4 ms·

As opposed to the computer you've set up to trust? MITM is a vector for either.

• scarface74 4y ago
  You might have set your computer to trust. But there is nothing stopping someone else from making your phone think it’s a trusted computer. That’s the entire point.
  • gruez 4y ago
    > But there is nothing stopping someone else from making your phone think it’s a trusted computer. That's non-trivial because the computer that you've trusted identifies itself to the iphone cryptographically.
    • scarface74 4y ago
      That’s just the issue. There is a security issue on the Mac side that doesn’t make it possible to securely identify itself and it can be spoofed. https://theevilbit.github.io/posts/cve-2022-32929/ https://theevilbit.github.io/posts/cve-2022-32929/
      • gruez 4y ago
        The exploit in question doesn't "spoof" anything. The iphone is still talking to the same computer, that part hasn't been bypassed. You can't use this exploit to plug an iphone into a new computer and make a backup. The only thing that changed is that previously the iphone could be assured that random apps on the computer couldn't access the backup data, but now it couldn't. However, I don't think this difference is meaningful. For one, you could bypass TCC by whitelisting apps, unbeknownst to the iphone, so there's no real expectation that the backup data is kept 100% confidential. Furthermore, iphones could be backed up to windows machines, which don't have such protections at all.