And for the phone number part, “If Bluetooth is ON on your Apple device AND you’re trying to Airdrop something (which you’d expect to send some identifying information) or connect to a new WiFi network (same)...”

To be fair I wouldn’t necessarily expect those actions to send out a hash of my phone number, but the threat indicated by the title is definitely overblown.

AirDrop has to send out a hash of you so that way the surrounding devices that are set to "contacts only" can use it to determine if you're in their contacts list (and therefore that it should respond).

I'm not sure why WiFi has to send a hash of your phone number, I thought it just prompted nearby devices to ask if they wanted to share it. Maybe there is some functionality there relating to determining if the sender is in your address book, I'm not sure.

Yes, it will only share the WiFi password with devices in your contacts.

> I'm not sure why WiFi has to send

AirDrop operates on both Bluetooth and WiFi

A part of the problem is that bluetooth is almost always ON on iPhones. The way one typically toggles it from the control center only disables bluetooth for a short period of time (24 hours), after that, it turns on again. One has to go into settings to actually disable bluetooth.

And it's the same shit with Wifi. Hitting the button in the control center merely disconnects from the current network; to actually turn it OFF, you have to go into the settings. I hate that.

To be fair I quite like that feature. Usually if I'm disconnecting from a WiFi it's because it's not working very well and I want to use my mobile data instead. If I forget to turn it back on I'd end up using way too much data.

I hope you realize that doesn't mean that you disconnected.

Try opening an ad-monetized app that requires network connection to load the ads. Make sure cellular date for that app is off. You'll get ads. Unless something has changed in the past few weeks, you should see ads load despite the fact that they should not in this scenario.

This means the Wi-Fi isn't off, isn't even in a respectful hibernate state, it's on but telling you it's off. It's your child telling you "yes mommy/daddy I'll do it right" and then cuts corners knowing you're going to trust them.

In the past few weeks my iPhone X has been having a strange Wi-Fi bug where it says it's on in the top corner of the screen, but in settings it says it's off. I didn't turn it off. When I go to turn it off, it's frozen and I have to restart settings. I'm highly suspicious it's related to Apple's Wi-Fi and Bluetooth default hibernate code or implementation of that code.

Apple screwed the pooch on this one. They should allow us to toggle the hibernate mode or long press to choose whether to go into hibernate or actually turn off, not force us to use it in a misleading way.

I've trained myself to always turn it off in settings, it's annoying, but it fits apple's product motto:

It just works.

Fair point, but they could just have used short/long press to have both options, as mentioned elsewhere in this discussion.

Yeah true, they could easily give both options

Gotta love the dark pattern. I remember when they made the change, I was pretty frustrated with that.

"Dark pattern" seems too strong. Apple doesn't benefit from your turning Bluetooth on and isn't trying to manipulate you into doing so.

It's fixing the annoying issue of today's AirPods failing because of something I did yesterday afternoon which I forgot.

Apple does benefit from turning bluetooth on.

Your phone will locate and report bluetooth ibeacons, and allow apple to update their crowdsourced location databases.

The same thing with wifi (which has the same behavior in control panel)

It would have been SO SIMPLE to have a nicer pattern. short press to disconnect, long press to turn off.

>It would have been SO SIMPLE to have a nicer pattern. short press to disconnect, long press to turn off.

Indeed, this is exactly what I expected would happen when I long pressed and I was disappointed when it didn’t. There are definitely times like this when Apple’s UX gets more credit than it deserves.

Apple could have made that a three way toggle, or even made turning off Bluetooth permanently through a 3DTouch action or haptic long press action. Many people provided feedback on this when iOS 11 was released. Apple has not shown any willingness to solve this for Bluetooth or WiFi (both toggles in Control Center work the same way).

I mean, iPhone's have a somewhat checkered history with their batteries failing.

Which is one of the reasons why I'd always leave Bluetooth/WiFi off by default, and only turned them on when I actually need them: Cut way down on the battery draw.

That option is now gone, instead the default has become "everything is always on", drawing on the battery, thus forcing you to recharge more often, cutting down on the lifespan of your battery.

Not saying that was Apple's plan all along, but it's one of the outcomes of this pointless change. When the solution to this could be as simple as "double-tapping the icon will turn it off permanently, tapping once temporary".

> That option is now gone,

....No, it's really not.

You can still turn WiFi and Bluetooth off (really off) from the Settings app, and they will stay off until you turn them back on.

You can even turn them back on from Control Center.

Meanwhile I was absolutely thrilled they made this change. I can't count the number of times I realized WiFi was off because I had temporarily disabled it earlier as I stood just on the edge of my network's range and forgotten to re-enable it again.

Now imagine everyone less tech savvy than us who doesn't know why their bluetooth headphones won't work.

My family loves their iPhones but I don't think anyone knows how to swipe up from the bottom to check the control panel, much less what the bluetooth symbol is and how they should reenable it if their fat-finger disabled it one day. Or how to even troubleshoot that as a possibility.

Calling it a "dark pattern" is a bit silly and dramatic. This simple feature saves users a bunch of headache.

If you want to perma-disable bluetooth, you can toggle it off from the phone options instead of the quick menu. It's a great UI trade-off.

> If you want to perma-disable bluetooth, you can toggle it off from the phone options instead of the quick menu. It's a great UI trade-off.

It's not really a great UI trade-off.

It made the usability for a whole lot of users worse, all on the basis of other users forgetting what hardware they previously disabled/enabled.

Now you are forcing everybody who doesn't want BT to be always on, to always deep-dive into the options if they still want to use it for a moment. Which is something that the quick menu originally was supposed to be there for. So overall it's pretty much a step back.

Which is kinda sad, because there are more than one solutions to that which could have made everybody happy. Like giving a setting that defines the quick menu icons behavior (temporary vs permanent disable), or the ability to press to icons several times to at least toggle between temp/permanent disabled and on.

IIRC in previous versions of iOS, a Bluetooth icon would be visible when enabled. After reading the article, I thought, “Well, my Bluetooth is off.” But it sure wasn’t.

Agreed. It is weird that they just hash the phone number and don't salt it with something else. Even just appleid+phonenumber would be huge and prevent pre-attacks.

It's what about an hour to calculate the SHA of all 10 digit numbers in the US?

I was curious: my Laptop needed 18 minutes.

haha, I checked my source and I had the units wrong so I was off by a factor of 1000. Looks like 8x GTX1080s can do almost 3 billion SHA256 hashes per second, so you could just brute force these with no table with the right hardware.

Then the problem is: “You’re leaking your Apple ID to everyone in your contact list!” or more, depending on how exactly they’d plan to distribute Apple IDs to everybody else. The hash of the phone number thing is to provide the “contacts only” airdrop thing.

I'm missing what you are saying, sorry. If I know your email already, nothing is getting leaked. If I don't know your apple ID email, I have to brute force all combinations of email concatenated with your phone number to figure it out. If a stranger doesn't know either piece, they'd have to pre-image the entire space which is nigh impossible (all phone #s X all email addresses)

It’s convenient to just have a phone number be the piece both sides know. It’s not as magical if you need to also give your AppleID to every single contact manually, and if you have some sort of Phone Number to AppleID lookup service it’d be abused just as badly is what I’m saying here.

You're right, but they probably have/want to cover the case where you've given someone just your phone number (or just your email).