News for hackers. Stuff that matters.
Re:Apple iOS 13.1 Personal automation via Shortcuts by jasongill on Thursday September 26, 2019 @10:35AM (#21081233)
The list of auto-approved items seems somewhat arbitrary, but I think they had privacy concerns in mind when they made the list (although it seems stupid that you can't override those protections if you'd like).

All of the ones on the "cannot be run automatically" list are things that a bad actor could do if they had your phone, like wait for a certain time of day, or move your phone to a specific location, or bring it in range of a particular bluetooth or wifi device.

But then, NFC is on the "can be run automatically" list, meaning that a bad actor could touch your phone to a NFC tag to trigger an action, so that doesn't make much sense. The rest of the items on the "can be run automatically" list are all ones that require your phone to be unlocked (I think).

Very odd choice by Apple for something that will be used by relatively few people and would greatly increase the usability of the feature

Re:Apple iOS 13.1 Personal automation via Shortcuts by barkerja on Thursday September 26, 2019 @12:05PM (#21082332)
That's true about the potential for bad actor, but it's also true for many false positives.

Passive automations based on location, bluetooth, wifi, etc. stand a good chance of many accidental triggers. Connections are flaky, location accuracy is flaky; without some form of throttling mechanism or way to better control accidental firings, it should remain manual.

Re:Apple iOS 13.1 Personal automation via Shortcuts by graeme on Thursday September 26, 2019 @10:56AM (#21081450)
The NFC automation is tied to specific tags. So the thief would have to be in your house tapping a specific tag you setup.
Re:Apple iOS 13.1 Personal automation via Shortcuts by jasongill on Thursday September 26, 2019 @11:05AM (#21081531)
Yes, but what if the NFC tag was on your keychain with your phone, which the attacker also had? That seems far more likely than being able to spoof a Bluetooth device that your phone had already paired with in the past (yet that one is in the list of "not automatic" choices)
Re:Apple iOS 13.1 Personal automation via Shortcuts by marksomnian on Thursday September 26, 2019 @02:32PM (#21083950)
When the attacker has your keys and your phone, you have bigger problems.