Post

More from @mysk_co

Mysk 🇨🇦🇩🇪

@mysk_co

Jan 28, 2023

🧵
The App Store on #macOS 13.2 sends detailed usage data and analytics to Apple. All interactions are associated with the user's iCloud ID, or dsid. This happens even when you turn off sharing usage data and analytics.
(1/6) 👇
#Privacy #InfoSec

(2/6)
The App Store on the latest version of macOS (13.2) behaves identically to what we demonstrated on iOS 14.6. This gives a clue that almost certainly the same happens on iOS 16.2. Recap of what iOS 14.6 sends:

(3/6)
Here's an example of the analytics sent when I search for "Holy Moly" on the App Store. Everything is logged and associated with the user's iCloud ID, even when you play a video of an app and click on the unmute button. Data collected can identify a user personally.

Read 7 tweets

Mysk 🇨🇦🇩🇪

@mysk_co

Jan 22, 2023

🚨New 🧵:
(1/9)
No, macOS doesn't send info about your local photos to #Apple
We analyzed mediaanalysisd after an extraordinary claim by Jeffrey Paul that it scans local photos and secretly sends the results to an Apple server.👇
#Cybersecurity #Privacy
sneak.berlin/20230115/macos…

(2/9)
The process indeed scans local photos, as its name suggests. mediaanalysisd starts every time you preview an image file in Finder, then calls an Apple service. The process does not access any suspicious resources. Here is a look at the resources:

(3/9)
The content of its framework, MediaAnalysis.framework, clearly shows that the process runs machine learning algorithms to detect objects in photos. Its binaries file show a huge list of objects the model is trained to detect, some sample:

Read 10 tweets

Mysk 🇨🇦🇩🇪

@mysk_co

Nov 23, 2022

🧵 1/7
We have received a lot of feedback on our recent Apple Analytics findings. Here’s a thread to address some of these comments:

2/7
Many have pointed out that Apple’s “Device Analytics & Privacy” policy document doesn’t pertain to the analytics in Apple’s apps, but instead there are separate policy documents that cover Apple’s apps and services.

3/7
While this is technically correct, we believe it’s misleading on Apple’s part, who claim “Privacy is a fundamental human right,” to have very different privacy policies that cover different aspects of their “walled garden”

Read 7 tweets

Mysk 🇨🇦🇩🇪

@mysk_co

Nov 21, 2022

🚨 New Findings:
🧵 1/6
Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s analytics can personally identify you 👇

2/6
Apple states in their Device Analytics & Privacy statement that the collected data does not identify you personally. This is inaccurate. We also showed earlier that the #AppStore keeps sending detailed analytics to Apple even when sharing analytics is switched off.

3/6
Apple uses DSID to uniquely identify Apple ID accounts. DSID is associated with your name, email, and any data in your iCloud account. This is a screenshot of an API call to iCloud, and DSID it can be clearly seen alongside a user's personal data:

Read 6 tweets

Mysk 🇨🇦🇩🇪

@mysk_co

Nov 12, 2022

@TeamYouTube

🧵
1/7
During our research on link previews, we discovered that Instagram servers execute #JS code in links sent in DM. We contacted Facebook security team. They said it was expected behavior, no issue. We published the work. @TeamYouTube took down the video and sent us a warning

@YouTubeCreators

2/7
We appealed @YouTubeCreators decision. We argued that the video we uploaded to @YouTube was the exact video that we shared with Facebook security team. They concluded it was harmless. We discussed the issue with Facebook in a long exchange to convince them it was critical

@TeamYouTube

3/7
Facebook team was adamant that that issue was harmless and expected behavior. We shared with Facebook that we would publish the video. They didn't stop us. The video was viewed 3300 times before @TeamYouTube took it down and later rejected our appeal

Read 8 tweets

Mysk 🇨🇦🇩🇪

@mysk_co

Nov 6, 2022

🧵
1/6

Apple's Data & Privacy statement starts with the calming phrase "Apple believes privacy is a fundamental human right" then goes on to describe how the platform aggressively collects your data. You must accept the statement or stop using your iPhone.
#CyberSecurity

2/6
It is true that there are options to disable personalized ads, but as this videos shows, usage data is still collected and sent to Apple even when these options are disabled:

3/6
Before you conclude that Apple is tracking its users, you need to understand how Apple defines tracking. In short, as long as data collected to track you is not shared with 3rd parties, it's not considered tracking. No, Apple is not tracking you, just keeping an eye on you 👀

Read 6 tweets

Share this page!

Enter URL or ID to Unroll

Mysk 🇨🇦🇩🇪

Try unrolling a thread yourself!

More from @mysk_co

Mysk 🇨🇦🇩🇪

Mysk 🇨🇦🇩🇪

Mysk 🇨🇦🇩🇪

Mysk 🇨🇦🇩🇪

Mysk 🇨🇦🇩🇪

Mysk 🇨🇦🇩🇪

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!