> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark
Apple could fix that with proper UI though.
One reason is that GPS doesn't work well (or at all) indoors, through cell-tower geolocation should work well enough for that case.
Back in the university days, we (me + a few friends) used to get some radios and antennas to create a signal stronger than the one coming from satellites. It was always fun when the semester started and all freshmen were using Google Maps to navigate through the campus, but the map always showed their location in North Korea. Good ol' times.
Still an impressive feat.
If you were spoofing GPS campus wide over 1.544 GHz and had all your GPS sentences correct, with simple radios and antennas... and you hadn't got in trouble with Uncle Charlie or the FAA....
Broadcasting an RF signal to spoof GPS (and especially across a campus), that my friend, is not trivial or cheap.
But broadcasting a loud signal that tells everyone in range that they are at the same exact point doesn't seem too hard to me. Couldn't that even be as simple as replaying a single-antenna recording taken somewhere else?
Doesn't work well with some receivers that cache data from the real network and stay locked onto the much weaker real signal. But works with most receivers.
From your previous comment, it sounds like your experience may have been from a while ago? In 2022, it is fairly trivial and cheap: https://github.com/osqzss/gps-sdr-sim
I can not ;^) personally confirm that this works with a HackRF, which is like $300, but probably also with any other reasonable tx-capable sdr.
Still, it was illegal and could get everyone expelled, so I wouldn't do it again.
I don't think contactless Apple Pay actually uses device geo[1] for authorization, but it's still worth noting that iOS devices without cell connectivity (ie WiFi-only iPads) don't have GPS anyway.
You can use Apple Pay on websites in Safari, though, which IIRC doesn't require location permissions to work.
1. You have to be able to use it in the same places you'd use a normal card, which means you can't rely on network connectivity of any kind.
Apple's statement was "to prevent the sharing of fraud prevention assessments with your payment card network, you may select another card". I removed my Visa cards from Apple Pay.
"For cards with certain enhanced fraud prevention, when you attempt an online or in-app transaction, your device will evaluate information about your Apple ID, device, and location (if you have enabled Location Services), to develop fraud prevention assessments, which are used by Apple to identify and prevent fraud."
* first, a purchase shouldn't require an internet connection. Humans have been doing commerce for millennia without it, and we have sophisticated pub/priv key schemes to figure this all out.
* second, it's a security hole. It's either a VPN or it's not.