Hacker News Reader

Comment by fishywang | Hacker News Reader

>It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties.

And that's how the pegasus/etc. pwned iPhones

View on HN

It was before the zero day was closed.

so you are saying apple is doing something they already knew is a bad idea?

No. I’m saying your information is outdated and wrong.

What do you mean? The OP said that this is how Pegasus pwned (notice the past tense) the iPhone. That's correct. Moreover while Apple might have closed that specific vulnerability, would you bet your money (or even your live) on there not being other vulnerabilities in the apple indexer?

how can you be so confident that it's "closed"? the last time apple announced the high protection mode for state sponsored targets in new ios (whatever it's called), they disable all auto previews in that mode. if they are as confident as you are that it's "closed" that doesn't seem necessary?

Disabling link previews in high protection mode is more likely to be a combination of not issuing any network requests that could accidentally leak your IP, and being able to see the full URL so link previews can't pretend to be a different site to trick you into clicking on it.

I’m confident that it’s closed because they claimed to have closed it.

As for the high protection mode - of course that reduces the attack surface.

If this forum were to live up to its name, you would be laughed out of here after that comment.

Reply on news.ycombinator.com