Google Outlines iPhone Vulnerabilities That Let Malicious Websites Steal User Data for Years, Now Fixed

[realtuner]

Why do they take money from Google to be default search provider in Safari. Seems at odds with their commitment to privacy no?

Again, that's just marketing. They can't market privacy with Google as their main search engine.

Google only gets an anatomized request from your device. They receive no identifying information. No Apple ID, no Device ID, no IMEI, no e-mail address, no phone number. Apple restricts the information that Google gets. So Apple can absolutely claim they are taking your privacy seriously while still giving consumers the option to use Google.

It's the same way Apple uses Google servers for iCloud data. Google doesn't have access to any of your iCloud data even though it's on their servers.

 

[AustinIllini]

Well stated. I feel for the contractors who are poor pawns in the new global "gig economy" exploitation racket. However I feel nothing but cold contempt for Apple and how it operates these days.

Honestly, Apple is the best out there right now. They have a solid balance between services and privacy.

I'm just calling them out for a couple of exceptions. Some people here will say things along the lines of "Apple values your privacy". Well, they kind of do, but they don't value your privacy like you value your privacy. The other thing to consider is Apple isn't a thing with standardized values. When Tim and company are gone, this could all change.
[doublepost=1567177939][/doublepost]

Google only gets an anatomized request from your device. They receive no identifying information. No Apple ID, no Device ID, no IMEI, no e-mail address, no phone number. Apple restricts the information that Google gets. So Apple can absolutely claim they are taking your privacy seriously while still giving consumers the option to use Google.

That's not true if you are logged into a google account on iPhone. Sorry, it's just not. They let Google have unprecedented access to user data. It's fine with me, but accept it for what it is.

They basically go "here's our default search engine, by the way for it to work best, give it access to your location data"

Which I'm totally fine with, but don't call that a champion of privacy.

 

[Alan Wynn]

Serious question: If Apple values privacy so highly why do they not have a division like Googles Project Zero doing this kind of work? If they do have such a division, what has it exposed over the years?

I am not clear if you are asking if Apple has a security team that looks for bugs and exploits in its own software (something they obviously do - someone from that team spoke at Blackhat), or if they have a team that looks for bugs in other people’s software (something of no real interest to them). Apple’s focus on privacy is not, primarily, about bugs, it is about systems that are designed to vacuum up users’ data (see articles about Google Chrome and cookies as an example).

 

[Expos of 1969]

Who cares about the default? The fact that I can set duck duck go as my default search engine on iOS is proof of apples commitment to privacy, not lack there of.

At least it’s an option with iOS at the users discretion, don’t think google even offers that.

That is very funny but equally sad. You give Apple a huge pass and thumbs up because they let you change Google to Duck Duck Go. If Apple really cared about privacy they would not have Google as the default. Unfortunately they know that the majority of iPhone or Mac users don't care what search vehicle they use or have no idea something other than Google exists. Google would not pay Apple the big bucks if they knew a majority of users changed from the default. This in no way shows that Apple has any interest whatsoever in users privacy.

 

[LETSTRUCK]

Google is trying to be a Crook and a Policeman simultaneously.

OK.

So true, kinda funny that Apple had bugs and loopholes to jump through to have security threats made by hackers yet Google is the king hacker. Android and any google device is just a data engine collecting everything.

 

[FFR]

Android allows you to use a completely different browser as the default.

You haven't answered the question, they are talking privacy yet taking Googles money to be default search provider. Thats doesn't make any sense.

Cynics would say they care about privacy as long as it doesn't hurt their bottom line.

Google allows you to remove google search from a android and replace without another search engine,

I missed where they allowed that, could you show the option in chrome or system wide android thanks.


Ofcourse if google were in a better positon to negotiate, all those billions would have been to make google the exclusive search engine.

Guess they have no other choice.

 

[realtuner]

That's not true if you are logged into a google account on iPhone. Sorry, it's just not. They let Google have unprecedented access to user data. It's fine with me, but accept it for what it is.

They basically go "here's our default search engine, by the way for it to work best, give it access to your location data"

Which I'm totally fine with, but don't call that a champion of privacy.

Show me where in iOS that you're required to log into a Google account when picking Google as the default search engine.

 

[cocky jeremy]

Bad idea to disclose because some people don’t install the latest firmware and are still vulnerable.

Wouldn't those people want to know which sites to avoid then?

 

[realtuner]

That is very funny but equally sad. You give Apple a huge pass and thumbs up because they let you change Google to Duck Duck Go. If Apple really cared about privacy they would not have Google as the default. Unfortunately they know that the majority of iPhone or Mac users don't care what search vehicle they use or have no idea something other than Google exists. Google would not pay Apple the big bucks if they knew a majority of users changed from the default. This in no way shows that Apple has any interest whatsoever in users privacy.

Google doesn't get any identifying information about me or my iOS device. How is that a violation of my privacy?

 

[smoking monkey]

1. Reboot your iphone
2. Install the latest OS
3. Reset all passwords

Seems to me the only way to make sure you're not going to continue to give out information if you've visited one of these mysterious compromised sites.

 

[AustinIllini]

Show me where in iOS that you're required to log into a Google account when picking Google as the default search engine.

I never made that claim. We just know it works best when you give it your location data. Safari asks for that.

 

[FFR]

That is very funny but equally sad. You give Apple a huge pass and thumbs up because they let you change Google to Duck Duck Go. If Apple really cared about privacy they would not have Google as the default. Unfortunately they know that the majority of iPhone or Mac users don't care what search vehicle they use or have no idea something other than Google exists. Google would not pay Apple the big bucks if they knew a majority of users changed from the default. This in no way shows that Apple has any interest whatsoever in users privacy.

Huge pass? I think it absolutely genius.

They get a huge check from google, and any user can switch at any time.

That’s the key right there. Any user can switch at any time. Android is stuck with google, right there on the home screen, it’s been that way from the beginning, don’t forgot the assistances or any of googles other services.

 

[XXPP]

The defenders will soon be here trying to explain how Apple was not at fault and that the company is really trying to put privacy priority # 1 (ha...ha...ha).

Every software has errors. They removed it within 7 days. All Apple devices received the fix the same day.

How is it on Android?
Fix will reach the promile of devices, the producers will not update them.

 

[AustinIllini]

Every software has errors. They removed it within 7 days. All Apple devices received the fix the same day.

How is it on Android?
Fix will reach the promile of devices, the producers will not update them.

And depending on the manufacturer they're also subject to carrier interference.

I've done the Android thing multiple times and the iPhone thing multiple times. I'm about done with Android.

 

[Expos of 1969]

Google doesn't get any identifying information about me or my iOS device. How is that a violation of my privacy?

Has Mr. Cook not publicly criticised Google for its lack of focus on privacy as part of his campaign to promote Apple as the Privacy King? Of course he has.
Therefore, whether Google is getting any identifying info is not the major issue. I believe Mr. Cook often states that ideals and principles are very important. As a result, he should be refusing to take any funds from Google and he certainly should not be having Google as the default on Apple devices.
Such a clear and obvious decision to make based on ideals and principles but just a moment...."Google, you will pay me how much to put you on my devices??!! Just a sec....."Ideals and principles, there is the door, get the heck out of here!!"

 

[realtuner]

I never made that claim. We just know it works best when you give it your location data. Safari asks for that.

You said:

They let Google have unprecedented access to user data.

Show me where in iOS Google gets “unprecedented access”.

 

[Khedron]

This. Google values ad revenue, which requires the use of customer data. Apple sells hardware.

Here's the thing, though. Apple doesn't actually value your privacy. Apple only values their ability to market privacy. That's why you see certain oddities where Apple has been compromising your privacy.

Apple sells ads. Apple only values blocking other companies tracking users because they want a monopoly on user data to sell their own targeted advertising service. They don't include themselves in their anti-tracking measures.
[doublepost=1567179145][/doublepost]

Has Mr. Cook not publicly criticised Google for its lack of focus on privacy as part of his campaign to promote Apple as the Privacy King? Of course he has.
Therefore, whether Google is getting any identifying info is not the major issue. I believe Mr. Cook often states that ideals and principles are very important. As a result, he should be refusing to take any funds from Google and he certainly should not be having Google as the default on Apple devices.
Such a clear and obvious decision to make based on ideals and principles but just a moment...."Google, you will pay me how much to put you on my devices??!! Just a sec....."Ideals and principles, there is the door, get the heck out of here!!"

There is nothing Tim Cook values more than a profit margin

 

[AustinIllini]

You said:



Show me where in iOS Google gets “unprecedented access”.

Which other native iOS app directs you to a site that works best when tracking your location?
[doublepost=1567179355][/doublepost]

There is nothing Tim Cook values more than a profit margin

That's his job by definition.

Steve Jobs felt the same way. The thing is, Apple is a completely different company from the Apple which launched iPhone in 2007. Their market position is much different.

 

[mi7chy]

So many critical vulnerabilities considering how dumbed down iOS is. Perhaps that's why Apple is reluctant to, for example, add code to allow placing icons anywhere on the home screen since it can add new vulnerabilities.

 

[Rob_2811]

That is very funny but equally sad. You give Apple a huge pass and thumbs up because they let you change Google to Duck Duck Go. If Apple really cared about privacy they would not have Google as the default. Unfortunately they know that the majority of iPhone or Mac users don't care what search vehicle they use or have no idea something other than Google exists. Google would not pay Apple the big bucks if they knew a majority of users changed from the default. This in no way shows that Apple has any interest whatsoever in users privacy.

Exactly Google pay for that access because they know that is access to the vast majority of iOS users.

I refer back to the most downloaded Apps last year on iOS, Google and Facebook accounted for six of the top ten. WhatsApp, Chrome and Google Photos are also in the top twenty.

iOS devices are out there in the hundreds of millions running Facebook and Google services and even when they pull a stunt Apple doesnt ban them. The truth is Apple needs them because most of their customers are using them.

Apples privacy messaging comes with huge caveats, its basically marketing tag line, it isn't a reality that exists for most of their users.

 

[realtuner]

Which other native iOS app directs you to a site that works best when tracking your location?

You're jumping all over the place. First off you try to equate logging into a Google account with Google being the default search engine. Then you claim "unprecedented access to user data". Now you've moved onto "which other native iOS App directs you to site...."

You still haven't answered the first two question I posed to you:

What does a person logging into a Google account have to do with picking Google as the default search engine?

What "unprecedented access to user data" does Google have, and what data are they actually getting?

 

[1098474]

Yeah, why no links?

They are probably not there cause they don't want i
Diots going to them, just saying tho

 

[TheSapient]

Google discovers vulnerabilities in IOS and Safari. Google informs Apple. Apple immediately fixes the problems.

MacRumor posters: Google/Apple is evil!

 

[AustinIllini]

You're jumping all over the place. First off you try to equate logging into a Google account with Google being the default search engine. Then you claim "unprecedented access to user data". Now you've moved onto "which other native iOS App directs you to site...."

You still haven't answered the first two question I posed to you:

What does a person logging into a Google account have to do with picking Google as the default search engine?

What "unprecedented access to user data" does Google have, and what data are they actually getting?

I'm not sure why you think I'm jumping around. Logging into google on safari keeps you logged in. Searching in the search bar takes you to a logged in site that tracks your data.

Regardless, Google requests your location and Apple allows it. None of that is privacy forward.

You go take some time and figure that out because it's fairly straightforward. There's nothing else to discuss.

 

[laz232]

Having read the Google Project Zero post, and the Macrumors article - the QUESTION that I would like to have clearly and unambiguously answered is: is the exploit persistent or does installation of the latest (or at least post iOS 12.1.4) clean any potentially compromised device?