News for hackers. Stuff that matters.

A comment on iPhone privacy feature hiding Wi-Fi Macs has failed to work for 3 years. Parent comment

Re:iPhone privacy feature hiding Wi-Fi Macs has failed to wo... by Wowfunhappy on Thursday October 26, 2023 @10:05PM (#38033871)
The threat model changed.

If I'm using HTTP, and my traffic is unencrypted, there isn't a vulnerability.

If I'm using HTTPS, and my traffic is unencrypted or can be decrypted, there's a serious vulnerability!

[ Parent | on HN ]
Re:iPhone privacy feature hiding Wi-Fi Macs has failed to wo... by 7e on Friday October 27, 2023 @12:39AM (#38034756)
This CVE does not allow decryption (or non-encryption) of HTTPS.
[ Parent | on HN ]
Re:iPhone privacy feature hiding Wi-Fi Macs has failed to wo... by DANmode on Friday October 27, 2023 @01:20AM (#38034976)
The point is the expectation not meeting reality - nothing about that specific technology.
[ Parent | on HN ]
Re:iPhone privacy feature hiding Wi-Fi Macs has failed to wo... by rekoil on Friday October 27, 2023 @04:02AM (#38035891)
Just strange to use HTTP for comparison when the actual problem works just fine.

If I'm connecting to WiFi normally, and expecting that I can be tracked, there isn't a vulnerability.

If I'm connecting to WiFi using this privacy feature, and expecting NOT to be trackable, yet someone is still able to track me, there is a serious vulnerability!

[ Parent | on HN ]
Re:iPhone privacy feature hiding Wi-Fi Macs has failed to wo... by fooker on Friday October 27, 2023 @06:32AM (#38036810)
That's what comparisons and analogies are for.

The HTTP comparison helped me understand the issue.

[ Parent | on HN ]
Re:iPhone privacy feature hiding Wi-Fi Macs has failed to wo... by rasz on Friday October 27, 2023 @07:03AM (#38036997)
Pre 14 phones leak MAC to all people around, post 14 phones only expose it inside encrypted network phone was allowed to connect.
[ Parent | on HN ]
Re:iPhone privacy feature hiding Wi-Fi Macs has failed to wo... by hsbauauvhabzb on Friday October 27, 2023 @07:03PM (#38045110)
I would argue you’re almost right, the two considerations are intent (if you say something is true and it is not true, that is a vulnerability) and real world use (if the site accepts usernames and passwords, and is unencrypted, and there is some impact to a breach or credential theft, there is a vulnerability).
[ Parent | on HN ]