4 ms·

FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecti

FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecting SSIDs which can then later be correlated to locations). If there is an entitlement, it is as of yet unclear whether it means a consent dialog/privacy toggle or not. IIRC an entitlement only means you can ask for this sort of access, not get it automatically, but I may be wrong (I’ve never gotten far in iOS dev). We can argue that this feature is misnamed, regular users will not understand what it is and would not be giving informed consent, and I can get behind that, but “automatic access to my private data on my device” looks like jumping to conclusions.

stavros 3y ago
Hm, I assume any app can ask for whatever it wants, but that's just an assumption. I don't know if app developers need to apply to be able to request permissions, but I don't own an iPhone.
- MBCook 3y ago
  Certain things require permission from Apple to be able to even use. The API in question here is one of them. Other things are just available to any developer but have to have a user prompt, for example saving to the photo library.
- anileated 3y ago
  I was remembering when trying out iOS development years back that entitlements were needed for many things and the ones I tried involved a consent screen. From looking at https://developer.apple.com/documentation/bundleresources/entitlements https://developer.apple.com/documentation/bundleresources/en... I would say there are many more entitlements than consent screens, the phrasing suggests there is no 1:1 mapping between them and is not clear on whether they reliably come with consent screens (I suspect not). It is very unfortunate that there is little clarity on that in the docs, and that entitlements are not exposed anywhere in the GUI. Sure, they are too technical, but they could at least be shown in some advanced info pane. I am seriously considering if I can dejail an old iPhone and perhaps inspect some big name apps for what they have been entitled to.
gruez 3y ago
> FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecting SSIDs which can then later be correlated to locations). Is that what "local network access" means? I thought that was for controlling network connections to LAN ips and/or to send multicast packets (eg. mdns).
- anileated 3y ago
  > there was a VPN app I used that didn't have the "local network access" permission, but was still inexplicably able to get a list of wifi networks I connected to It is different from continuously getting a list of all SSIDs within your Wi-Fi range, even those you never connected to. This is what allows shady apps infer location (this, and massive databases of SSID matched to coordinates). What you described is also a feature of WireGuard iOS, and it needed no permission.
  - lxgr 3y ago
    As far as I can tell, Wireguard does it the other way around (i.e. you provide it with a list of SSIDs you want to always enable VPN for, it provides that to the OS, and the OS then only tells the VPN that it needs to get connected). But according to this [1] post (by an Apple employee?), having an enabled VPN profile seems to indeed be opting the app in to receiving the current SSID without the location permission, at least for some time and since iOS 14. [1] https://developer.apple.com/forums/thread/679038 https://developer.apple.com/forums/thread/679038
    - anileated 3y ago
      I may have mixed up WireGuard versions, it does it on macOS but doesn’t on iOS (or this feature was removed). Either way, being able to get a list of networks user connected to is unrelated to the feature under discussion.
lxgr 3y ago
That’s not what that permission does. As mentioned in TFA, SSID scanning access requires an entitlement (granted by Apple), not a permission (granted by the user).
- anileated 3y ago
  You are misunderstanding what entitlements are. An entitlement does not imply no consent from the user, in many cases all it gives is the ability to ask for that consent.

stavros 3y ago

Hm, I assume any app can ask for whatever it wants, but that's just an assumption. I don't know if app developers need to apply to be able to request permissions, but I don't own an iPhone.

MBCook 3y ago
Certain things require permission from Apple to be able to even use. The API in question here is one of them. Other things are just available to any developer but have to have a user prompt, for example saving to the photo library.
anileated 3y ago
I was remembering when trying out iOS development years back that entitlements were needed for many things and the ones I tried involved a consent screen. From looking at https://developer.apple.com/documentation/bundleresources/entitlements https://developer.apple.com/documentation/bundleresources/en... I would say there are many more entitlements than consent screens, the phrasing suggests there is no 1:1 mapping between them and is not clear on whether they reliably come with consent screens (I suspect not). It is very unfortunate that there is little clarity on that in the docs, and that entitlements are not exposed anywhere in the GUI. Sure, they are too technical, but they could at least be shown in some advanced info pane. I am seriously considering if I can dejail an old iPhone and perhaps inspect some big name apps for what they have been entitled to.

gruez 3y ago

> FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecting SSIDs which can then later be correlated to locations). Is that what "local network access" means? I thought that was for controlling network connections to LAN ips and/or to send multicast packets (eg. mdns).

anileated 3y ago
> there was a VPN app I used that didn't have the "local network access" permission, but was still inexplicably able to get a list of wifi networks I connected to It is different from continuously getting a list of all SSIDs within your Wi-Fi range, even those you never connected to. This is what allows shady apps infer location (this, and massive databases of SSID matched to coordinates). What you described is also a feature of WireGuard iOS, and it needed no permission.
- lxgr 3y ago
  As far as I can tell, Wireguard does it the other way around (i.e. you provide it with a list of SSIDs you want to always enable VPN for, it provides that to the OS, and the OS then only tells the VPN that it needs to get connected). But according to this [1] post (by an Apple employee?), having an enabled VPN profile seems to indeed be opting the app in to receiving the current SSID without the location permission, at least for some time and since iOS 14. [1] https://developer.apple.com/forums/thread/679038 https://developer.apple.com/forums/thread/679038
  - anileated 3y ago
    I may have mixed up WireGuard versions, it does it on macOS but doesn’t on iOS (or this feature was removed). Either way, being able to get a list of networks user connected to is unrelated to the feature under discussion.

lxgr 3y ago

That’s not what that permission does. As mentioned in TFA, SSID scanning access requires an entitlement (granted by Apple), not a permission (granted by the user).

anileated 3y ago
You are misunderstanding what entitlements are. An entitlement does not imply no consent from the user, in many cases all it gives is the ability to ask for that consent.