receiving an incoming UDP broadcast — yes And finally usage of Bonjour operations. [1] https://developer.apple.com/forums/thread/663874 https://developer.apple.com/forums/thread/663874

yc12340 5y ago
This sounds like it might help against DNS rebinding attacks, — at the cost of breaking interchangeability between DNS names and IP addresses. Not sure, if such policy is a good idea, especially if the permission prompt automatically appears upon network activity without explicit developer intention. This will simply condition users to click "OK" without understanding what's going on.

kall 5y ago

I‘ve had many apps, even very trustworthy ones, show me this permission prompt when my internet connection was down and the router was directing all requests to an error page. So it‘s possible for this prompt to appear without the app developer doing anything bad. Not giving TikTok much benefit of doubt though.