Hacker News Reader

Comment by chpmrc | Hacker News Reader

Did you even read the article? It clearly shows that all that's being sent to Apple is some opaque info about the dev certificate used for the app(s).

View on HN

Which is still sufficient information to narrow down to the set of applications developed by a single entity. And because this is being done over HTTP, anyone along the network chain has visibility as well.

Agreed, this should be sent encrypted, obviously. My point was that the intent here might not be to "snoop" on users, as even the author points out by comparing his analysis with what Jeffrey Paul's article reported ("[...] that’s quite an important difference on a privacy perspective") but likely to efficiently handle certificate revocation. Hopefully they will find a better way.

It's called plausible deniability and it's how frog is being boiled slowly.

It clearly shows that Apple is getting fed the dev certificate info for each application being launched.

For developers with multiple applications, then sure, that's not going to be as clear as individually identifying the application.

But there are plenty of developers around with just one popular application. Sending the dev certificate for them is effectively the same as sending the application hash itself.

They already know they exist (they sign them) and most of those are downloaded via the AppStore (they run that) and people tend to log in using iCloud (which they own).

I get it, we're all supposed to trust nobody and have 7 billion independent islands where you don't have to trust anyone or work with anyone.

I have not seen any solution, just people piling on. Having PKI and signatures using a central authority is the least-worst solution we have right now, and until something better is created we don't really have a lot of places to go (unless we accept downgrading common user's security and usability).

I'm not sure what you're getting at. ;)

"They already know they exist ..." doesn't really seem to match up? Like, of course they do.

Anyway, I was just pointing out that the communication still seems pretty close to sending Apple the list of applications being run. At least, for applications created by dev's with only one major program for their certificate.

A solution would be allowing the user to turn this off. And more importantly, to allow firewall apps to manage all network traffic instead of excepting apple's.

So opaque that this journalist figured out what it is and what it stands for in a few hours.

Reply on news.ycombinator.com