6 ms·
> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN co
by nb_key 4y ago
> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark
- khana 4y ago
- RetpolineDrama 4y agoWallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.
- jaywalk 4y agoI don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.
- tablespoon 4y ago> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. One reason is that GPS doesn't work well (or at all) indoors, through cell-tower geolocation should work well enough for that case.
- thelopa 4y agoA compromised device can send a false location or the user may have disabled location. Geolocation has relatively predictable failures.
- bierjunge 4y agoGPS can be easily spoofed. Back in the university days, we (me + a few friends) used to get some radios and antennas to create a signal stronger than the one coming from satellites. It was always fun when the semester started and all freshmen were using Google Maps to navigate through the campus, but the map always showed their location in North Korea. Good ol' times.
- pphysch 4y agoI thought GPS worked by triangulation? How did you use one transmitter to specifically misdirect receivers to believing they were in North Korea?
- ballenf 4y ago> some radios and antennas Still an impressive feat.
- zikduruqe 4y agoI'm calling shenanigans. I used to work in a lab where we had GPS repeaters to test consumer equipment. That alone costs big bucks. And, we had the FAA come down on us big time, because our GPS repeater broadcast outside the building too far and we got into some hot water. If you were spoofing GPS campus wide over 1.544 GHz and had all your GPS sentences correct, with simple radios and antennas... and you hadn't got in trouble with Uncle Charlie or the FAA....
- imwillofficial 4y agoSpoofing GPS is trivial. Getting caught or not is a toss of the coin
- zikduruqe 4y agoCheating the location on my phone is gravy. Broadcasting an RF signal to spoof GPS (and especially across a campus), that my friend, is not trivial or cheap.
- mritzmann 4y agoFraud detection happens on the server side. The IP address is more reliable than GPS, because the client can fake GPS at any time.
- rosnd 4y agoBut Apple Pay doesn't require internet (on the phone).
- culturestate 4y ago> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. I don't think contactless Apple Pay actually uses device geo[1] for authorization, but it's still worth noting that iOS devices without cell connectivity (ie WiFi-only iPads) don't have GPS anyway. You can use Apple Pay on websites in Safari, though, which IIRC doesn't require location permissions to work. 1. You have to be able to use it in the same places you'd use a normal card, which means you can't rely on network connectivity of any kind.
- ev1 4y agoSome Visa cards do [1] now, https://pbs.twimg.com/media/FQyVcUHXEAMSKbt?format=jpg&name=orig https://pbs.twimg.com/media/FQyVcUHXEAMSKbt?format=jpg&name=... and can refuse authorisation if it's not sent. Apple's statement was "to prevent the sharing of fraud prevention assessments with your payment card network, you may select another card". I removed my Visa cards from Apple Pay.
- culturestate 4y agoI’d never come across that before, but quickly looking at the statement from Apple it seems like this only applies to browser and in-app purchases, not contactless transactions where you’re using your phone in lieu of a physical card: "For cards with certain enhanced fraud prevention, when you attempt an online or in-app transaction, your device will evaluate information about your Apple ID, device, and location (if you have enabled Location Services), to develop fraud prevention assessments, which are used by Apple to identify and prevent fraud."
- exabrial 4y agoI disagree completely. * first, a purchase shouldn't require an internet connection. Humans have been doing commerce for millennia without it, and we have sophisticated pub/priv key schemes to figure this all out. * second, it's a security hole. It's either a VPN or it's not.
- VortexLain 4y agoIsn't it only matters what payment terminal bank's country is?