Hacker News Reader

Comment by amelius | Hacker News Reader

The problem here is the tight integration by Apple: the app and the networking services are implemented by the same company.

I'd be ok with an app by a third party which does not automatically gets network access on my phone explicitly or implicitly, so I know my data doesn't leave my phone.

View on HN

Has there been any indication that health data and the associated sensitive information are leaving the device without the user's consent? They would run afoul of quite a lot of laws and regulations in all western jurisdictions the moment they do that.

AFAIK, except when you enrol in a study, none of that depends on network access.

When there is an indication, then it's already too late.

The trust you have in the system is not the trust I have.

Well yeah, but without observable facts, this is just wild guesses or paranoia. Considering the regular news about weaknesses in anything from Safari to iMessages, I have a really hard time taking these claims seriously. The storage and processing of health data is documented, and they do not leave the device or the Secure Enclave (unless you accept it, e.g. during a study).

> Well yeah, but without observable facts, this is just wild guesses or paranoia.

Not at all. What you are saying is that you don't want to lock the front-door because nobody has illegally entered your house yet. In contrast, I want to lock my front-door for obvious reasons. No paranoia. It's just a different mentality of dealing with security.

According to a security researcher[1], a 0-day in Analyticsd allowed any installed app to access the users health data.

[1] https://habr.com/en/post/579714/

EDIT: Found the link to the previous HN discussion about this: https://news.ycombinator.com/item?id=28637276

the health and PII data making its way to log data may give Apple legal cover to ingest the data "accidentally", also.

Recall that Google got to claim their street view cars wardriving was unintentional, and just paid $13M to make it go away, after using the data for about a decade [1]

https://www.cnn.com/2019/07/22/tech/google-street-view-priva...

Your wish wouldn’t work on iOS. Apple hasn’t so far focused on adding Internet access permission. Every app on the device gets access to the network by default. There is no way to stop one app from accessing the Internet while allowing others.

I remember reading about a guy who got FreeBSD's "pf" working on an iPad. MacOS used to (still does?) ship with it. They could do it, they just don't want. They'd certainly never let you be the admin of it and block the gazillion telemetry requests they make back to themselves.

Sorry to use the phrase but this sucks. I feel like companies are too much focused on pushing shiny stuff while forgetting about basic security features.

Reply on news.ycombinator.com