5 ms·
Apple bleee. Everyone knows what’s on your iPhone (2020)
- deleted 3y ago[deleted]
- gkoberger 3y agoThere's always a hard balance to strike between security and usability, and it's impossible to get right. It seems that it's less Apple and more Bluetooth that the author is concerned about, and simply turning it off will prevent every issue listed. (And given the point of Bluetooth is to connect with devices around you, it seems reasonable to assume that people with it on would like these connections to happen.) That being said, Apple does have modes which disable these features for people who are worried, including their Lockdown Mode: https://support.apple.com/en-by/guide/personal-safety/ipsd5baf79d0/web https://support.apple.com/en-by/guide/personal-safety/ipsd5b...
- tantalor 3y ago[flagged]
- CharlesW 3y agoI wonder if there have been any changes to this default behavior in the 5 years since.
- upon_drumhead 3y agoWhile the article is full of great insight into the features stated, the title is clickbait and doesn't match the content at all.
- DennisAleynikov 3y agoThe title seemed to match the content pretty well based on my reading. You can get personally identifiable info from an iPhone pretty easily given the methods described
- mullingitover 3y ago> Well, AirDrop seems to be less anonymous than we thought. It's possible to identify you: your phone sends out SHA256 your phone number hash to all the devices around you every time you hit Share. It's wild that this hash isn't salted.
- mcculley 3y agoHow would salting work in this scenario? Both devices would have to share the salt, wouldn’t they?
- gruez 3y agoYou broadcast salt || SHA256(phone number || salt). If you know the original phone number, you can check whether it's a match.
- eknkc 3y agoAnd if you don’t know the phone number you can brute force that pretty easily and it’s all the same. How many bits of enthropy are there on phone numbers?
- deleted 3y ago[deleted]
- l3s2d 3y agoThis doesn't seem any more secure than broadcasting SHA256(phone number).
- judge2020 3y agoAll it does is marginally increase the cost of reverse engineering the sha2. Instead of having a rainbow table of every phone number’s salt, you generate one with that salt whenever you want to get the phone number it broadcasted.
- 3y ago
- theginger 3y agoIf I am understanding the article correctly, this is unpatched and apple haven't even had any warning as they've not disclosed any of this as they didn't consider it a vulnerability (I think I would disagree but haven't fully digested the article) Edit - it's 3 years old I'm guessing they have made some changes since
- CharlesW 3y ago> …[Apple] they didn't consider it a vulnerability… Neither does the author, seemingly: "This behavior is more a feature of the work of the ecosystem than vulnerability."
- theginger 3y agoYes by they I meant the author, I would consider it information disclosure, this data is meant to be private and the designers have made an attempt to keep it that way.
- niemandhier 3y agoSecurity by obscurity never works.
- lostlogin 3y agoThat’s going to be hard to prove.
- ls612 3y agoThe phone number part seems inexcusable but isn’t everything else pretty much necessary for a wireless data protocol like Bluetooth to work?
- AshamedCaptain 3y agoSurprising that Apple can devise an authentication method for the battery that is strong enough to prevent all 3rd party phone repairs whatsoever, but when it comes to wirelessly authenticating another iPhone for purposes of deciding whether to share or not your Wi-Fi password, then there's no check whatsoever...
- CamperBob2 3y agoWow, not salting the phone number before hashing it was a pretty amateur move. Whoever did that made other mistakes... bank on it.
- Arch-TK 3y agoAssuming that there's some functionality by which if you know someone's phone number, you can identify them in some UI, how would you salt this? Do you salt all the phone numbers with the same salt? Do you send out the salt and expect phones to respond with the salted hashes (in which case, how does this achieve anything?). Do you salt based on geographic location? (Again...) Do you make every phone use the same salt and try to hide it?
- eknkc 3y agoWhat would salting do? The sender would need to share the salt anyway. I guess it would eliminate a database of number hashes approach but brute forcing a salted phone number hash should not be a big problem in any case.
- CamperBob2 3y agoSalting would prevent an attacker from being able to find your phone number by hashing every possible phone number in your area code and comparing each hash with what they captured over the air. Or am I misunderstanding something?
- YeBanKo 3y agoSHA-256 is designed to be quick to compute, so with salt and maybe some guessing of area code the march can be found within seconds. For salt to make a difference they’d need to use some intentionally slow hash functions, like bcrypt.
- trifurcate 3y agoYou're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.
- oij3 3y ago[flagged]
- graphe 3y agoTurn off airdrop for non contacts? Turn off airdrop? Pretty misleading of them saying every time you click share instead of share with airdrop everyone can see some info.
- s3p 3y agoYes, very much so. It is also a mass generalization and a complete falsehood when the author makes bold claims like "Gen Z is using AirDrop to cheat". But they seem completely fine with their extremely generous claims.
- eproxus 3y agoMy guess is that the SHA2 of the phone number is used for exactly this feature, so you can accept connections from your contacts only (your iPhone most likely already has a SHA2 calculatedfor each contact phone number) and ignore the rest. Your phone will probably broadcast its hash in that scenario too.
- thih9 3y agoThe article is from 2020 so I’m curious: how much of this is still valid today? Especially: > Broadband BLE requests contain your data, namely, SHA256 hashes of your phone number, AppleID, and email. Only the first 3 bytes of the hashes are sent, but that's enough to identify your phone number Is that a viable way of accessing someone’s phone number in 2023?
- wkat4242 3y agoIt's doable. Out of 100 million numbers here in Spain and 16 million possible 3-byte hashes, there will be 6 possible numbers for each 3-byte hash on average. That's low enough for trial and error.
- parker_mountain 3y agoYes. Brute forcing it takes at most a few seconds on modern consumer hardware. Probably under a second, tbh.
- kmeisthax 3y agoI wish there was an Android app that emulated all these weird Apple ecosystem BLE handshake things. They're kinda nifty.
- pengaru 3y agoWhy is this flagged?
- porkbeer 3y agoVoicing my suspicion will get ny comment flagged as well I suspect, but consider the HN reader base, what they get paid to do, and come to your own biased conclusions like I did. Many here feel that an attack on 'free' data, or a top tech company, is an attack on their livelyhood, and they are correct. Also the article is a bit overblown in many aspects which gives the clickbait anger response. Both, I feel, are valid reasons to flag this, even if I personally think many points in the post remain relevant.