5 ms·
Apple Reneged on OCSP Privacy
- post_break 4y agoLittle Snitch is still one of the most powerful apps I run. I wish I could run it on my iPhone. When the OCSP thing went down I was livid. This still pisses me off.
- wfhordie 4y agoDoes Apple offer “offline” versions of their updates in DMG form?
- my123 4y ago> Does Apple offer “offline” versions of their updates in DMG form? .app bundles, but only full updates not deltas. When using Reduced Security instead of Full Security, online verification through TSS isn't necessary to install/update an OS.
- samtheprogram 4y agoSince High Sierra (released 2017), their documentation points to the App Store installer links instead of to DMGs [1]. It’s still possible to create a DMG installer for newer versions using createinstallmedia on the command line after downloading the installer to a Mac. [1]: https://support.apple.com/en-us/HT211683 https://support.apple.com/en-us/HT211683
- deleted 4y ago[deleted]
- novok 4y agoYou still need activation / authorization from apple of your device when doing a clean wipe.
- nixpulvis 4y agoAnyone want to make Apple Butter? Please send help.
- OrvalWintermute 4y agoIs the only way to mitigate this to jailbreak the device, edit the /etc/hosts to remap the DNS and point it at your own OCSP caching similar to what is done for airgaps and ICS/SCADA, or could you do this through 3rd party DNS apps, or an iOS VPN profile?
- saagarjha 4y agoThis is for macOS.
- OrvalWintermute 4y agoSounds like >edit the /etc/hosts to remap the DNS and point it at your own OCSP caching similar to what is done for airgaps and ICS/SCADA would be fairly easy fixes.
- cglong 4y agoMost of this is a quote taken from https://lapcatsoftware.com/articles/ocsp-privacy.html https://lapcatsoftware.com/articles/ocsp-privacy.html
- dang 4y agoDiscussed a few days ago: Apple Reneged on OCSP Privacy - https://news.ycombinator.com/item?id=31731090 https://news.ycombinator.com/item?id=31731090 - June 2022 (7 comments)
- sneak 4y agoAs the one who originally publicized the fact that Apple was leaking users' app launch data like this, I was surprised that they even committed to fixing it. I was doubly surprised when they failed to follow through; it is unlike Apple to lie. Note also that the link to my site in the first part of TFA is to the wrong article; the OCSP issue is related to app launches ("Your Computer Isn't Yours"), not the fact that each Mx macOS update phones home a) in plaintext and b) with hardware unique identifiers (your ARM's ECID) on every single OS update (this is TSS, not OCSP). This allows passive listeners to sniff your unencrypted HTTP TSS traffic that contains your system's unique ECID, and, via client IP geolocation, infer your travel/location history unless you remember to always update over a VPN. Different types of bad plaintext phone home APIs. Apple uses at least 2: OCSP and TSS. :)
- lapcat 4y ago> each Mx macOS update phones home a) in plaintext and b) with hardware unique identifiers (your ARM's ECID) on every single OS update Question about this article: At what point exactly during the update process does this happen? As a workaround, could one do softwareupdate --download from Terminal, turn off your internet connection, and then do softwareupdate --install?
- callmeal 4y agoIt's easy for the os to stack up the updates and the push everything once the network is back up. See: https://sneak.berlin/20210202/macos-11.2-network-privacy/ https://sneak.berlin/20210202/macos-11.2-network-privacy/
- sneak 4y agoNo, the machine (if set to full security) needs a signed ticket from Apple specific to your hardware (ECID) to run. It's just like an iPhone/iPad in that regard. Disabling the internet means the update will fail. Remember TinyUmbrella and backing up your SHSH blobs so that you could downgrade to previous OSes? It's that same API. https://www.theiphonewiki.com/wiki/Tatsu_Signing_Server https://www.theiphonewiki.com/wiki/Tatsu_Signing_Server
- stalfosknight 4y agoIt could just be that they are still working on implementing this in a future update, maybe a minor update to Ventura. I would imagine the software engineering team has its hands full every summer with more important things like readying major new versions of all of their platforms.
- grishka 4y agoHow much work could it possibly be to add one setting and a corresponding if statement?
- stalfosknight 4y agoPriority as dictated by business needs rather than raw work effort is usually what determines when things get done. At least on my team.
- fartcannon 4y agoSecurity and privacy isn't a priority. Got it.
- lapcat 4y agoThey said "over the the next year" in November 2020. It's now June 2022. It should have been in Monterey, which shipped October 25, 2021.
- stalfosknight 4y agoDoes everything always go to plan in your workplace? No one has a crystal ball and sometimes priorities get rearranged after the fact.
- lapcat 4y agoExcept it wasn't just a private plan: Apple made a public written statement about the timeline, in response to a disaster (the Mac "appocalypse") and the resulting public criticism. So this should have been a very high priority.