7 ms·

Actually this makes sense. Already since recent iOS versions have started popping up an alert to grant access to local network resources per app, I've noticed t

by 0x0 5y ago

Actually this makes sense. Already since recent iOS versions have started popping up an alert to grant access to local network resources per app, I've noticed this popping up on several apps that have no business mapping and fingerprinting my LAN. Including the Facebook app. It's weird how a company can be so internally disconnected. This entitlement is a good privacy-preserving hurdle to prevent scummy apps from interfering with your local network and fingerprinting you. On the other hand, the on-device scanning of nudes in imessage and csam in iphoto is a total snitchware swatting-as-a-service piece of software which only serves to incriminate and harass the owner of the device. Such a shame.

veeti 5y ago
If Facebook has no business using this permission why did App Store review approve it? Surely they must know what is going on in every app, that's why the App Store is so safe.
- davewritescode 5y ago
  Because there are legitimate reasons why Facebook might need access to your network for streaming videos to a TV or similar uses cases. Apple doesn't know what every app does, they basically know what frameworks/syscalls get made. You can wrap entitlements around those things without explicitly knowing exactly what an application is actually up to.
  - 0x0 5y ago
    Streaming videos to a TV with airplay can and does happen without the app itself needing multicast/broadcast permissions, as long as you use the provided frameworks and APIs.
    - pW9GLKxm9taFEhz 5y ago
      And what if an app wants to support Cast in addition to or in-place of AirPlay?
      - deleted 5y ago
        [deleted]
    - howinteresting 5y ago
      It's for Chromecast, not Airplay.
    - spoonjim 5y ago
      It’s not for AirPlay it’s to control Facebook applications running on other devices like the Facebook Portal. I control our Portal with my phone regularly.
      - jackson1442 5y ago
        I'm curious, what led you to decide to buy a portal? I haven't seen much of it, but it just doesn't have an appeal to me.
        spoonjim 5y ago
        It is an OUTSTANDING product. We have several elderly grandparents who loved visiting their grandkids and during the pandemic were cut off. The portal brought them back into the feeling of being part of the action and getting to see what their grandkids were doing. They were all able to set up the Portal without any assistance, which was very surprising. Also, it’s a fantastic Bluetooth speaker when we’re not using it for calls. Did I feel good about inviting Facebook into my living room? No. I don’t trust that company. But the tradeoff was worth it for me. Edit: I didn’t just buy one Portal, I bought 4. One would be kind of pointless.
  - inetknght 5y ago
    > Because there are legitimate reasons why Facebook might need access to your network for streaming videos to a TV or similar uses cases. If you want Facebook on your iPhone to call someone then Apple provides a Phone API. If you want Facebook on your iPhone to stream to your TV then Apple should provide an Apple TV API for Facebook to use. There is no reason whatsoever for Facebook to have any direct access to anything on your phone whether its your sensors, your microphone, your video, your network.
    - judge2020 5y ago
      > If you want Facebook on your iPhone to stream to your TV then Apple should provide an Apple TV API for Facebook to use. There is - AirPlay doesn't require local network access since it's an API apps can use. Un/fortunately, there are multiple competing standards like Chromecast (and other, manufacturer-specific casting standards) which require the app to do its own local network discovery to find available devices.
    - smoldesu 5y ago
      Try telling that to Uber or Waze. Both of those apps need special permissions from Apple just to keep operating.
      - willstrafach 5y ago
        In current versions? What permission is this?
- SalimoS 5y ago
  there is the facebook watch application on smart tv
bjackman 5y ago
Your comment nicely addresses the local network restriction, but the article already expresses understanding of this. Why the extra-stringent multicast thing?
- neilalexander 5y ago
  They’re trying to stop people from listening for all multicast traffic, presumably because it stops someone from fingerprinting based on the things on your network. The restriction doesn’t stop you from using the NetService API (or friends) from listening for or advertising specific named mDNS services. You can continue to do that today without any extra entitlements. What it stops you from doing is listening for wildcards and sucking up everything — sadly, restricting multicast traffic on regular IP sockets is basically an extension of that.
- floatingatoll 5y ago
  Instead of trying to define a guideline that says “may not use multicast for this, that, blah”, apps instead just have to request it and explain why. It’s probably not a topic that the usual review team can consider without extreme levels of training beyond what’s necessary, and it’s a specialty network skill with lots of privacy traps. It also allows Apple to see who doesn’t request the permission but uses multicast anyways, because they might be using some sort of framework that is unknowingly tracking people, and then they can identify and start rejecting that framework storewide. “How can we ensure every request for multicast escalates to someone qualified to make a decision that we can stand behind?” An essay question is a great answer, even if people hate the uncertainty. Better that than a new guideline!
- yaur 5y ago
  Multicast can wreak havoc on a WiFi network. Clients that are further away from your AP require sending data at a slower rate and APs will try to send the data slow enough so that all clients can receive the traffic. In practice this means a 1mbps multicast stream will take far more than 1% of a 100mbps network and in some cases I have seen it shut down a network entirely. At my day job we disabled receiving multicast (IPTV) feeds over WiFi years ago because we have never seen it work well enough to be worth it.
l-albertovich 5y ago
Could you explain your posture in the CSAM scanning thing? I'm not an apple user but the way I see it, it's not some sort of nudism / age detection mechanism where a very incopetent system could land you in jail for an old digitalized photo of yourself after a shower from 30 years ago when parents actually took those kinds of pics. The way I see it, it just hashes them with whatever mechanism they came up with and there are additional mechanisms to verify it if for some fringe conincidence your cat pictures hash matches some CSAM hash which would be annoying but not the end of the world. Now, in the other hand, let's say the snitch detects actual CSAM in someones phone, what's the problem? if it was sent without their consent an investigation can lead to who sent it, and if it was well, tough shit... I know it sounds very 1984ish but honestly I don't think it's any worst than the kind of surveillance power google has with all their platforms combined (chrome, android, google, any web thing they didn't kill already). I guess, what I'm asking for is for real arguments on why and how this truly violates privacy and to what extent it is problematic for a legit non CSAM consuming person. I'm not trying to argue with you but to understand this point of view since I read so many comments against it but nothing that seriously made sense to me.
- 0x0 5y ago
  I am not fond of my device burning battery for, and being one bitflip away at a jmp-if-zero/jmp-if-not-zero, to calling an API whose only purpose is to inform the authorities that I am a suspect. If it happened server-side I would have no problem with it.
  - l-albertovich 5y ago
    Thanks for your response, I'll answer just to continue the conversation, not to try to invalidate your points or anything like that. I read in other posts there's some sort of review process and a way to verify if the image is a match or a collision (I don't know much about he details) but I read the latest posts about the attacks that were being worked on. I mean, with the complexity these attacks have I think it'd be easier for a ransomware gang to just infect you, plant the CSAM, find reliable contact info, verify it, lock your phone and extort your through an untrackable side channel (if this system didn't exist) or something a bit more elaborate / targeted (not even at NSO level). IDK, I think the phone burns battery for dumber reasons at a higher rate, this should only be activated when there's a new picture written to disk and it's probably less expensive resource wise than whatsapp / telegram / imessage checking for new messages periodically don't you think? I think if they don't royally fuck the process up or turn it into some idiotic fake way of getting the cops whatever paperwork they need to force you to give them access to your files it's a good thing.
swiley 5y ago
Facebook has no business being an app at all.
kmeisthax 5y ago
The only problem I have with it is that the entitlement system controls both what you can submit to the App Store as well as what you can locally compile and install. For example, you can't locally develop a VPN app until you ask Apple permission to develop a VPN app. Almost certainly this is to appease China, which I find particularly egregious. Fonts also require an entitlement, but I'm not sure if it's just something you need a paid dev account for or if you need to specifically grovel to Apple as to why you need it. I doubt "I want to submit a pull request to iSH" would be considered a valid reason (but correct me if I'm wrong). Even things like camera access in multitasking views are entitlements that your dev account needs to be preapproved for. In fact, it wasn't even something that Apple even publicly mentioned for a while - only Zoom had it until someone reverse-engineered their app bundle and found out about it.
- shuckles 5y ago
  Didn’t that get hardened in response to the Onavo revelations? In particular, Facebook was using their developer certificate to sign spyware installed via MDM. I don’t remember it being a requirement from the beginning, even though China has tightly regulated VPNs for a long time.
  - upbeat_general 5y ago
    Honestly I see no issue with facebook being allowed to do this. If someone pays me to install spyware on my desktop, nobody complains that we should remove the ability to run as root.
- jackson1442 5y ago
  > For example, you can't locally develop a VPN app until you ask Apple permission to develop a VPN app. Almost certainly this is to appease China, which I find particularly egregious. Can't you manually add a vpn without an app? I haven't needed to configure this myself but presumably if you're bundling your own vpn app you can do the manual configuration in settings which is significantly easier.
  - 5y ago

by 0x0 5y ago

veeti 5y ago

If Facebook has no business using this permission why did App Store review approve it? Surely they must know what is going on in every app, that's why the App Store is so safe.

davewritescode 5y ago
Because there are legitimate reasons why Facebook might need access to your network for streaming videos to a TV or similar uses cases. Apple doesn't know what every app does, they basically know what frameworks/syscalls get made. You can wrap entitlements around those things without explicitly knowing exactly what an application is actually up to.
- 0x0 5y ago
  Streaming videos to a TV with airplay can and does happen without the app itself needing multicast/broadcast permissions, as long as you use the provided frameworks and APIs.
  - pW9GLKxm9taFEhz 5y ago
    And what if an app wants to support Cast in addition to or in-place of AirPlay?
    - deleted 5y ago
      [deleted]
  - howinteresting 5y ago
    It's for Chromecast, not Airplay.
  - spoonjim 5y ago
    It’s not for AirPlay it’s to control Facebook applications running on other devices like the Facebook Portal. I control our Portal with my phone regularly.
    - jackson1442 5y ago
      I'm curious, what led you to decide to buy a portal? I haven't seen much of it, but it just doesn't have an appeal to me.
      - spoonjim 5y ago
        It is an OUTSTANDING product. We have several elderly grandparents who loved visiting their grandkids and during the pandemic were cut off. The portal brought them back into the feeling of being part of the action and getting to see what their grandkids were doing. They were all able to set up the Portal without any assistance, which was very surprising. Also, it’s a fantastic Bluetooth speaker when we’re not using it for calls. Did I feel good about inviting Facebook into my living room? No. I don’t trust that company. But the tradeoff was worth it for me. Edit: I didn’t just buy one Portal, I bought 4. One would be kind of pointless.
- inetknght 5y ago
  > Because there are legitimate reasons why Facebook might need access to your network for streaming videos to a TV or similar uses cases. If you want Facebook on your iPhone to call someone then Apple provides a Phone API. If you want Facebook on your iPhone to stream to your TV then Apple should provide an Apple TV API for Facebook to use. There is no reason whatsoever for Facebook to have any direct access to anything on your phone whether its your sensors, your microphone, your video, your network.
  - judge2020 5y ago
    > If you want Facebook on your iPhone to stream to your TV then Apple should provide an Apple TV API for Facebook to use. There is - AirPlay doesn't require local network access since it's an API apps can use. Un/fortunately, there are multiple competing standards like Chromecast (and other, manufacturer-specific casting standards) which require the app to do its own local network discovery to find available devices.
  - smoldesu 5y ago
    Try telling that to Uber or Waze. Both of those apps need special permissions from Apple just to keep operating.
    - willstrafach 5y ago
      In current versions? What permission is this?
SalimoS 5y ago
there is the facebook watch application on smart tv

bjackman 5y ago

Your comment nicely addresses the local network restriction, but the article already expresses understanding of this. Why the extra-stringent multicast thing?

neilalexander 5y ago
They’re trying to stop people from listening for all multicast traffic, presumably because it stops someone from fingerprinting based on the things on your network. The restriction doesn’t stop you from using the NetService API (or friends) from listening for or advertising specific named mDNS services. You can continue to do that today without any extra entitlements. What it stops you from doing is listening for wildcards and sucking up everything — sadly, restricting multicast traffic on regular IP sockets is basically an extension of that.
floatingatoll 5y ago
Instead of trying to define a guideline that says “may not use multicast for this, that, blah”, apps instead just have to request it and explain why. It’s probably not a topic that the usual review team can consider without extreme levels of training beyond what’s necessary, and it’s a specialty network skill with lots of privacy traps. It also allows Apple to see who doesn’t request the permission but uses multicast anyways, because they might be using some sort of framework that is unknowingly tracking people, and then they can identify and start rejecting that framework storewide. “How can we ensure every request for multicast escalates to someone qualified to make a decision that we can stand behind?” An essay question is a great answer, even if people hate the uncertainty. Better that than a new guideline!
yaur 5y ago
Multicast can wreak havoc on a WiFi network. Clients that are further away from your AP require sending data at a slower rate and APs will try to send the data slow enough so that all clients can receive the traffic. In practice this means a 1mbps multicast stream will take far more than 1% of a 100mbps network and in some cases I have seen it shut down a network entirely. At my day job we disabled receiving multicast (IPTV) feeds over WiFi years ago because we have never seen it work well enough to be worth it.

l-albertovich 5y ago

Could you explain your posture in the CSAM scanning thing? I'm not an apple user but the way I see it, it's not some sort of nudism / age detection mechanism where a very incopetent system could land you in jail for an old digitalized photo of yourself after a shower from 30 years ago when parents actually took those kinds of pics. The way I see it, it just hashes them with whatever mechanism they came up with and there are additional mechanisms to verify it if for some fringe conincidence your cat pictures hash matches some CSAM hash which would be annoying but not the end of the world. Now, in the other hand, let's say the snitch detects actual CSAM in someones phone, what's the problem? if it was sent without their consent an investigation can lead to who sent it, and if it was well, tough shit... I know it sounds very 1984ish but honestly I don't think it's any worst than the kind of surveillance power google has with all their platforms combined (chrome, android, google, any web thing they didn't kill already). I guess, what I'm asking for is for real arguments on why and how this truly violates privacy and to what extent it is problematic for a legit non CSAM consuming person. I'm not trying to argue with you but to understand this point of view since I read so many comments against it but nothing that seriously made sense to me.

0x0 5y ago
I am not fond of my device burning battery for, and being one bitflip away at a jmp-if-zero/jmp-if-not-zero, to calling an API whose only purpose is to inform the authorities that I am a suspect. If it happened server-side I would have no problem with it.
- l-albertovich 5y ago
  Thanks for your response, I'll answer just to continue the conversation, not to try to invalidate your points or anything like that. I read in other posts there's some sort of review process and a way to verify if the image is a match or a collision (I don't know much about he details) but I read the latest posts about the attacks that were being worked on. I mean, with the complexity these attacks have I think it'd be easier for a ransomware gang to just infect you, plant the CSAM, find reliable contact info, verify it, lock your phone and extort your through an untrackable side channel (if this system didn't exist) or something a bit more elaborate / targeted (not even at NSO level). IDK, I think the phone burns battery for dumber reasons at a higher rate, this should only be activated when there's a new picture written to disk and it's probably less expensive resource wise than whatsapp / telegram / imessage checking for new messages periodically don't you think? I think if they don't royally fuck the process up or turn it into some idiotic fake way of getting the cops whatever paperwork they need to force you to give them access to your files it's a good thing.

swiley 5y ago

Facebook has no business being an app at all.

kmeisthax 5y ago

The only problem I have with it is that the entitlement system controls both what you can submit to the App Store as well as what you can locally compile and install. For example, you can't locally develop a VPN app until you ask Apple permission to develop a VPN app. Almost certainly this is to appease China, which I find particularly egregious. Fonts also require an entitlement, but I'm not sure if it's just something you need a paid dev account for or if you need to specifically grovel to Apple as to why you need it. I doubt "I want to submit a pull request to iSH" would be considered a valid reason (but correct me if I'm wrong). Even things like camera access in multitasking views are entitlements that your dev account needs to be preapproved for. In fact, it wasn't even something that Apple even publicly mentioned for a while - only Zoom had it until someone reverse-engineered their app bundle and found out about it.

shuckles 5y ago
Didn’t that get hardened in response to the Onavo revelations? In particular, Facebook was using their developer certificate to sign spyware installed via MDM. I don’t remember it being a requirement from the beginning, even though China has tightly regulated VPNs for a long time.
- upbeat_general 5y ago
  Honestly I see no issue with facebook being allowed to do this. If someone pays me to install spyware on my desktop, nobody complains that we should remove the ability to run as root.
jackson1442 5y ago
> For example, you can't locally develop a VPN app until you ask Apple permission to develop a VPN app. Almost certainly this is to appease China, which I find particularly egregious. Can't you manually add a vpn without an app? I haven't needed to configure this myself but presumably if you're bundling your own vpn app you can do the manual configuration in settings which is significantly easier.
- 5y ago