4 ms·
Possibly relevant comment from a few years ago: https://news.ycombinator.com/item?id=26893693 https://news.ycombinator.com/item?id=26893693 >AirDrop also share
by keane 11mo ago
Possibly relevant comment from a few years ago: https://news.ycombinator.com/item?id=26893693 https://news.ycombinator.com/item?id=26893693
>AirDrop also shares your full name (seemingly the one associated with your Apple ID, not what you have set for yourself in your contacts), both by displaying it in the sharing interface on the involved devices and by attaching it as an extended attribute to uploaded files.
>So if you AirDrop some files to your computer and then zip them up, anyone you send that zip to (a journalist, a public file-hosting site, w/e) will have your full legal name to go with them.
Linked article from that thread is moved to https://medium.com/@kieczkowska/introduction-to-airdrop-forensics-b5076a2962da https://medium.com/@kieczkowska/introduction-to-airdrop-fore... (but is archived).
I wonder if Google is adding metadata as well. Otherwise there does seem to be the problem of, for example, threats being AirDropped in a public place.
- hoherd 11mo agoUsing macOS 26 and iOS 26 I was unable to reproduce their findings. I airdropped a photo from my iOS device to my laptop, and nothing in `mdls`, `xattr -l`, `exiftool -s`, `rg -i` showed my name.
- lathiat 11mo agoIt wouldn't surprise if Apple had fixed this, it's the sortof thing they would fix, but it may be worth trying with 2 devices not from the same iCloud account. Wouldn't surprise me if the code paths were subtly different in that case.
- quitit 11mo agoThey would seem to contain identifiers as law enforcement have been able to follow up on instances where there has been airdropping of perverse images, but as noted by others the files don't include names. The problem with airdrop (and likely why the 10 minute setting now exists) is that it includes a preview image as part of the notification request. So other than being able to subject someone to perverse images, preview images have also been used in state-sponsored zero-click attacks to infect the phones of their targets. While that vector seems to be muted for now, the 10 minute setting provides a layer of defence against both potential future zero-clicks and receiving unsolicited previews images.
- NaomiLehman 11mo agoJust a tip - You can put any string as your name for your Apple ID. you can also change it at any time. I have it as Mac Book. It's not checked when making any credit card payment, AFAIK.
- buildbot 11mo agoIs anything but the zip code actually checked ever? Besides the number and cv2 or whatever.
- justsomehnguy 11mo agoNumber, date (though I never bothered to check if it's actually checked, besides stupid frontend shenanigans when I couldn't enter it because it had a whole whooping month ahead of the current date) and CVC. As soon as I learned what BANK NAME is acceptable name I used it almost everywhere.
- dizzant 11mo agoI’ve never heard of this. Are you saying I could enter “MyLocal Bank” as the payer name instead of my own when transacting online with a credit card? This seems like the kind of fact that should be essential privacy knowledge if true!
- justsomehnguy 11mo agoWell, try it. But don't blame if some over zealous merchant would deny you without refund despite receiving you money.
- jeromegv 11mo agoThis might not work super well if your package is crossing border either. Sure it's your billing address and not your shipping address, but sometimes they are all the same.
- 11mo ago
- rsync 11mo ago"... then zip them up, anyone you send that zip to (a journalist, a public file-hosting site, w/e) will have your full legal name ..." A bit of a leap to assume that your Apple ID (or the name you give your iphone) is your full legal name ... or related to any name at all ... My apple ID is built specifically for just that phone and is jettisoned when I upgrade/change the phone. The apple ID is not related to my own name. I don't consider this an aggressive - or even interesting - privacy practice. Did you use your full legal name when you signed up with Blizzard for WoW ? Why would you do anything different for Apple ? They are not the IRS. They are not a passport agency. They are not the government. Stop treating them that way.
- paranoidrobot 11mo agoIf you're someone who's bought into the Apple ecosystem over multiple devices, or ave a partner or children who are also using devices in the Apple ecosystem, then your Apple ID is something that is very definitely tied to you and probably difficult to change/give up when you replace your phone. I don't think it would be at all surprising to find that the vast majority of people use their legal name or something closely associated with their identity, and that it persists over multiple devices.
- niek_pas 11mo agoAs defensible as it may be, your behavior is very far from the norm. You may not consider this a aggressive privacy practice but demographically speaking, it absolutely is.
- jamwil 11mo agoSo you repurchase your entire App Store library when you upgrade your phone?
- 1718627440 11mo agoDo other file systems even support the extended attributes from Apple?
- kccqzy 11mo agoWhen you create a ZIP, the extended attributes are saved to separate files. When you copy them to a FAT filesystem they are also saved to separate files.
- 1718627440 11mo agoInteresting, but now this information is no longer attached to the original file and you need to manually include it, when distributing the file. Also it is now kind of obvious, that there is not only the file itself in the ZIP file.
- kccqzy 11mo agoIt’s not obvious if you are only using macOS, because macOS hides all of these extra files it creates. It’s only obvious if you use Windows or Linux. But of courses the chances of a typical macOS user also using Windows or Linux is very low.
- 1718627440 11mo agoDo packager programs on macOS lie about the packet contents? Otherwise the user will see it when opening the packet. The user needs to be aware of metadata when leaking stuff, e.g. EXIF data for images, non-deleted text in Word, overdrawn stuff in SVG, etc. anyways.