17 ms·
macOS scanning and following downloaded QR codes has been retracted
- johnklos 4y agoIt's nice to see people clarify when they make mistakes. I'm still REALLY curious about the Facebook useragent. Where was that from, specifically? Firefox?
- Operyl 4y agoA lot of applications seem to use this user agent because a lot of sites were providing embed data only to this user agent. Bizarre, but a needed evil I guess.
- _23sd 4y agoYes, I just tried it and apparently Firefox on iOS uses that user agent when it gets a thumbnail of a page for its "Recently Saved" and "Jump Back In" sections on the new tab page.
- yjftsjthsd-h 4y agoThe retraction is that it's not the operating system doing it. But honestly, Firefox doing the same thing isn't great either. Am I alone in finding it surprising that the recent list actively polls the things on it?
- ale42 4y agoAs far as I understand it, Firefox is not reading QR codes out of images and automatically opening links, but rather reloading already opened URLs that were coming from QR codes. Maybe not ideal, but far better than having the OS scan for QR codes in background and loading them without warning.
- woojoo666 4y agoYeah and if you use a VPN and occasionally rotate IPs, this Firefox "recents" feature can leak your new IP to websites that you previously visited
- Tomuus 4y agoI don't think Firefox was reading any QR codes, but instead was recrawling the link in the "Recents" list on a new tab or bookmarks screen. This is in no way a problem. There is precedent for browsers eagerly loading links, it happens all the time in regular webpages. This is most of the reason why anchors should be safe/side-effect free.
- chrononaut 4y agoPrior discussions (when macOS was presumed at fault): - https://news.ycombinator.com/item?id=33095608 https://news.ycombinator.com/item?id=33095608 (83 comments) - https://news.ycombinator.com/item?id=33096540 https://news.ycombinator.com/item?id=33096540 (102 comments)
- vucetica 4y agoThis community is funny at times. A lot of people had their opinions on those two threads, didn't they? Kudos to the ones who questioned the origin of the phenomenon instead of declaring immediately that the world is falling.
- smoldesu 4y agoIt's equally funny to see the collective sigh-of-relief expressed through this post's upvotes. OCSP is real and can hurt you, warrantless iCloud access still goes un-mitigated, but thank God! The QR code IP leak turned out to be a fake. Who knew MacOS was a nice and private operating system all along?
- derbOac 4y agoSo... I think replication was needed and have a MacBook myself. However, the claim in question was tricky to verify because it was supposedly occuring over the course of days. I also think it says a lot about collective anxieties over not using an open OS. The scanning wasn't happening but it was plausible and there wasn't really much to do about it other than try to verify it. I think the episode says less about collective unwarranted paranoia and more about collective vulnerabilities. I still am scratching my head about the new tweet though. It doesn't say the scanning isn't happening, just that it's not MacOS.
- zimpenfish 4y ago> The scanning wasn't happening but it was plausible I didn't think it is plausible which is why I set up a whole bunch of replication scenarios to verify the extraordinary claim. > It doesn't say the scanning isn't happening, just that it's not MacOS. I think it's clear that the scanning isn't happening and that it was just Firefox refetching something? "I now believe the canary token was triggered [...] by Firefox’s “recent” shortcuts on the home screen"
- zimpenfish 4y agoOne of the quicker cycles of "extraordinary claim" to "retracted" I've seen recently.
- rnjesus 4y agoincite rage with anti-apple sentiment -> get twitter followers and engagement admit you were wrong and made it all up -> get people to ‘respect’ you and even more twitter followers
- imwillofficial 4y agoI wouldn’t say that’s a fair characterization. Besides the ham fisted approach, the original vuln idea seemed reasonable. They were wrong, it happens to the best of us. I’d say the potential security risk was worth raising the flag over. Better be wrong and safe, having many of us learn something along the way, then overly cautious and leave a potential problem unaddressed.
- zimpenfish 4y ago> then overly cautious and leave a potential problem unaddressed. I don't think "do even the most cursory verification to check if the extraordinary thing I've just seen is actually happening" could be counted as "overly cautious".
- imwillofficial 4y agoAs somebody in the security field tackling this stuff every day, I am happy with the tradeoffs made, and the resolution.
- maliker 4y agoGreat job by the author for looking more closely and clarifying this was not an issue.
- 4y ago
- bink 4y agoI hope the Apple security team that was assigned to investigate this report is enjoying a nice beverage tonight. Dealing with unconfirmed critical security reports with few details can be a nightmare, especially when they turn out to be unfounded. Good practice for the real thing, though.
- gw99 4y agoThis stuff happens all the time. A few years back a company I was contracting for had one of their end users report a high severity security defect. Apparently he signed into the app and thought he had been hacked because a couple of large 6-figure transactions had been made. After several hours of inconclusive investigation where even identifying the user proved difficult, this turned out to be him seeing the marketing example screens in the app store and having a panic. The app never even got installed and he never signed up for it. The marketing screens were quickly updated to show something less impressive and with a sample data only warning...
- Exuma 4y agoI wonder how big of a company you'd have to be to go through all the effort of changing marketing screens because of that. I can think of the biggest company I've worked for laugh at that and move on.
- Arrath 4y ago> The app never even got installed and he never signed up for it. ....that is some serious "My computer won't turn on. No I can't check to see if the power cord is plugged in, its too dark to see back there because the power is out." energy.
- Waterluvian 4y agoI’m quite curious to be a fly on the wall where the decision was made to accommodate the lowest common denominator. Why wouldn’t he just be dismissed rather than wasting hundreds or thousands of dollars of employee time? By chance could you illuminate the thought process?
- vestrigi 4y agoGlad I saw this and now I wonder how often something turns out to be false and then we don‘t happen to read about the retraction. Next we incorporate the false information as facts into discussions with other people. I mean, I‘m worried enough about infosec that I had enough interest to read the story but then I wouldn‘t have returned to look further into the story, eventually finding out it was false. Instead I‘m just lucky to have checked out HN once again today.
- regularespresso 4y agoHow embarrassing for this man of many titles and authorities, to have his reputation upended by a foolish and avoidable false accusation. A slice of humble pie sticks in the throat, so it is heard.
- draconpern 4y ago
- prmoustache 4y agoI am curious to know why someone would tweet something like that before trying it in a lab with a freshly installed VM.
- renewiltord 4y agoLOL most predictable thing in the history of time. Made for clickbait for a gullible audience, though.
- rognjen 4y agoThis situation reminds me very much of "Facebook is listening to everything you say" that pops up every couple of weeks.