You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start?

M4 iPad Pro lacks always-on display despite OLED panel

New Sonos app breaks accessibility for visually impaired users, here's what this advocate recommends - 9to5Mac

Apple apologizes for 'Crush' iPad Pro ad that sparked controversy - 9to5Mac

In a memo distributed to Apple Store teams on Tuesday and viewed by 9to5Mac, Apple explained that Apple stickers will not be included in the box for the new iPad Pro and iPad Air. The company says that this is part of its environmental goals, as it strives to ensure its packaging is completely ...

PSA: New iPads won’t include stickers in the box due to Apple’s environmental goals - 9to5Mac

Here's what Apple announced at its iPad-focused ‘Let loose’ event - 9to5Mac

Nano-texture glass for M4 iPad Pro only available on 1TB and 2TB models - 9to5Mac

New iPad Pro loses ultra-wide camera, fastest spec M4 chip exclusive to 1 TB and 2 TB models - 9to5Mac

Based on the book by Blake Crouch, Dark Matter is a new sci-fi drama series that starts streaming today on...

New sci-fi show Dark Matter streaming today on Apple TV+ - 9to5Mac

Apple unveils M4: Its first chip made for AI from the ground up - 9to5Mac

Ted Lasso series releasing on Blu-ray disc in July [update: now available to order] - 9to5Mac

9 to 5 Mac

9to5mac

Think of the last time you set up a new smart device. It probably came with a default password manufacturers intend for people to use once before setting their own login details. But did you take that step? Many consumers don’t, which is why the United Kingdom’s government has cracked down on those passwords as part of larger improvements in smart security. What do they involve? World-First Law Against Default Passwords The Product Security and Telecommunications Infrastructure (PSTI) Act, enacted on April 29, 2024, makes the United Kingdom the first country to legally obligate manufacturers to protect device users against hacking attempts. Default passwords are a central focus. Those become problematic because default password lists often get distributed online, making it easy for cybercriminals to find entry points for wreaking havoc. The newly introduced legislation applies to all products with network or internet connectivity and forbids manufacturers from setting easily guessable passwords, such as “12345” or “admin.” If the device password contains them, users see prompts to change the credentials. Consumer information about the new law suggestsdevice users create passwords containing three random words. It also recommends two-factor authentication, if available. Such safeguards reduce the chances of adversaries successfully using artificial intelligence (AI) or other emerging tech to guess passwords faster or enter accounts with only those credentials. One security professionals study found 89% of respondents believe AI-enabled threats will cause challenges for the foreseeable future. Now is the time to take proactive prevention measures. One AI password cracker can discover 51% of credentials in less than a minute. That result highlights the importance of using strong passwords and other safeguards to secure smart home products. More User Transparency Another legislative aspect involves manufacturers publishing contact details so users can reach them to report bugs or other problems. Then, device makers and retailers must be upfront with users about the minimum time frames for providing security updates. There’s currently significant variation, with some vendors offering them for approximately two years while others release improvements for more than a decade. Many smart products state specifications such as battery life and compatibility with other products. You can expect to soon see similar information about security updates under the new laws. Think of them like the use-by dates on supermarket products. You’ve probably had a few foods spoil even though the label said they should have been still good to eat. Security updates are also not foolproof, but they make it harder for cybercriminals to break into smart devices. Many enterprising hackers specifically target older operating systems or devices no longer supported by their manufacturers. Effects Beyond the United Kingdom While this is a U.K. law, it applies to companies selling or importing products there. Compliance failures are criminal offenses carrying fines of up to £10 million or 4% of the qualifying global revenue. Since most internet-connected products in the United Kingdom get made elsewhere, it’ll be interesting to see if manufacturers update their product packaging and user manuals to show the newly required information in other markets. Long security update time frames could also become a competitive advantage. Some brands already use that approach. When Dutch smartphone maker Fairphone released its fifth-generation model, the manufacturer promised users operating system, security, and software updates until 2031. Consumers Must Act, Too The PSTI Act increases device manufacturers’ responsibilities, but no one should allow this law to make them overly comfortable. Most reputable resources explaining the law to consumers emphasize the importance of setting strong passwords and using two-factor authentication with their smart devices. The need for password protection extends to changing credentials after relationship breakups, housemate changes, or similar residential variables. Otherwise, someone could continue controlling connected smart home devices long after they move out, as long as they know the password. Additionally, device users should check for software updates regularly, and — ideally — tweak settings to make them happen automatically for convenience. If there is no such option, a simple workaround is for someone to create monthly calendar reminders to look for new releases. Striving for Security First An enduring culture among some smart device makers involves releasing new devices as quickly as possible, treating security as an afterthought. However, people will soon lose their fascination with pioneering products that have major security flaws. The new law mandates security improvements from device makers, which is an excellent start. However, consumers must also take a couple of simple but effective steps to stop their devices from becoming hackers’ entry points. Sources: https://www.gov.uk/government/news/new-laws-to-protect-consumers-from-cyber-criminals-come-into-force-in-the-uk https://www.ncsc.gov.uk/files/Security-law-smart-devices-NCSC.pdf https://darktrace.com/blog/the-state-of-ai-in-cybersecurity-how-ai-will-impact-the-cyber-threat-landscape-in-2024 https://9to5mac.com/2023/04/07/ai-cracks-passwords-this-fast-how-to-protect/ https://www.which.co.uk/news/article/new-security-laws-for-smart-devices-aGJO50M7C3jo https://www.ncsc.gov.uk/blog-post/smart-devices-law Think of the last time you set up a new smart device. It probably came with a default password manufacturers intend for people to use once before setting their own login details. But did you take that step? Many consumers don’t, which is why the United Kingdom’s government has cracked down on those passwords as part of larger improvements in smart security. What do they involve? World-First Law Against Default Passwords World-First Law Against Default Passwords The Product Security and Telecommunications Infrastructure (PSTI) Act, enacted on April 29, 2024, makes the United Kingdom the first country to legally obligate manufacturers to protect device users against hacking attempts. Default passwords are a central focus. Those become problematic because default password lists often get distributed online, making it easy for cybercriminals to find entry points for wreaking havoc. The newly introduced legislation applies to all products with network or internet connectivity and forbids manufacturers from setting easily guessable passwords, such as “12345” or “admin.” If the device password contains them, users see prompts to change the credentials. forbids manufacturers from setting forbids manufacturers from setting Consumer information about the new law suggests device users create passwords containing three random words. It also recommends two-factor authentication, if available. Such safeguards reduce the chances of adversaries successfully using artificial intelligence (AI) or other emerging tech to guess passwords faster or enter accounts with only those credentials. device users create passwords device users create passwords One security professionals study found 89% of respondents believe AI-enabled threats will cause challenges for the foreseeable future. Now is the time to take proactive prevention measures. One AI password cracker can discover 51% of credentials in less than a minute. That result highlights the importance of using strong passwords and other safeguards to secure smart home products. found 89% of respondents believe found 89% of respondents believe 51% of credentials in less 51% of credentials in less More User Transparency More User Transparency Another legislative aspect involves manufacturers publishing contact details so users can reach them to report bugs or other problems. Then, device makers and retailers must be upfront with users about the minimum time frames for providing security updates. There’s currently significant variation, with some vendors offering them for approximately two years while others release improvements for more than a decade. offering them for approximately two years offering them for approximately two years Many smart products state specifications such as battery life and compatibility with other products. You can expect to soon see similar information about security updates under the new laws. Think of them like the use-by dates on supermarket products. You’ve probably had a few foods spoil even though the label said they should have been still good to eat. Security updates are also not foolproof, but they make it harder for cybercriminals to break into smart devices. Many enterprising hackers specifically target older operating systems or devices no longer supported by their manufacturers. Effects Beyond the United Kingdom Effects Beyond the United Kingdom While this is a U.K. law, it applies to companies selling or importing products there. Compliance failures are criminal offenses carrying fines of up to £10 million or 4% of the qualifying global revenue. fines of up to £10 million fines of up to £10 million Since most internet-connected products in the United Kingdom get made elsewhere, it’ll be interesting to see if manufacturers update their product packaging and user manuals to show the newly required information in other markets. Long security update time frames could also become a competitive advantage. Some brands already use that approach. When Dutch smartphone maker Fairphone released its fifth-generation model, the manufacturer promised users operating system, security, and software updates until 2031. Consumers Must Act, Too Consumers Must Act, Too The PSTI Act increases device manufacturers’ responsibilities, but no one should allow this law to make them overly comfortable. Most reputable resources explaining the law to consumers emphasize the importance of setting strong passwords and using two-factor authentication with their smart devices. The need for password protection extends to changing credentials after relationship breakups, housemate changes, or similar residential variables. Otherwise, someone could continue controlling connected smart home devices long after they move out, as long as they know the password. Additionally, device users should check for software updates regularly, and — ideally — tweak settings to make them happen automatically for convenience. If there is no such option, a simple workaround is for someone to create monthly calendar reminders to look for new releases. Striving for Security First Striving for Security First An enduring culture among some smart device makers involves releasing new devices as quickly as possible, treating security as an afterthought. However, people will soon lose their fascination with pioneering products that have major security flaws. The new law mandates security improvements from device makers, which is an excellent start. However, consumers must also take a couple of simple but effective steps to stop their devices from becoming hackers’ entry points. Sources: Sources: https://www.gov.uk/government/news/new-laws-to-protect-consumers-from-cyber-criminals-come-into-force-in-the-uk https://www.gov.uk/government/news/new-laws-to-protect-consumers-from-cyber-criminals-come-into-force-in-the-uk https://www.gov.uk/government/news/new-laws-to-protect-consumers-from-cyber-criminals-come-into-force-in-the-uk https://www.ncsc.gov.uk/files/Security-law-smart-devices-NCSC.pdf https://www.ncsc.gov.uk/files/Security-law-smart-devices-NCSC.pdf https://www.ncsc.gov.uk/files/Security-law-smart-devices-NCSC.pdf https://darktrace.com/blog/the-state-of-ai-in-cybersecurity-how-ai-will-impact-the-cyber-threat-landscape-in-2024 https://darktrace.com/blog/the-state-of-ai-in-cybersecurity-how-ai-will-impact-the-cyber-threat-landscape-in-2024 https://darktrace.com/blog/the-state-of-ai-in-cybersecurity-how-ai-will-impact-the-cyber-threat-landscape-in-2024 https://9to5mac.com/2023/04/07/ai-cracks-passwords-this-fast-how-to-protect/ https://9to5mac.com/2023/04/07/ai-cracks-passwords-this-fast-how-to-protect/ https://9to5mac.com/2023/04/07/ai-cracks-passwords-this-fast-how-to-protect/ https://www.which.co.uk/news/article/new-security-laws-for-smart-devices-aGJO50M7C3jo https://www.which.co.uk/news/article/new-security-laws-for-smart-devices-aGJO50M7C3jo https://www.which.co.uk/news/article/new-security-laws-for-smart-devices-aGJO50M7C3jo https://www.ncsc.gov.uk/blog-post/smart-devices-law https://www.ncsc.gov.uk/blog-post/smart-devices-law https://www.ncsc.gov.uk/blog-post/smart-devices-law

UK Prohibits '12345' Passwords in Smart Device Security Overhaul

An In-depth Look at iOS 16's Features and their Usability Apple has its own way of drawing eyeballs, and this time it's with the beta release of iOS 16. While the recently launched iOS version is gaining all the attention, reactions are mixed, with some still wondering whether an iOS 16 upgrade is worth getting or not. To address the same, I wanted to share an in-depth analysis of some of the newly introduced features. Recently, made available to download, followed by a mid-July beta launch of public release. The final launch is believed to happen this fall, making all the available for people to use. Apple iOS 16 developer beta best features of iOS 16 Recently in a video, editor, Miles Somerville shared an in-depth analysis of all the newly introduced features in iOS16. While he shared a long 37-minute-long video covering all the new features, we will prioritize features based on their usability. 9to5Mac The internet is flooded with mixed reactions to new features and the upgrades introduced; let's explore some of them. iOS16 introduced some new and much-needed features. While there’s a huge list to share, I would list some of the key features here. Let’s have a look at them Home App The Home app gets a complete overhaul with iOS16 and offers easier visibility, organization, control, and navigation of your smart home accessories. The revised home tab lets you keep an eye on and control your smart home easily by allowing you to access favorite accessories and rooms through the app's main tab. In addition, the upgraded version provides you quick access through dedicated categories for climate, light, TVs, speakers, and security, along with elaborated status information. Usability The enhancements are primarily around ease of access through various sections of your iPhone. The widgets on the lock screen further add to the experience with redesigned tiles that make accessories visually more recognizable. The ease of controlling accessories through the tiles enhances the visual and usability experience. Not just this, but later this year, Apple is introducing a new software update that will introduce Matter. It's a refreshed connectivity standard for smart homes that will allow users to enable seamless connectivity of accessories through connected devices. Lock Screen In iOS16, the lock screen is completely redesigned and offers a wide range of customizable typefaces, widgets, animated wallpapers, and multilayered effects for images. The new iOS 16 update allows users to create multiple personalized lock screens depending on Focus modes. In addition, you can easily switch between the lock screen by holding down and swiping. Usability The integration might look like a minor tweak, but it undoubtedly enhances usability to a large extent. For example, the multilayered effect brings the subject to the front, improving the overall appearance. In addition, while you have the liberty to change the way date and time look on your iPhone screen, you can also use gallery display suggestions for some inspiration. Besides these, you can also use Apple Watch-inspired widgets that give you a glance at the weather, calendar events, time zones, battery level, activity ring, and much more. Not just this, once the iOS is released this fall, you may surely expect to have new Widgets created by developers using the WidgetKit API. Wallet and Apple Pay iOS16 users can now track Apple Pay orders while getting receipt and order tracking information for participating merchants and Apple purchases in your Wallet app. Also, iOS16 gives extended support to Keys and IDs, allowing users to utilize their Wallet ID for apps requiring age and identity verification. Users can also secure and manage necessary permission in the Wallet app. Another feature added to the list is 'Apple Pay Later. The US users can now split the Apple Pay purchase bills into four installments over six weeks. Usability The Wallet and Apple Pay enhancements will surely get the attention it deserves. The integrations are commendably ensuring user security, privacy, and experience. While, on the one hand, the Keys and IDs function shares only the information required, Apple Pay later allows users to leverage the ease of paying everywhere Apple Pay is accepted in-app or online, using the Mastercard network. Health and Fitness The health app, too, gets a bit of revision by allowing users to create and manage schedules and reminders, medication lists, and track medications, supplements, vitamins, medications, and custom visuals. Not just this, the Fitness app can now be accessed even if the users do not have an Apple Watch. Users can set a daily move goal in the Fitness app and track active calories next to the Move ring. All of this is done using the iPhone's in-built sensors that track steps and activity (including third-party apps) and eventually estimate active calories to daily Move goals. Usability Before talking about it, let me share the key motivational factor with Fitness+ awards. However, it's not clear how many awards are up for grabs. The app upgrade doesn't just inspire people to lead a healthy life but puts ahead everything that's needed for it. In the United States, users can also point their iPhone camera at a label to add the medication and learn about its uses. Notes and Reminders Apple has done moderate updates to Notes and Reminders apps, but they greatly help. With iOS16, Apple has introduced Quick Note. The functionality allows users to create a Quick Note using the control center or share menu in any app. Also, sharing and security have been enhanced. You can encrypt notes using your iPhone's password and share them using a link. The Reminders app now has the option to pin notes easily and have a favorite list for easy accessibility. Usability As I mentioned earlier, both the updates could be minor, but they are of great use for those who rely on the two apps. The features don't just prioritize ease of access; they also consider security and privacy. A blend of further personalization has been added by allowing users to create bullets, underline text, strike through, bold, etc. A bunch of other inclusions like notifications and smart folders further ensure a flawless experience for users. Apple Messages This is where a significant upgrade allowed users to edit and unsend a message within 15 minutes of sending it. The duration might increase or decrease in the coming days post the final release of iOS16 this fall. With the iOS16 upgrade, you can also mark your messages as unread in the iMessages app and return to it later. Usability The feature can save you from embarrassing typos and mistakenly sent messages. However, people must use it over misusing the feature. The engagement factor further increases with iOS16 bringing SharePlay to Messages. The function allows users to share synced content through the Messages app. Not just this, developers can additionally use the shared API to integrate this function into third-party apps. Maps With iOS16, Apple Maps has introduced a new feature to add upto 15 stops in advance. The feature will allow users to plan their journey and sync routes. Besides these, Apple Maps also got updates linked with transit updates, which will help riders ascertain the estimated journey cost, add transit cards, refill them, etc., all while staying in the applications. Usability The feature can help those who prefer planning their trip and want to stay updated with the route accordingly. Besides, it will also help the public to ascertain the cost of their travel—especially those who prefer keeping track to maintain their budget. Revised Focus Mode Focus Mode was first introduced in iOS15 and got a critical overhaul with the iOS16 upgrade. Each Focus mode can now be linked with a custom lock screen design. Besides the current ways of activating the lock screen through a control center or automation, users can now switch through Focus Modes by swiping their fingers on the screen. Usability iPhone users loved the Focus Mode feature in iOS15, and with this upgrade, Apple has made it easier for people to access this feature in a personalized manner. They can customize each Focus Mode by configuring the Home/Lock Screen with relevant wallpaper, widgets, and apps. Other key features in iOS 16 are iCloud+ Game Center Spotlight Weather Music Books Stocks Translate Tips CarPlay App Clips Improved Child Account Memoji TV App Keyboard Haptics Media Streaming Improvements And much more Before signing off iOS 16 brought a wide range of new features for users. While with this list, I tried covering most of them, there's still a list of minor upgrades that can be listed. However, suppose we summarize all the features and their usability in a statement. In that case, it can be said that the big boys at Apple always emphasized streamlining and improving the user experience. Just in case you are using the public/developer beta, do share your views or any other feature you think is paramount and I missed.

Is iOS 16 Really Worth Getting? 

This Slack discussion by , and occurred in 's official #random channel and has been edited for readability. Marina Volkova Richard-Kubina Slogging I have some stories to share with our slogging folks, hope you will like them. Marina Volkova Mar 3, 2021, 2:06 PM Marina Volkova Mar 3, 2021, 2:09 PM https://www.computerworld.com/article/3609897/android-12-features.html Marina Volkova Mar 3, 2021, 2:09 PM https://www.businessinsider.com/foldable-iphone-coming-in-2023-report-2021-3 Marina Volkova Mar 3, 2021, 2:09 PM https://9to5mac.com/2021/03/02/exploding-iphone-x-lawsuit/ Marina Volkova Mar 3, 2021, 2:09 PM https://www.macworld.com/article/3609900/macalope-apple-rumors-apple-car.html Marina Volkova Mar 3, 2021, 2:09 PM https://appleinsider.com/articles/21/03/02/magsafe-connector-could-return-and-replace-lightning-on-iphone Marina Volkova Mar 3, 2021, 2:09 PM https://www.macrumors.com/2021/03/01/prosser-iphone-12-magsafe-battery-reverse-charging/ Marina Volkova Mar 3, 2021, 2:09 PM https://lifehacker.com/how-to-quickly-scan-documents-on-your-mac-with-your-iph-1846388645 Marina Volkova Mar 3, 2021, 2:10 PM https://www.tomsguide.com/news/the-most-stunning-android-phone-of-the-year-just-leaked-and-its-not-from-samsung yay to the magsafe comeback richard-kubina Mar 4, 2021, 6:43 PM

Cool Mobile Tech Stories 2021

In the world of today, personal data like our names, phone numbers, Internet history, geodata, and much more is very valuable to the corporations who harvest and it. I shouldn’t remind you about , right? But in case you need a refresher, here’s a brief of the increasing privacy problem by NewsBTC: sell Cambridge Analytica overview “Equifax, a company whose operations effectively rely only on data security and data processing, saw the personal details (Social Security numbers, addresses, full names, etc.) of approximately 145.5 million of its American, Canadian, and British clients get exposed by hackers. This fracas, of course, is just the tip of the iceberg.” Source: hipaajournal.com How can you protect yourself from this kind of private data leaking if you don’t even know about it? In this article we’re going to look at the most commonly used devices that store most of our data, which are our phones. Let’s check how reliable they are when it comes to safeguarding our privacy and security in the face of such attacks. Current smartphones from a privacy perspective No matter what the device is, if it has any kind of features, hackers (and governments, and corporations, and other unknown third parties) will try to exploit them. We learned from The Verge’s that even the most sophisticated security mechanisms are hackable. Anatomy of a Hack The more sophisticated a device is, the better protection it has, you may believe. But paradoxically, the opposite is also true: the more functionality, the more information your phone is transmitting straight to strangers. These are the most commonly used smartphones and their respective privacy mechanisms. BlackBerry No one uses BlackBerry anymore, you say? Actually, following a steep in popularity after the release of the iPhone, Blackberry recovered nicely with their acquisition of Cylance, an AI-based security mechanism, with sales 23% in the first quarter of 2019. decline rising Here’s a review from Zero Day by Jack Whittaker from 2015, coincidentally just before BlackBerry went down: “Facebook accessed my location a total of 194 times in seven days. Skype accessed my phone contacts list a total of 1,814 times in the past seven days. Twitter accessed my location 704 times in the past seven days.” Source: businessinsider.com In 2019, BlackBerry is more in terms of security than ever before in order to combat modern-day privacy face-to-face: introducing threats “DTEK records when an application accesses highly-private sensors (microphones, cameras, etc.)  and prompts the user to take action when an app oversteps its boundaries. Locker, on the other hand, is an encrypted safe storage space to store sensitive photos and documents. ‘Privacy shade’ blacks out the entire display and only enables a small area to prevent over-the-shoulder peeking. It even has a Redactor tool that lets you hide sections of the screen before sharing.” Will this be a better BlackBerry than four years ago? We’ve yet to see results. Samsung As a Samsung user with doubts about privacy pointed out on a , “Most advice seems to go on the verge of changing the phone entirely or completely giving up using a cell phone for all practical purposes.” Are things so bad that no matter what you do your phone is sure to get invaded anyway, so you may as well just give up even using a phone in the first place? Which concerns would drive a Samsung user to such desperation? Your data (even if you turn your settings to private) along with your location data and YouTube history is still getting collected by Google miners. And then there’s this: forum “Samsung's apps (Mail, Browser, Gallery, Camera, Messages, etc) all appear to make regular contact to 'vas.samsungapps.com', which resolves to AWS. So if you're looking at a packet log on your router/firewall, you can't pick the traffic out from the rest of the AWS stuff. I've no idea what the connections are for, as they're encrypted. You can't remove nor disable the apps.” Ouch! Nokia In March, NotebookCheck “That certain Nokia 7 Plus units were phoning home to China with sensitive user data that could allow real-time tracking.” Questions? Just one, from this Reddit thread, but the words “pre-installed” and “undeletable” should tell you everything you need to know: reports “How much does the pre-installed, un-delete-able Facebook-app on the 3310 3g have?” access iPhone How great are iPhones? Everyone is using them, so they must be the best. This lemming mindset will lead you to ignore the following by Bloomberg: publication “Bloomberg News recently reported that for years iPhone app developers have been allowed to store and sell data from users who allow access to their contact lists, which, in addition to phone numbers, may include other people’s photos and home addresses… The consumer control option gives developers access to everything you’ve stored about everyone you know, more than just their phone numbers, and without their permission. This is the kind of situation that landed Facebook CEO Mark Zuckerberg in 10 hours of congressional testimony in April.” Source: 9to5mac.com Following a recent ban on the usage of that data, Apple still did very little, if anything at all, to ensure that it’s technically impossible for developers to use that (very sensitive) data. Why? “Developers have made $100 billion in revenue in that time, even after Apple took its average 30 percent cut. Fortunes have been built on the personal data of Apple customers.” Sound like someone you trust? How blockchain phones could make privacy concerns obsolete Now, when it comes to privacy, the blockchain is one of the best solutions around. No single point of failure, biometric scans, unprecedented levels of cryptographic security - if security is to be found anywhere, it’s in blockchain technology. Some cryptocurrency users have even ingeniously implanted subdermal under their skin. With this, your money is stored in a tiny capsule somewhere on your body no one would think to look. To log into your wallet on a PC you just walk in front of it, as it is powered by near-field communication technology. That should give you some idea of how to secure new technology can make your data. Here’s what blockchain-enabled smartphones offer in terms of privacy: wallets The first generation of blockchain phones SOLARIN, by Sirin Labs provides, substantially more security to your data by introducing a whole new principle of protection. Encrypted calls and messages alone sound exciting. Also, military-grade encryption technology KoolSpan and “Zimperium state-of-the-art mobile threat protection that thwarts the broadest array of advanced device, network, and application mobile cyber attacks.” Using a slightly different approach, there is the HTC Exodus, a phone that uses Bitcoin’s architecture to allow you to be your own bank. Private keys aren’t owned by a third party and they work with Ethereum-decentralized applications. A native crypto wallet as part of the mobile Opera browser that can use Exodus One’s native hardware means the world’s first system that creates not just a few features but a completely protected environment. And since the success of this system depends on the extent of its decentralization (remember, centralization means a central point of failure, which is really bad for your data’s safety), Telecoin’s TeleFone, which is even more decentralized, is the most enviable option of the three.  Telecoin uses Obfuscation and SwiftTx with the help of MasterNodes and Proof-of-Stake to introduce some of the fastest and most secure blockchain-based infrastructures around. Its secure, decentralized mobile phone, Tele-Fone, allows users to store personal data/files and information directly on the blockchain. Why is that so important? Why Tele-Fone is a more decentralized mobile phone than others A decentralized mobile network based on the blockchain Why is the decentralized way the only way? The Internet was invented to be decentralized, just like Bitcoin. Then, like all good concepts, it became tainted when it went mainstream and now there is centralization, which means massive threats to user data. Source: blog.cloudflare.com Decentralized data means you’re not using intermediaries like Google and Facebook to transfer information, and you are only sending it from a peer to another peer using state-of-the-art encryption. User history doesn’t get sent to Google, so their clients can’t supply you with targeted advertising. Phone messages are not stored on a server somewhere. That way, no third parties with dubious intentions can get their hands on your data. Genius! Here’s with an example of decentralization at work: Forbes “A user will receive a decentralized ID issued by the DID sidechain. Data itself will not be stored on the blockchain, but instead, on a distributed file storage system (similar to Interplanetary File System - IPFS) that will be spread across thousands of servers, all of which are encrypted. When a user wants to access this data, the Elastos Carrier will retrieve the data without prior knowledge of where it is stored. This is decentralization at work.” Remember how we said Telecoin is decentralized? The data that its Telefone transmits is sent from user to user, without involving intermediaries, which means no one is listening in on your conversations, which secure P2P calling and messaging anyway. include Integrated wallet You’ve already learned from the example of Exodus One that an integrated wallet makes a huge difference. An integrated (built-in) hardware wallet means that private keys are stored on a chip, which is off-limits and cannot be accessed by hackers. The data is accessible only to you, as the wallet holds the private key that can sign transactions and the key doesn’t leave the hardware wallet. TeleFone’s integrated wallet means much greater security, which is very important in decentralized networks. Custom dApps TeleFone’s custom dApps can take data out of the hands of third parties, hackers, and governments and only confine it to peer-to-peer exchanges, thus allowing for much greater privacy and security. Here’s Hackernoon’s : Mayank Pratap “Decentralized applications are very useful as they can be used to connect different people in marketplaces, sharing resources and storing them, maintaining cryptos as well as executing smart contracts without giving ownership to one central authority.” When can we start using a blockchain-enabled phone? Naysayers are skeptical about the rise of blockchain phones (just as they were skeptical about everything ever always). Still, just like how the blockchain was ridiculed at first and then by global giants who actively use it today, blockchain phones will no doubt make good use of this spectacular technology soon enough to take control out of the hands of the government and give it back to the people. accepted Source: dilbert.com Getting your priorities right is achieved by first imagining who would save you if the worst came to worst. The Internet isn’t technically controlled by anyone (we know you’re sick of hearing this, but no single point of failure=good), but a huge deal of its servers are run by corporations. Which means they make the rules. What happens if those servers get hacked? What if there is a global satellite failure? Sounds like a fantasy? ? What if companies decide to completely censor your data? one day there’s just no Internet for no apparent reason and no one knows why? A decentralized Internet with a peer-to-peer network would be your only backup. What about now What if A peer-to-peer decentralized network without intermediaries that sell your data, censor you, or tell you what to do is a must. TeleCoin is TeleFone’s IEO on 31/07/2019 on the LAToken Exchange. Ask yourself why they got involved in the first place. Remember, Bitcoin’s original beauty was about decentralization. And so was the Internet’s… before centralization ruined everything. Be smart! Come back to the roots. launching

What’s the Best Smartphone for keeping your Conversations Private?

Let us dive into a topic every techie loves and loves to hate and hates to love: Android vs. iOS. Now this has been done a million times, so what could I possibly add to it? Some thoughts on one of the new IT battlegrounds: mobility. I say because this is the term used by giants like Daimler and BMW. At this point everybody knows that the future of mobility is a blend of car sharing on the one hand and autonomous driving and companies like Uber and Tesla in the long term on the other. So, the new game is to bring people from A to B while never letting them leave your own platform by whatever means neccessary. mobility This is why Daimler bought MyTaxi, BMW launched DriveNow with Sixt (ReachNow in the US), Daimler launched Car2Go and why BMW and Daimler are fusing everything together into ShareNow hoping to counter Silicon Valley and not remain as anonymous to end users as Airbus and Boeing in the future (do you remember what plane you flew on last? exactly.) Hell, they will gladly rent you bikes as long as you keep using their apps. Imagine telling this to a board member in Stuttgart or Munich 30 years ago. More specifically I am going to be talking about the reason why Android slowly has the upper hand by being patient and refusing to introduce a walled garden experience by looking at the automotive sector as a new super-market for IT giants. Enter Apple and Google. While Waymo, Google’s autonomous driving spin-off, recently valued by Morgan Stanley to the tune of 175 billion (!) USD, is more than real, we just keep hearing unsubstantiated rumors of the so called Apple Car. Apple has kept and engineers for its automotive activities left and right for quite some time now. At this point I am not sure what “Tim Apple” is doing. In the meantime we have CarPlay and Android Auto and let’s face it — CarPlay wins hands down. I love iOS, I love Apple and I will never buy an Android phone again. There we have it. Right? Fanboiii? No. I think that Apple has missed the point while selling high margin sheets of glass and steel for the past decade. With all their unbelievable success of becoming the iPhone company they did not realise how big of a market they will lose by not providing an alternative in newer OS markets like the automotive sector. Enter Android Automotive; often mistaken with Android Auto — definitely not the same thing. We will come back to this in a minute. hiring firing Currently Apple makes pretty decent software, which delights most users — nobody cares* that Apple makes amazing chips in their own hardware division — and it keeps them coming back to Apple (same with the Mac). The problem is that this software is exclusively attached to extremely expensive devices that will not get any cheaper anytime soon. In fact they have been getting more expensive to the point that for the first time ever an exec from Apple, Jeff Williams, said the following: “We do not want to be an elitist company […] We want to be an egalitarian company, and we’ve got a lot of work going on in developing markets.” Wow. Now imagine an Apple Car. Right. Ok. But then there are the never ending regarding Apple “needing” to buy Tesla. I also think that this is unrealistic. Why take over a complex manufacturing operation without any domain knowledge to get into a lower margin market? GM’s net income was around a 1/7 of Apple’s net income in 2018. Apple will soon start making more money with their services (if they have not done so already) than GM ever could by selling of cars every year. rumors millions While Apple was busy buying Beats and launching Apple Music because it wanted some of Spotify’s pie (justifiably by the way since iTunes was/is pretty much dead with the younger demographic at this point), Google used its incredible open source super powers with the Android Open Source Project (AOSP) — this is the core Android project that allows OEMs to create their own versions of Android — to launch Android Automotive. In case you are not familiar with the basic architecture of Android (AOSP), here is a brief overview: AOSP Architecture What you may not know as an end user of cars is how complicated it is to build new software for legacy automakers compared to Tesla and its OTA (over the air) updates. If Tesla was around since the 90s, their in-car infotainment would be just as bad — technical debt is a part of software development. I know as I work with legacy automakers every day. Google understands this and knows how powerful AOSP is beyond phones — it can morph into any new or old hardware product category and since Google does not need to own the hardware like Apple, the sky is the limit. The Android runtime is almost always exactly the same and you sort of end up changing your HAL — Hardware Abstraction Layer depending on your device type and your UI if we are e.g. talking about smart watches or in this case cars. Now we are back to what in my mind is even more valuable than Waymo — Android Automotive: Android Automotive architecture based on AOSP Essentially Google has provided a solution for legacy car manufactures — a fully customisable OS, which can be run on any and all cars they have with the ability to implement their own UI. And if a manufacturer is interested — customers get all the Google Services as well. Sweet deal for Google. This is huge for the industry believe me. And everyone is experimenting with it. You can let Android developers start building apps for your boring cars and delight millennial customers around the world; needing to go back in time to Elon Musk. all without murder This is why Android will win or in fact already has: AOSP is not bound to specialised hardware and while Apple keeps reaping the profits of the smartphone market for now, Google’s software will eat the world. Apple is not only losing the automotive market, it has showed that it cannot be competitive without owning the whole value chain, which will become very hard going forward. For these corporate leviathans to keep growing with a pace anywhere close to the last decade, they will need to become more creative when entering new markets as the rest of the corporate world has already awoken to the knowledge that software is magic that can be translated into cash for shareholders. *I actually love Apple’s in-house chip team and I care. Keep rocking. Sources: https://source.android.com/devices/automotive, 09.04.2019 https://markets.businessinsider.com/news/stocks/google-stock-price-waymo-worth-100-billion-more-than-before-morgan-stanley-2018-8-1027439248, 09.04.2019 https://9to5mac.com/2019/02/26/iphone-pricing-3/, 09.04.2019 https://www.cnbc.com/2018/10/31/general-motors-earnings-q3-2018.html, 09.04.2019 https://arstechnica.com/gadgets/2018/11/apple-services-reach-a-whopping-10-billion-in-revenue-in-q4-2018/, 09.04.2019 https://www.statista.com/statistics/267728/apples-net-income-since-2005/, 09.04.2019 https://phys.org/news/2019-02-gm-strong-profits-good-sales.html, 09.04.2019 Photo by from Aleksejs Bergmanis Pexels

On Android Automotive and why Android will “win” while Apple makes all the money in the world

Last night a coworker of mine, , gave a great talk about some of the basics of ARKit, and touched on some of the more advanced topics like touch handling on 3D objects and blend shapes. Having done AR in production for the past year at Nike (see and ), a lot of people came up to us last night after the talk to ask about some of the pain points in working with ARKit and SceneKit and whether a 3D engine like Unity is better suited for their purposes. I made a mental note of some of those questions and decided to write about how I reach a decision about which framework to use. Sonam Dhingra https://9to5mac.com/2017/06/23/nike-snkrs-ios-app-augmented-reality-exclusive/ https://www.digitaltrends.com/outdoors/inside-s23nyc-the-digital-studio-keeping-nikes-tech-relevant/ What they are, and what they do To make an informed decision, let’s understand what each of the two frameworks do and what their strengths and weaknesses are. Note : I am choosing to skip over Unreal engine because in its current form, it’s not as indie-friendly as Unity, and the ecosystem is not as approachable. If you are arriving at a decision as an organization, you should look at Unreal as well. : A full 3D engine, including an IDE which has a scene editor (allowing you to place your objects and create your world), physics engine, animation editor, full GUI for editing object properties, attaching scripts to your objects (behaviors), material editor, lighting manager (so you can bake your lighting into light maps), and a host of other assistant editors. Unity The script editing is done via an external application (Visual Studio Code is the default solution), and the language used to develop is C#. The produced output is cross-platform (i.e. games made in Unity can be easily ported to around a dozen platforms, including iOS, Android, macOS, Windows, Xbox, Playstation, Switch, etc.) A mostly barebones 3D engine, with minimal editor support through Xcode. The editor allows you to lay out your scene, and has a properties editor for your objects, allowing you to change basic properties like position, rotation, scale, and visibility features, including a materials properties editor. There is very basic support for adding SCNActions such as rotate and scale animations in a timeline. There is a lighting tab which allows you to bake your lighting, but has no real properties to tweak how that occurs. ARKit/SceneKit: All your code is in native Swift (or Objective-C if you’re still doing that), and you have to manually set up the boilerplate code to load up your scene, and perform whatever actions you want on your scene objects. You define your own architecture for writing your application logic. What do I use? The question that came up most often last night was, “Which platform should I use?” While not always cut and dry or obvious, there are a few rules of thumb that I’ve used to determine which platform to use for a particular use case. Let’s go over some of these scenarios and see which platform I would choose. You are prototyping an idea You are building a consumer app (non-game) that uses standard UI elements (UIKit standard elements like UIViews, UIButtons, UICollectionViews, etc) You are building a game You are adding AR capabilities to an already existing application Let’s examine each of these. You are prototyping an idea When prototyping an idea or determining viability of a certain use case, the overriding factor is how quickly can you get a demo version up and running. Being able to test out an idea quickly is essential in figuring out whether or not to spend weeks or months further developing that idea into a full-fledged product. You can’t spend weeks on a prototype so you need to choose the platform which will allow you to get to a workable demo quickly. That means spending less time on writing setup boilerplate code like object loading and animation and more time on getting your idea to the screen. UI is less important in this case, and a minimal interface is fine for situations like this. In this scenario, Unity wins easily. I can create a new project, drag and drop some basic (or not so basic) models into my scene, create a new script and be coding a behavior for them in under 5 minutes. Using SceneKit, it’s a lot more complicated. Even using the Xcode template for ARKit or SceneKit still requires you to write loading code, object management code, and start keeping references for your objects so you can then write code to manipulate those objects. If what you’re looking to load is anything more complicated than a simple 3D model, you may encounter importing issues (I’ve encountered several issues with SceneKit’s Collada DAE format loading) which will lead you down a rabbit hole of going into your 3D modeling application (Cinema4D, Blender, etc.), tweaking, exporting, re-importing, and testing. . Even if you set up boilerplate code to initialize your scene and develop some sort of framework to mimic Unity’s object behavior pipeline, it is still a lot of work to get an idea up and running. The only time I choose to go the SceneKit route for prototyping is when I am experimenting with a particular idea that I want to determine the feasibility of doing in SceneKit. That is, I want to know if it’s possible to do this particular thing using SceneKit’s API. It does me no good to figure out how to do something in Unity if in the end it can’t be done in SceneKit, or I would have to learn how to do it all over again. In this scenario, I would hands-down choose Unity You are building a non-game app If you already know what you want to build, and are ready to begin writing your app in earnest, then you need to determine which is the best platform for the type of app you are looking to write. If you want to have your app look native to iOS, for instance, using native UI controls, or using built in mapping, notifications or web views, then I would choose to go native and use ARKit/SceneKit. To be able to use native UI in Unity is another rabbit hole that I urge people not to do. You use native UI over Unity, but it involves building bridges to the native side using Unity’s plugin architecture. I can attest from experience that it is not a pleasant task, and you end up in a sort of uncanny valley where you are mixing native UI with in-experience (3D) UI and it just does not look good. can There are off-the-shelf plugins you can buy in the Unity Asset Store (more on that later) that you can use for mapping or web views or other native interfaces, but there is usually a cost involved, and most of the time it’s not just money, but time and effort in dealing with the integration of 3rd party code. In this use case, I would choose to go native and use SceneKit. You are building a game This is probably the easiest scenario. Even though currently there are only two platforms that support mobile phone AR (iOS with ARKit and Android with ARCore; I’m leaving Vuforia out for this argument), Unity provides the best chance of staying cross-platform. It is built with games in mind, and has all the necessary components at the ready. Physics, collisions, animation, input schemes are all Unity’s strengths. The Asset Store provides additional resources in the form of plugins, 3D model assets, GUI packs, audio effects, music, etc. It is a mature ecosystem now, with a plethora of free and paid assets. Want to build a MOBA-style game where your characters have to traverse your office in AR? There’s an asset pack for that. Need multiplayer networking to take your game to the next level? There’s plugins for that too. Need a fancy race car or samurai or jet plane or mechwarrior? There’s plenty to choose from. The amount of work needed to replicate any of the things that Unity provides in the case of using SceneKit is tremendous. Only if you already have all the necessary underlying code to do all the above things really well would I even consider using SceneKit for a game. If you take out the AR component altogether, that is, if you were building a 3D game, there is no way I would even consider SceneKit. In my opinion. there is really no choice to be made here. It is obvious I would choose Unity. You are adding AR to an already existing app This is the choice we had to make at Nike. We had to make a decision on how we would add AR capabilities to our already existing application, the iOS version of SNKRS (iOS and Android versions ). This is an already-established app in the App Store, with rich media and a lot of functionality. It has a very distinct design and follows strict style guidelines. here Trying to integrate a full engine like Unity into SNKRS would have meant integrating the whole Unity runtime, writing hooks to propagate touch events and interactions, writing plugins for things like location and network access (so we would make use of our own networking stack), and figuring out how to overlay our own UI on top of the Unity view, all while attempting to steer clear of the uncanny valley. For us, in this situation, it didnt make sense. Our use case at the time was relatively simple, and we didnt need the overhead of a full 3D engine and all its associated (and unused) functionality that comes with it. Not only that, but the addition of the runtime & scene would have added upwards of 30MB to our binary. Not something that we could do. For us, the choice was clear. Integrating SceneKit into our app was as easy as just adding another view controller into our app, just like we do for anything else. Beyond the setup code, all of the other functionality involved loading assets from the network, displaying them on the screen, and using well-known conventions like gestures and using native UI. The result is a seamless experience that looks natural. No uncanny valley here. No question about it here. SceneKit was the clear choice. The elephant in the room There are a lot of factors in choosing one technology over the other, but a deciding factor can often be “How do I get the same functionality on both iOS and Android”. While the technology and interface to ARCore and ARKit differ, your logic for controlling your scene can remain the same. This is where Unity shines. One codebase, multiple platforms. If your app is a game or has non-standard UI, then Unity may be the right choice, particularly if you are short on developers and their strength is C#. You could write two different bridges to the ARKit and ARCore APIs, then all your logic is separated and can work with whatever AR engine happens to exist on the current platform. Other Comparisons 3D model loading SceneKit falls short here. While it can support other formats like Alembic’s ABC and Wavefront OBJ’s (see and ), in my opinion the only real option is Collada DAE format, since it can hold multiple objects, material descriptions, and animations. I never had much luck importing a model in Alembic format, but that could be due to bad exports from 3D modeling software. For me, that’s reason enough not to use it. There are external libraries like Assimp and AssimpKit (an iOS wrapper) to assist in loading other formats, but they add complexity to your project. Unity wins easily here, supporting a lot of formats, including the popular FBX format, and better support for importing improperly exported files (it seems every 3D modeling package has its own interpretation of how to save files in different formats). https://developer.apple.com/documentation/modelio https://developer.apple.com/documentation/scenekit/scnscenesource Plug-ins and Assets If you are looking for 3rd party libraries for things like networking or custom UI components, both sides (native iOS and Unity) have a rich ecosystem of Cocoapods and plug-ins, respectively. If you are looking for game specific assets, such as 3D objects and audio or music, then the Unity Asset Store can fullfill your needs, while you are looking at purchasing assets on Sketchfab or TurboSquid on the native side. I’ve found that it’s usually cheaper for the same items on the Unity Asset Store due to the increased competition. YMMV. Documentation and Sample Code Putting aside Swift and C# documentation and sample code, which there is an abundance of, and concentrating solely on SceneKit and Unity API’s, the lack of SceneKit documentation and sample code is alarming. When I first began to dabble in AR and wanted to do something more involved than putting a cube on the screen, things got hairy. Want to write a custom shader or learn how to modify a group of vertices? There’s almost no docs or sample code to show you how to do that in SceneKit. I’m attempting to help people get started by writing more about ARKit and SceneKit. , , and an upcoming post try to close that gap. In Unity land, there’s tons of sample code, demo projects and a large community of people doing amazing things. SceneKit’s been around for a few years, but there’s never been much of a reason to use it, thus, a lack of resources for it. With ARKit now making heavy use of it, perhaps we will see a surge of new materials being available. Getting started with ARKit and SceneKit ARKit, SceneKit, and How to Control the World 3D Scene Layout and Object properties This is Unity’s strength. They have a fully-featured 3D scene editor, and now, with the of , they have a way of creating geometry within the scene editor. Their property editor allows you to drag and drop scripts (behaviors) onto objects and be able to edit script properties (values, lists, references) all within the editor. SceneKit is severely lacking in the editor department. It has rudimentary control of object layout and transform properties. It allows you to assign material properties, and that’s about it. It has an animation timeline that let’s you drop SCNActions to it and have some simple transform animations, but beyond that its capabilities are limited. purchase ProBuilder Conclusion The above guidelines are what I use to make my own decisions when choosing a framework at the start of a project. Your own situation and knowledge is probably different than mine, and your final decision may differ. If you are an iOS developer and have never used Unity, or feel intimidated, I urge you to check it out with an open mind. It has its positives and negatives, but having options never hurts. If you enjoyed this analysis, please recommend and share the story with others. Do you have your own experiences with SceneKit or Unity? Comment below and share your thoughts. is a developer who’s worked on more platforms and languages than he cares to admit to. He believes in building products that create memorable user experiences. To Dan, the users are first, the platforms are second. Follow Dan on or to hear more from him. Also check out the blog, where a lot of great content by Nike’s Digital Innovation team gets posted. Daniel Wyszynski Medium Twitter s23NYC: Engineering Author’s Note: Views are my own and do not necessarily represent those of my employer

The Match-up: SceneKit or Unity for ARKit?

A decade after the release of iPhone, our ways of communication changes significantly. Instead of talking face to face, we send message to each other and we identify where the message comes from by letting our phone tells us who the sender is. What if I told you that your trusted device can betray you and act on your behalf? What if anyone can be “you?” The horror story of Apple’s product continues. And today, on the land of “We just blindly trust and now we are f**ked,” we have two new members. Remember that super convenient, magical feature that allows you to send SMS on your Mac through your phone? It turned out the “it just works” part is only possible because your phone will just process any command send to it asking it to send SMS from the current number. And our beloved personal assistant, Siri? It’s also a dummy that just processes command without checking the command is from you. Both daemons don’t verify message origin and process the request when IDS delivered the request to them. security IDS I need to be clear that just because daemon doesn’t verify message origin doesn’t mean Apple is dumb in security. By default, IDS is supposed to only allow the account owner (limited to devices signed into your iCloud account) to send message to those restricted services (SMS, and Siri iCloud). Those protection should be sufficient as long as Apple ensures no message can reach those restricted service unless it’s from account owner. But then, someone in the IDS team think it’s a good idea to allow message itself being able to override which service it suppose to be delivered to. What this means is that someone can tell IDS to send a message over iMessage service (which everyone can send message to other accounts since that’s how message works 😛), and inside the message, instead of the normal iMessage payload, the person can include instruction to say “actually this message is meant for SMS service” along with the payload for SMS service. Once IDS delivers the message to the on the target’s device over iMessage service, the daemon sees the instruction to override target service and then pass the message to the new target service, which the involved daemon doesn’t check the sender. LOL we bypassed the wall that keeps your identity safe. that identityservicesd iOS Personally I found this issue really interesting because it raised some fun questions: How are we suppose to separate individual identity away from the device that suppose to be your identity? Should individual be blamed for things their device did without the owner’s knowledge? I mean, with the SMS issue, one can literally put words in other’s mouth. All records will show the messages were sent by the owner of the device when the reality is that the device send those without the owner’s consent. The SMS is even logged on the victim’s device which cannot be achieved with traditional SMS spoofing techniques. There are quite a few creative ways to use this and I freaked out when seeing the bug actually worked 😅. The Spaghetti Flavor of iOS 🍝 (identityservicesd) is a huge spaghetti in iOS now. Based on the description in iOS Security white paper, the initial goal of IDS is to be something that allows iOS devices (and Mac) to exchange device identification (public key, push token) used to establish the end-to-end encrypted communication with each other. Somehow down the line, the IDS itself becomes a message transport for a lot of Apple’s daemons that need inter-device communication on iOS. Digging through the disassembly for a “suppose to be generic” message sending method on the daemon side, you can find a lot of service specific hack in there to disable or enable certain features on individual message 🤦‍♂️. IDS Somewhere in the spaghetti, identityservicesd will try to insert an “IDSAdHocServiceKey” with target service identifier if it believes the service that’s trying to send message is not capable of receiving message directly (AdHoc type 5), and then send the message using the primary service associated to the target service. I don’t know why this is there since there is no service actually uses this but maybe IDS engineers just want to better prepare for the future? Anyway, the send part is not that interesting, what’s funny is the message handling part. Upon receiving the message from Apple Push Notification service, identityservicesd will try to find the service the message is for and then dispatch the message to clients that interested in the message. During this process, the daemon checks if the message contains the “IDSAdHocServiceKey” and override the target service if the key is present. Here is where everything went south See the issue? One thing they missed is to check whether or not the overriding service is expecting to be delivered from primary service. The right way to do that would be check and see if target service has an AdHoc type of 5 before actually overriding it. All that’s left for an attacker to do is just to figure out which daemon doesn’t check message sender and craft message to have fun with them. Below is a video demo of SMS relay. It’s a little creepy to see the phone send out text without human touching it 😛 The strange string in the end is caused by a bug (or a feature?) in iOS 11.2 when it thinks the target is capable of receiving iMessage… Fixing IDS If you remember , you can see there are a lot similarities between these two. It felt like there is a common assumption inside Apple that clients using IDS don’t need to do extra work to ensure the message is delivered in the expected way… If that’s the assumption, maybe IDS should have a default behavior of not delivering message to clients from senders other than current account unless the client has a special entitlement. Then the product security team can conduct periodic security audit on IDS clients that have that special entitlement to ensure other daemons won’t have the similar issue again in the future. the HomeKit issue The issue of IDS bypass was patched by Apple sometime between Dec 19th and Dec 20th by having IDS server strip of “IDSAdHocServiceKey” from individual messages. Maybe in the future iOS releases they will properly handle the message ¯\_(ツ)_/¯ Apple Security Bounty is a joke Okay, I’m not sure if it’s just me not compatible with Apple’s product security team or if the product security team is always trying to be a jerk. My communication with them got a lot responsive after involving the press in the HomeKit issue. I found the IDS bypass issue on Dec 15th, then spent Dec 16th on scoping the affected daemons. Since I don’t want to do all the work free for Apple, I sent product-security an email asking about if I can get an invitation to join their security bounty program so I can report this one with some guarantee of the submission will be a bounty submission. Here is the reply I got from them. All reported issues are evaluated against the Apple Security Bounty program’s criteria, however participation is by invitation only. Information about the Apple Security Bounty program is available in the iOS Security Guide at . https://www.apple.com/business/docs/iOS_Security_Guide.pdf We would appreciate any additional information you are able to provide about the issue you mentioned. Submission of a qualifying issue is necessary but not sufficient to qualify for an invitation; Apple Security Bounty participation requires responsible disclosure: no public discussion of the issue until a fix is released and available. … For an issue to qualify, researchers must fully disclose details to Apple and coordinate with us so the issue can be fully addressed prior to any disclosure of details. Early disclosure disqualified your original issue. “For an issue to qualify, researchers must fully disclose details to Apple and coordinate with us” did the first one, coordination was unfortunately not possible due to lack of communication from Apple’s side. Only after 9to5mac threatened publication of the article did Apple ever get back to me with something meaningful, and now they blame me for “early disclosure” ¯\_(ツ)_/¯ BTW do anyone know about this “requires responsible disclosure” part? It’s not documented in any place… Then on Dec 19th had a call with them mostly talking about the HomeKit writeup revision and in the end I asked about bounty invitation again and basically the lady still blames me, but she said she will ask around and see if there is a solution. I tried to be nice and gave them some hints on where the IDS issue is at and wrapped up the call. Then the next day they fixed the issue from server side and said nope again. After that it’s basically just me sending a long email expressing my frustration and refusing to play on their terms. Which I assume that email resulted them putting me back to the do-not-reply list since I haven’t hear back from them since then 🙃. Thanks for reading through and I’d really like to get some feedback to calibrate my understanding of the world… Am I the one being unreasonable here? I was just asking for an invitation, not even say asking Apple to give bounty on the HomeKit issue. Should Apple just expect all security researchers work free for them? That’s the horror story of Apple’s product security. Hope you won’t see a season 3 from me anytime soon. Merry Christmas :) PS: Someone should probably take a closer look from inside if “bad week” just keeps happening. It only took a new grad a Friday evening to find something like this, who knows what else is hidden under the imagination of “secure and private.”

What if anyone can be you?

Apple built a super secure door, left the key on the door and forgot to build the wall around the door. TL;DR — Ever since the existence of connected home accessories, is always something people worried about. So many things that can go wrong with your fancy new BTLE lock with software running on it, compared to old mechanical locks. There was a period of time where the market of connected home accessories is really chaotic, manufacturer shipping poorly implemented accessories with terrible security. I was really happy when announced HomeKit back in 2014, promising to offer a secure and private way to control connected home accessories. security Apple The thing is, a lot of time there is really no way for people to check whether a thing is really secure or not. And for HomeKit, it turned out not to be so secure after all. HomeKit didn’t check the sender of remote message before processing the request, which ended up allowing potentially anyone to remotely control HomeKit accessories in the home. HomeKit is actually an umbrella term covering both the software on your iOS device and a communication protocol. The software on your device provides a centralized place for you to manage home and accessories (daemon), and the communication protocol (HAP) used by the software on iOS to talk to your HomeKit accessories. The security issues with watchOS 4 and iOS 11.2 were , . on daemon side the underlying HAP exchange is not breached So, what went wrong with HomeKit? A not too technical version Imagine HomeKit as the butler for your home, and when you are not at home, you can send iMessage to it asking it to do things for you. Say you want to unlock the front door, you would send a message to HomeKit asking it to unlock the front door. Once HomeKit receive the message, it should check that the message is sent by you and then unlock the door as you have asked. Except that in reality, HomeKit doesn’t check who sent the message and it will happily unlock the door whenever someone ask it to do so. In order for HomeKit to do something, the message needs to contain a unique identifier that identifies the object (accessory, scene, or room) in the home. Normally it should be impossible for anyone to figure out the unique identifier for those objects unless you are actually authorized to access that home in HomeKit. However, there are two separate bugs, one in watchOS 4 - 4.1, and another in iOS 11.2 and watchOS 4.2, allow someone to figure out those unique identifiers without authorizing the person to access the home in first place. With those unique identifiers, remote attacker can ask HomeKit to do almost anything. Apple disabled the ability for people to send HomeKit message to others on December 7th as a temporary solution while it works on a proper fix for future iOS release. As a result of that, sharing home to new users and remote access for existing shared users are not longer available for users on iOS before 11.2.1. A more technical version HomeKit daemon is built upon the request-response pattern. Each action you do in your favorite HomeKit app is being translated to a request, sent to daemon. The daemon processes the request, perform the operation, and then reply to the request. For HomeKit app running on iOS device, all of the communication is done over and the access permission is enforced by TCC (the permission popup in iOS). All information discussed in this article are based on disassembling HomeKit daemon binary bundled with iOS SDK. Hopper is a great tool for this kind of task ;) XPC To allow you to securely access your accessories when you are not at home, and share your home with other users, Apple built a remote cloud messaging platform (same one behind iMessage). Messages across users, devices, and apps over multiple transports are processed by the HomeKit daemon with a centralized message dispatcher. Fun things happen when someone try to design a system that’s too flexible. For XPC messages, HomeKit daemon doesn’t really need to perform extra validation for messages since TCC and iOS in general have already done all the hard work (Entitlements 😉). For normal daemon to daemon remote communication, the actual message is encrypted by HomeKit secure session, and the encrypted packet is then sent over the remote cloud messaging platform. The issue with HomeKit is how the daemon handles remote message without a secure session. Instead of having daemon discard the message that doesn’t make sense with the state machine, the daemon treat the message as a normal request and processed it anyway. Apple addressed the issue with iOS 11.2.1 and tvOS 11.2.1 by improving message handling on the daemon side. Since HomeKit daemon handles request without secure session as a normal request, we can send messages to home manager and have it leak information about the home and its accessories. Those information could then be used to instruct HomeKit to perform actions it shouldn’t do in the normal situation. There are two ways we could gather the required information from home manager, one was available with watchOS 4 and 4.1, and the other one was introduced in iOS 11.2 and watchOS 4.2 🙃. Both are now patched as of iOS 11.2.1. For watchOS 4 and 4.1 Of all the messages you can send to HomeKit daemon, there are some really interesting ones. There is one message that will let HomeKit on watchOS to reply with a list of home identifiers, along with the public and private key that used to encrypt home data and communicate with accessories to the sender. Once an attacker got the reply, it’s game over for HomeKit. With pairing identity and private key, the attacker can trick HomeKit into thinking him as the owner of the home, even after Apple fixed the messaging issue. A small tool for verifying the vulnerability But yeah, now we have all the information we need to tell HomeKit daemon to do things, we can just send messages targeting the right home, and control every thing in user’s home (including IP cameras 😅). You can do so many things Fortunately Apple deployed a temporary fix on the remote cloud platform sometime around mid November, disabling inter account messaging targeting an Apple Watch so only the iCloud account on the Apple Watch can send message to the watch. Apple properly addressed the vulnerability of sending full pairing identity with watchOS 4.2 by improving message origin validation and only replying with public key. For iOS 11.2 and watchOS 4.2 I sent the report about HomeKit mishandling messages back in late October (more on communication with Apple’s product security team later), I’m surprised to see when iOS 11.2 officially released, they introduced new ways for remote attacker to control the home (and actually making it a lot easier). Before iOS 11.2, to control someone’s HomeKit accessories remotely, the target user needs to have an Apple Watch running watchOS 4 or 4.1 so the attacker can get the enough information about where to send the message. However, in iOS 11.2 (and watchOS 4.2), HomeKit introduced a new message on home manager which didn’t properly verify the message sender and will reply with sensitive home information. So now in order for the attacker to remotely control the home, the target just need to have an iOS device on iOS 11.2, which with the date issue happened a few days ago, a lot of people have updated. Thanks Apple! 🤦 Action Set execution That’s it, no fancy buffer overflow, just mishandling messages 😝. Level of ignorance on security? macOS root level. Communicating with Apple Honestly at this stage I think it’s safe to say marketing team at Apple can probably get whatever they want from engineering team with crazy deadline. Those message mishandling issues were discovered back in late October, and was disclosed to Apple’s product security team the next day I found it (Oct 28). I got email (on October 30) from Apple’s product security team saying they are investigating it through the entire November. During that time, I sent multiple emails (Oct 31, Nov 2, and Nov 16. Additionally there was one sent to Federighi on Nov 27.) to try to ensure the engineering team understood the issue but no reply at all. I observed that Apple deployed the watchOS server fix so I assumed they just being typical Apple not replying people (hello radar 🙃), so I thought the engineering team should have sufficient understanding of the issue and hoped they properly fixed the issue with iOS 11.2. But then iOS 11.2 officially released, while they did fix some issues in my report, they didn’t do a full security audit to ensure all messages are being handled properly, and instead they introduced a new message which makes the whole attack a lot easier 🤦. ONE It’s funny about how they prioritize the fix, in my initial report, I tried to list them by severity like this: HomeKit daemon should differentiate messages from different transports …Description of the issue… — — — Message for resetting home configuration … — — — Message for getting home data and encryption key … — — — Can remotely add/remove homes … — — — And somehow the engineering team managed to fix almost everything expect the one on top about differentiate messages from different transports 🤷‍♂️. Since they won’t reply to my emails and they made the situation worse in latest release, I wasn’t really sure what to do next. I asked around and lucky someone was able to poke a person they know working at product security team, and finally I was able to get a email reply from the team. I guess that’s how product security works now? I have to know someone to get my security issue handled properly? The guy replying is really nice but cannot provide any useful information on when Apple can fix the new issues caused by their negligence of the original report…So I ended up reaching out to friend at 9to5mac and turned out Apple PR channel is much more responsive than product security, from them reaching out Apple PR to Apple come up with a temporary fix all happened with 48 hours. No wonder nowadays people just throw security issues on Twitter right? What a world we live in. iOS 11.2.1 was released on December 13th which properly addressed all reported issues with HomeKit. So yeah, be vigilant when someone make the promise that something is secure. And it’s really funny that the low level infrastructure in the codebase behaves differently than the rest of the components in a way that engineer is not expecting, which eventually resulted a completely security breakdown of the entire system. Hope Apple will be more careful in the future. Some information were removed from this post per the request of Apple Product Security.

Your home was not so secure after all

1 and 2: (9to5Mac — October 2014) ‘iPad Air 2’ and ‘iPad mini 3’ with Touch ID & Burst Mode confirmed, show up early in iTunes 3, 4, and 5: (9to5Mac — July 2015) iTunes 12.2 update indicates new gold, dark blue, dark pink iPod nano, touch + shuffle colors 6. (9to5Mac — July 2016) Apple leaks unreleased Space Black Milanese Loop Apple Watch band on Czech store site 7. (The Mirror — September 2016) Apple accidentally reveals iPhone 7 on Twitter minutes before official launch 8. (MacRumors — October 2016) Images of New MacBook Pro With Magic Toolbar [Touch Bar] Leaked in macOS Sierra 10.12.1 9. Apple somehow accidentally uploads HomePod firmware that contains (Guilherme Rambo — July 2017) glyph of unreleased iPhone 10. Apple’s iOS 11 GM somehow ends up in the wrong hands, gets sent to 9to5Mac who reveal press render of upcoming and (9to5Mac — September 2017) Apple Watch Series 3 several other iOS 11 details Tim Cook, 2012: Apple will ‘double down on secrecy on products’ Update 09/09/2017 18:15 ET: Added iTunes leaking the new iPods in July 2015 and the Apple Watch Black Milanese Loop leak, bringing count from six to ten. Tweet me @JackGMarch if I’ve missed any other leaks from Apple!

Apple has now been the source for ten Apple product leaks since 2014

Photo by Jay Wennington on Unsplash This is a follow up post to . If you haven’t read that post yet, go read it now and then come back . It provides the background to this post on why we need dark mode to be an inclusive design consideration. Solving Molly Watt’s Problems 🙂 by Charles Reynolds-Talbot Everyone might benefit from a dark mode at some point or another; if you suffer with migraines, use your device at night, in a poorly lit room, or maybe it’s a personal preference — but. Molly Watt a dark mode. needs Molly has , which is a condition that has left her deaf with 5–degree vision in one eye, but Molly is still a visual person. One of the problems Molly has when interacting with digital services is high contrast; especially white backgrounds with black text. Usher Syndrome I’ll get onto why I think [and others] should be responsible for solving this problem. But first, the steps that have led me to that conclusion (I am a designer of things that end up on the UK government website, GOV.UK). Apple pride themselves on championing the needs of users, designing inclusively and building digital services that are accessible to everyone. And yet, the website is practically all white background with black text. It creates too much glare and makes it impossible for Molly to focus. . GOV.UK It’s unusable The challenge How might we allow people to change the text and background colour to suit their needs, without effecting images, video, meaning or brand? Starting with one thing I started with the assumption that a style switcher would solve this problem — by designing a toggle that would let users switch between a light and dark mode when needed. GOV.UK prototype to test an idea. Reading the content in dark mode would be bearable for Molly, and might benefit others too — enhancing the experience for a user with a headache, or someone browsing in a poorly lit room. Designing for the few, makes things better for the many. Thinking of the many I then thought about people who have different access needs to Molly. People whose needs could be met with a similar solution. Molly’s has a accessibility toolbar, allowing people to switch between a number of different colour combinations and even change the size of the text. own website classic Designer recently implemented a great version of this on his that includes the ability for dyslexic users to change the typeface to one that provides increased readability for them. Craig Abbott own website There used to be a lot of websites during the 00s that had these accessibility toolbars, but it’s something that seems to have . Surely, if we build one of these for , that will solve the problem. fallen out of fashion GOV.UK The toolbar on Craig’s website is great, until you leave. Well… While the outstanding efforts to make these websites more accessible should be celebrated, neither solves the problem. These solutions exist in a vacuum. As soon as the user navigates to a different website that doesn’t have one of these toolbars, the customisation is lost and the experience is broken. Even if the next website did have one of these toolbars — so the option was available to make it more accessible — it wouldn’t know the settings from the previous website, so the user would always be starting from scratch. really More importantly, if the presence of glare from the bright white literally hurts your eyes and head, you don’t want to have to endure this everytime while hunting around for the controls to change the colours. This isn’t inclusive. It’s a hack, and that’s OK for now — but. We need something better. We need an option for . maybe dark by default Something slightly better Having tested initial ideas and assumptions, we know that doing this on a website by website basis won’t help. People need a way to change the text and background colours consistently, across all websites to better suit their needs. The on how to do this , but I wouldn’t say the steps in these guides are easy for everyone to follow and they’re still a hack. BBC have guides on your computer only At the time of writing, , so those guides won’t help more than half the time. people use their mobile device more than they do their desktop computer We need to be providing inclusive design solutions that meet the demand and expectations of the digital era we live it today. Apple [and others] need to solve this problem When most people think or talk about accessibility, they default to the idea that a person is usually at home, using a desktop computer, with some sort of screen reader software. This isn’t the reality of everyone with access needs. Molly is 22 and like a lot of people, uses her iPhone and iPad while living a busy work and social life to access the internet and stay connected. Molly needs assistive technology on the devices she uses while on the go, not on a stationary desktop computer. Apple provide — and are probably leading — in-built accessibility features to help people with access needs use their technology which is brilliant — but. One thing I don’t think they do very well, is shout about it enough. I would love to see Tim Cook talk passionately about how Apple are making things easier for people with access needs. Unfortunately, this year I think we’ll instead see overly-excited cheers at new emojis. Some of the new emoji coming to iOS, macOS and watchOS later this year. Molly has talked and written about , which is great. But, one thing Apple haven’t yet added is the option to switch to a , that would make changes across the Operating System (OS), native Apple apps, third-party developer apps and web browsing. how Apple products have made her feel less excluded from society true dark by default mode This would solve one of the biggest problems and struggles Molly has with using her technology, and benefit a lot of other people too. Apple [and others] need to be making inclusive considerations for in-built accessibility features like a dark mode that just works, without the need for continuous tinkering or hacks. design Everyone should be able to customise their settings for a consistent accessible experience across all their devices, so they can interact with and consume content without barriers. Apple might be getting smarter On iPhone and iPad there has been the option for a while to Invert Colours. You can map this as an accessibility shortcut, so when you triple-click the Home Button, the colours will invert (white to black, black to white, etc). The problem is that this inverts everything, which makes images unusable, brands unrecognisable, and can create confusion in interactions that previously had clear context. Inverting everything also causes a previously dark interface to become glaringly bright, which is not a solution to the problem. There is a new feature coming called Smart Invert, which can be found in the public beta of iOS11. Unlike Classic Invert (as it is now called), this does not invert everything and appears to be a baby-step towards to a true Dark Mode. Previously bright interfaces like Mail and iMessage, become dark. Interfaces that were already dark like Clock and Calculator, do not change. Likewise, the Home Screen doesn’t change much and your photos stay the way they were supposed to be. I am unable to take any screenshots, as weirdly the images end up re-inverting themselves which I’m hoping is a bug. 9to5mac have some good images of Smart Invert in action. Unfortunately, third-party developer apps still mimic the Classic Invert, so everything, including images are changed. This means apps like Instagram are rendered unusable and Twitter — which has it’s own Dark Mode option — is flipped for the worse. Browsing the web is just as difficult as it was before. I hope that this is something that app developers will eventually be able to take advantage of, by specifying which parts of the interface should and should not change when using Smart Invert. However, this would still need developers to make the decision to implement this, and there are no guarantees they will. Especially depending on the size of the app, this may end up being perceived as too much work to bother. Likewise, I have no idea how this would work with browsing websites, but if it required every website developer to do something, it would never happen. This new feature should be called Invert** ** really Slightly Smarter But Not Smart Enough . So, what is the solution? I don’t know. Right now, we have a series of different hacks. Some of these hacks put the responsibility on designers and developers to implement one-off solutions that will only work on their app, or website. Others require the user to know a decent amount about their technology in the first place, to know how to successfully configure their device when it’s an option. And then there are the things that you need to know even exist, before you can start taking advantage of them. Accessibility features aren’t shouted about as much as they should be. just What can I do? From my position, I can push the teams at to do more research into an accessibility toolbar as a temporary solution, because the information and services on that website meant for everyone. GOV.UK are Beyond that, we need companies like Apple, Google, Windows and others that design and build OSs, devices and browsers to consider the needs of users like Molly and solve the problem once, to solve it everywhere. Please share your experiences and ideas to help put the pressure on, and hopefully one day we will have a solution that not only works for Molly, but works for lots of other people too. Originally published at which is dark by default (with an option to switch to light) because ( ) doesn’t have a dark mode, which means I can’t even send Molly here to join the conversation and read a story that’s about accessibility and her. charlesrt.co.uk Medium Medium Staff 🙄 Read next: Solving Molly Watt’s problems _Molly Watt has Usher Syndrome._startupsventurecapital.com Solving Molly Watt’s problems

Stories, News & Mentions about 9TO5MAC

9to5mac’s Stories on HackerNoon

9to5mac's News & Mentions