Linked List: October 14, 2019

Monday, 14 October 2019

‘How Safe Is Apple’s Safe Browsing?’ 

Matthew Green, writing at Cryptographic Engineering:

When Apple wants to advertise a major privacy feature, they’re damned good at it. As an example: this past summer the company announced the release of the privacy-preserving “Find My” feature at WWDC, to widespread acclaim. They’ve also been happy to claim credit for their work on encryption, including technology such as iCloud Keychain.

But lately there’s been a troubling silence out of Cupertino, mostly related to the company’s interactions with China. Two years ago, the company moved much of iCloud server infrastructure into mainland China, for default use by Chinese users. It seems that Apple had no choice in this, since the move was mandated by Chinese law. But their silence was deafening. Did the move involve transferring key servers for end-to-end encryption? Would non-Chinese users be affected? Reporters had to drag the answers out of the company, and we still don’t know many of them.

In the Safe Browsing change we have another example of Apple making significant modifications to its privacy infrastructure, largely without publicity or announcement. We have learn about this stuff from the fine print. This approach to privacy issues does users around the world a disservice.

If Apple needs to do things differently in China to comply with Chinese law, they need to explain exactly what they’re doing and why. Otherwise people are going to assume the worst. “Trust us” is not good enough. If they’re embarrassed to explain in detail what they’re doing to comply with Chinese law, then they shouldn’t be doing it.

Trust but Verify, ‘Safari Fraudulent Website Warning’ Edition 

Via Dino Dai Zovi, a user on Hacker News disassembled the code for Safari’s Fraudulent Website Warning feature and verified that it only uses Tencent (instead of Google) if the region code is set to mainland China.

Safari’s Fraudulent Website Warning Feature Only Uses Tencent in Mainland China 

Apple, in a statement to iMore:

Apple protects user privacy and safeguards your data with Safari Fraudulent Website Warning, a security feature that flags websites known to be malicious in nature. When the feature is enabled, Safari checks the website URL against lists of known websites and displays a warning if the URL the user is visiting is suspected of fraudulent conduct like phishing. To accomplish this task, Safari receives a list of websites known to be malicious from Google, and for devices with their region code set to mainland China, it receives a list from Tencent. The actual URL of a website you visit is never shared with a safe browsing provider and the feature can be turned off.

After quoting Apple’s statement, Rene Ritchie has more details on how the feature works, including the fact that the URLs you visit aren’t sent to Google (or Tencent) — hashed prefixes of the URLs are sent. This became a story over the weekend when a story by Tom Parker at Reclaim the Net ran under the alarming headline “Apple Safari Browser Sends Some User IP Addresses to Chinese Conglomerate Tencent by Default”.

My assumption was that Apple was only using Tencent in mainland China, where Google services are banned. Apple’s statement today makes it clear that that is true. But Apple brought this mini-controversy upon itself, because Apple’s own description of the feature doesn’t specify when the Fraudulent Website Warning feature uses Google and when it uses Tencent. Apple’s description simply says:

Before visiting a website, Safari may send information calculated from the website address to Google Safe Browsing and Tencent Safe Browsing to check if the website is fraudulent. These safe browsing providers may also log your IP address.

NYT: ‘Trump Followed His Gut on Syria. Calamity Came Fast.’ 

David Sanger, writing for The New York Times:

President Trump’s acquiescence to Turkey’s move to send troops deep inside Syrian territory has in only one week’s time turned into a bloody carnage, forced the abandonment of a successful five-year-long American project to keep the peace on a volatile border, and given an unanticipated victory to four American adversaries: Russia, Iran, the Syrian government and the Islamic State.

Rarely has a presidential decision resulted so immediately in what his own party leaders have described as disastrous consequences for American allies and interests. How this decision happened — springing from an “off-script moment” with President Recep Tayyip Erdogan of Turkey, in the generous description of a senior American diplomat — likely will be debated for years by historians, Middle East experts and conspiracy theorists.

But this much already is clear: Mr. Trump ignored months of warnings from his advisers about what calamities likely would ensue if he followed his instincts to pull back from Syria and abandon America’s longtime allies, the Kurds. He had no Plan B, other than to leave. The only surprise is how swiftly it all collapsed around the president and his depleted, inexperienced foreign policy team.

I’m starting to think this guy is a terrible president.