Hacker News Reader

Comment by sneak | Hacker News Reader

As the one who originally publicized the fact that Apple was leaking users' app launch data like this, I was surprised that they even committed to fixing it.

I was doubly surprised when they failed to follow through; it is unlike Apple to lie.

Note also that the link to my site in the first part of TFA is to the wrong article; the OCSP issue is related to app launches ("Your Computer Isn't Yours"), not the fact that each Mx macOS update phones home a) in plaintext and b) with hardware unique identifiers (your ARM's ECID) on every single OS update (this is TSS, not OCSP). This allows passive listeners to sniff your unencrypted HTTP TSS traffic that contains your system's unique ECID, and, via client IP geolocation, infer your travel/location history unless you remember to always update over a VPN.

Different types of bad plaintext phone home APIs. Apple uses at least 2: OCSP and TSS. :)

View on HN

Here is a thing. The endpoint gs.apple.com already supports HTTPS (and on port 433). In fact, a new cert was issued to that endpoint on 23rd Feb 2022 -- before the date of your article. Something was already afoot before you wrote about it. This new cert also contains a custom OID, which could be used for pinning.

It is possible, with an http proxy / pihole to upgrade all of your local network connections to https when speaking to gs.apple.com.

My guess is that a change is coming, but the pieces aren't all in place yet.

So I decided to look at the code that implements talking to gs.apple.com on my Mac. It already supports using TLS. If I am reading this correctly, there are ways it could be enabled right now. Out of respect to Apple; as they are clearly not yet ready to enable this for everyone, I am declining to say how.

> each Mx macOS update phones home a) in plaintext and b) with hardware unique identifiers (your ARM's ECID) on every single OS update

Question about this article: At what point exactly during the update process does this happen?

As a workaround, could one do softwareupdate --download from Terminal, turn off your internet connection, and then do softwareupdate --install?

It's easy for the os to stack up the updates and the push everything once the network is back up.

See:

https://sneak.berlin/20210202/macos-11.2-network-privacy/

No, the machine (if set to full security) needs a signed ticket from Apple specific to your hardware (ECID) to run. It's just like an iPhone/iPad in that regard. Disabling the internet means the update will fail.

Remember TinyUmbrella and backing up your SHSH blobs so that you could downgrade to previous OSes? It's that same API.

https://www.theiphonewiki.com/wiki/Tatsu_Signing_Server

> No, the machine (if set to full security) needs a signed ticket from Apple specific to your hardware (ECID) to run.

Thanks. I see now that it's somewhat documented by Apple, except the plaintext aspect. So it seems that "Reduced Security" would be the workaround.

https://support.apple.com/guide/security/startup-disk-securi...

I love Apple hardware, it's top notch truly but I am eager to completely remove macOS over privacy concerns. If Apple is taking privacy seriously, and advertising that, it needs to be across the board. I don't appreciate being lied to.

Shoutout to the Asahi Linux team and Godspeed.

I still need Lightroom and Mail.app. I solicit replacements for either. Darktable and Thunderbird ain't it.

Reply on news.ycombinator.com