News for hackers. Stuff that matters.
Re:Twitter says an attacker used its API to match usernames ... by lonelappde on Wednesday February 05, 2020 @04:02PM (#22250948)
What does Apple allow that for App Store apls? That's obvious circumvention of iOS's privacy control regime.
Re:Twitter says an attacker used its API to match usernames ... by toast0 on Wednesday February 05, 2020 @04:37PM (#22251230)
My post below is wrong, please move along. Keeping as-is, so the replies make sense. Thanks repliers!

The native prompts don't allow for app specific explanatory text to be presented. I haven't reviewed iOS guidelines, but Google provides guidance to inform users of why you're asking for permissions before you do it, and I would guess Apple would suggest the same as well. Pestering people for access once a day is probably not within the scope of the guidelines though.

Re:Twitter says an attacker used its API to match usernames ... by diebeforei485 on Wednesday February 05, 2020 @04:46PM (#22251305)
> The native prompts don't allow for app specific explanatory text to be presented

Not true. iOS apps can specify explanatory text to be included in the native prompt. In fact they are required to do this, since at least two years ago.

The NSContactsUsageDescription string (in the Info.plist file) is the place to specify this.

https://developer.apple.com/library/archive/documentation/Ge...

Re:Twitter says an attacker used its API to match usernames ... by cactus2093 on Wednesday February 05, 2020 @04:42PM (#22251267)
Incorrect, iOS does allow explanatory text on the system prompt, in fact it’s required.

There is no good reason for Apple to allow apps to mask permission requests with their own dialogs, it’s just a case of not bothering to fix this loophole.

Re:Twitter says an attacker used its API to match usernames ... by megablast on Thursday February 06, 2020 @12:21AM (#22253615)
Why do people keep saying clearly wrong stuff. You sound like you know what you are talking about, but are 100% wrong.