Re:Apple iOS 13.1 Personal automation via Shortcuts
by extrapickles on Thursday September 26, 2019 @05:22PM
(#21085689)
The malicious person would then click "Always Allow" while they are setting up the shortcut. It might be better if it worked like the location/bluetooth prompt, where some time later, it would prompt you if you still wanted that action to occur.
Re:Apple iOS 13.1 Personal automation via Shortcuts
by MaysonL on Thursday September 26, 2019 @09:06PM
(#21087486)
Make the allow and always allow options require Face ID, Touch ID, or passcode…
Re:Apple iOS 13.1 Personal automation via Shortcuts
by extrapickles on Thursday September 26, 2019 @11:12PM
(#21088069)
You don't need them to authenticate again, as the phone would be already unlocked.
What you want to do is periodically (at a random time each time) ask the user if they still want it to do the privacy sensitive action still. This way, it vastly increases the chances of detection if the action was added by a third party.
"The shortcut 'Foo' wants to run. Do you want to allow it?
- Never
- Not this time
- Run once
- Always"
Put an icon next to each shortcut showing whether it's always (or never) allowed, and it seems like the problem would be largely solved without asking much from the end user.