Source: MITM your iOS traffic.
Sidenote -- a possibly unforeseen side effect of end to end encryption everywhere is that it makes it far more difficult to man in the middle your traffic and hold companies accountable for their privacy policies.
You can turn it off from Settings > General > Spotlight Search. Uncheck "Spotlight Suggestions" and "<Default search engine> Web Results".
The "About Spotlight Suggesstions & Privacy" link at the bottom of that settings page gives you instructions on how to do it too.
I don't think it's an unforseen effect, but one that is highly downplayed by advocates pushing the security angle. When it was revealed that smart TVs phoned home with detailed viewing information, including filenames, I remember making a similar comment - if they had used TLS, that discovery might not have occurred.
The ability to MITM your own devices is very important, if only so you can figure out exactly what they're sending out.
Another thing is the widespread use of enforced code signing, accompanied by pinning to specific (e.g. MS) CAs; if this had happened a decade or more ago, it would've been pretty easy to pinpoint the parts of the OS responsible and just patch them out. Now the same thing is likely still possible (theoretically, as long as you can change any byte on the disk it is), but involves plenty of bypassing other protection mechanisms on the way and could get pretty hairy if hardware is involved (e.g. secure boot/TPM.) From this perspective, remote attestation and the other upcoming security technologies are immensely disturbing. The desktop PC ecosystem is gradually being locked-down in the same way that mobile is.
These security mechanisms certainly have benefits, but their goal is ensuring that your software is completely unchanged from what the author wants you to have; in situations like these, that is precisely what you don't want. Nevertheless, I hope the hackers/crackers out there find a solution so those that are forced to use Win10 can still retain some privacy.
Unfortunately, given how many in this very thread are willing to apologize for MS's behavior and justify their power grabs, I don't expect there will be much resistance in this War On General Purpose Computing.
In general, as long as you have root access to a machine, you can decrypt any traffic coming out of it, either by locating the private key in the filesystem or memory, or by patching the encryption methods to skip the encryption step.
If you do not have root access to a machine, and software on it signs traffic with a certificate you do not have access to, then you simply cannot see the traffic. If you ask me, that's a huge problem, especially when coupled with the "locking down" of ecosystems that you describe.
The skeptic in me wonders if the same entities pushing the privacy agenda are the same ones with vested interest in encrypted traffic that phones home.
It will even ignore a-0001.a-msedge.net in your hosts file.
Most people, even most developers seem to be pretty clueless with this stuff.
Please name and shame, this sounds pretty surprising!
There are several banking-related apps listed here.
Highly recommend any material on the main site as well. One of the few legit infosec professors I have ever interacted with.
> Altogether, of the 639,283 [Android] apps in our data-set, 45 implement pinning.
[1]: https://www.usenix.org/conference/usenixsecurity15/technical...
No. No application or OS should impose it's own CA on an end user without choice. I get the importance of encrypted traffic flowing over the internet, but I also have concerns about traffic leaving my own network. Neither at my home or my business do I want an encrypted stream of traffic flowing out of my network without my being able to inspect the contents and know who the recipient is.
For example, you may leak information about sites recently visited, updates applied, etc. if you have a local proxy cache and subsequently look at response timings.
The platform should hopefully be 100 % trustworthy (from an "it's free software so I can inspect it" point of view), as long as you do not choose to use a non-free graphics driver.
1. https://blog.torproject.org/blog/mission-impossible-hardenin...
The convenience of one device is a big sell though, plus I think a device with a built in cellular modem is more fairly called a "phone".
It reminds me of the argument that "of course NSA spies, that's what it does" completely merging together the spying on dangerous targets for national security with the spying on every single person on Earth and for economic, blackmail and so on purposes. Reality is more nuanced than that.
That depends on what you mean by privacy. We share information, sometimes sensitive information, with other parties all the time when we interact with them. I believe the essence of privacy is more about being able to choose when and how and for what purposes information is collected and shared and used.
I can't make a purchase using a credit card without the card company at least knowing who I'm paying and how much money I'm giving them. There's not much point going to see a doctor if you're not going to discuss your medical situation with them. If I go out to visit friends, someone passing me in the street is going to know where I am at that moment in time. That doesn't mean anyone else needs to know any of those things, or that they need to be used for other purposes or correlated with other data.
In any case, with a lot of information sharing that is going on with software and networked systems these days, it is far from clear that many of those "potential optimizations" are actually in users' interests at all. Obviously some facilities do need to analyse relevant data sets to make useful predictions -- personal assistants like Siri and Cortana, say, or recommending new material that is similar to what you've accessed before on Amazon or Netflix. But even there, the limitation is often that the technology isn't powerful enough to do the same things locally yet, not that the organisations running these services inherently need to know lots of data about you.
This is the core of the EU data protection principles. It's a very concise way of expressing things. There are two limitations:
- figleafing: the "cookie law" problem where everyone is made to agree to a useless dialog box, supposedly signing away their privacy in order to look at any web page with ads on
- it conflicts with the very strong American free speech principles, in which you can say anything you like about anyone on any basis. Privacy enforcement necessarily means silencing people talking about other people. The bad end of this is UK libel law. It's still present in the US "product libel" laws, although fortunately "ag-gag" was recently struck down.