5 ms·
Uber’s iOS App Had Secret Permissions That Allowed It to Copy Your Phone Screen
- mgamache 9y agoWondering what the legitimate use for this was?
- jsiepkes 9y agoFrom the article: “Apple gave us this permission years because Apple Watch couldn’t handle our maps rendering. It’s not connected to anything in our current codebase,” Uber’s spokesperson explained.
- matthewarkin 9y agoThe article states they were rendering maps screens on the phone and shipping the screenshot to the watch to handle performance issues with the watch.
- deathanatos 9y agoI don't buy this explanation. You need to full control over the screen's framebuffer to render an image? Even if your architecture is so hosed that you are screencap'ing the actual screen to get an image to ship over a network connection … multiple people thought that tradeoff with security was worth it?
- eridius 9y ago> You need to full control over the screen's framebuffer to render an image? No, but you do need the ability to render in the background, and apps aren't allowed to do any GPU-based rendering in the background (you can't touch an OpenGL context, and while I haven't actually confirmed this I assume you can't touch a Metal one either). This entitlement probably let them skip that restriction to do fast rendering in the background.
- willstrafach 9y agoI do wonder why they execlusively got it, and others (who must have had similar rendering issues) did not.
- eridius 9y agoPresumably because they were a headlining launch app for the Apple Watch and were in the keynote.
- jsjohnst 9y agoWasn’t Lyft also showcased at that event?
- jsjohnst 9y agoAlso, how do they still have it if it’s not needed? First cardinal rule of elevated privileges is to immediately give them up when no longer used.
- tqkxzugoaupvwqr 9y agoApple Watch Series 0 is possibly still not capable of rendering maps quickly and has to rely on a companion device. I guess Apple would have to leave this entitlement for Uber until the Watch Series 0 reached end of life five years after last selling them. Which would be quite the security risk.
- jsjohnst 9y agoYou sure? I think that was fixed with a WatchOS update (probably 2, but certainly by 3).
- freedomben 9y agoHow is this not a more popular story on HN? This seems like huge news to me.
- tosstossy 9y agoYou may have just discovered how prolific Apple fanboyism is on HN. If Google did this it'd be a much bigger deal on HN and people would be pointing out how this is why they use Apple products. All smartphones are a privacy/security shit show, Apple is no exception.
- Operyl 9y agoEh, compared to the “shit show” I just witnessed in the supposed “dark UI” around the new control center toggles, I’m inclined to believe that both sides get their side of crap.
- kinkrtyavimoodh 9y agoIf FB did this, people would be asking for Zuck's head on the chopping block.
- tinus_hn 9y agoConversely Hackernews, like many tech sites, also has a million people who have to whine their exaggerated complaints on every Apple article, like how every software suddenly ‘slurps’ their battery, how nothing is ‘snappy’ anymore and how Jobs is spinning in his grave about the latest UI ‘disaster’ and problem’gate’. Today the walls in the hated ‘walled garden’ are not high enough. The reality: these exceptions are made in a way that is exposed to external users which is much more transparent than most companies would be. It is stupid that Uber still has access if they don’t need it anymore. If you have to do a demo and it has to work before it is ready you have to make tough decisions.
- dbbk 9y agoWell, if you take Uber at its word (which I know is difficult) that it was only being used to render maps on the Watch, it doesn't seem like that big a deal to me.
- et-al 9y agoWhile it's easy to point the finger at Uber given its history, we also need to be asking Apple why this isn't something that's apparent to the user.
- nwrk 9y agoCurious, how much access like this could cost. Still, FaceID is safe by design.