Verichains' analysis reveals that several Vietnamese banking apps improperly use private iOS APIs, potentially jeopardizing user security and app stability. These apps employ undocumented functions to gather device information, bypass sandbox restrictions, and manipulate UI elements, likely in pursuit of enhanced functionality or anti-fraud measures. However, reliance on these private APIs violates Apple's developer guidelines and creates risks, as these APIs can change without notice, leading to app crashes or malfunctions. Furthermore, this practice exposes users to potential security vulnerabilities that malicious actors could exploit. The report details specific examples of private API usage within these banking apps and emphasizes the need for developers to adhere to official guidelines for a safer and more reliable user experience.
iOS 18 introduces homomorphic encryption for some Siri features, allowing on-device processing of encrypted audio requests without decrypting them first. This enhances privacy by preventing Apple from accessing the raw audio data. Specifically, it uses a fully homomorphic encryption scheme to transform audio into a numerical representation amenable to encrypted computations. These computations generate an encrypted Siri response, which is then sent to Apple servers for decryption and delivery back to the user. While promising improved privacy, the post raises concerns about potential performance impacts and the specific details of the implementation, which Apple hasn't fully disclosed.
Hacker News users discussed the practical implications and limitations of homomorphic encryption in iOS 18. Several commenters expressed skepticism about Apple's actual implementation and its effectiveness, questioning whether it's fully homomorphic encryption or a more limited form. Performance overhead and restricted use cases were also highlighted as potential drawbacks. Some pointed out that the touted benefits, like encrypted search and image classification, might be achievable with existing techniques, raising doubts about the necessity of homomorphic encryption for these tasks. A few users noted the potential security benefits, particularly regarding protecting user data from cloud providers, but the overall sentiment leaned towards cautious optimism pending further details and independent analysis. Some commenters linked to additional resources explaining the complexities and current state of homomorphic encryption research.
Summary of Comments ( 7 )
https://news.ycombinator.com/item?id=43502385
Several Hacker News commenters discuss the implications of the Verichains blog post, focusing on the potential security risks of using private APIs. Some express surprise at the prevalence of this practice, while others point out that using private APIs is a common, though risky, way to achieve certain functionalities not readily available through public APIs. The discussion touches on the difficulty of Apple enforcing its private API rules, particularly in regions like Vietnam where regulatory oversight might be less stringent. Commenters also debate the ethics and pragmatism of this practice, acknowledging the pressure developers face to deliver features quickly while also highlighting the potential for instability and security vulnerabilities. The thread includes speculation about whether the use of private APIs is intentional or due to a lack of awareness among developers.
The Hacker News post titled "Technical Analysis – Improper Use of Private iOS APIs in Vietnamese Banking Apps" has generated several comments discussing the implications of the article's findings.
Several commenters focused on the security risks associated with using private APIs. One commenter highlights the potential for malicious apps to exploit these same private APIs, potentially bypassing security measures or accessing sensitive user data. They mention the "walled garden" approach of iOS and how circumventing it introduces vulnerabilities. Another commenter reinforces this by pointing out that Apple explicitly warns against using private APIs, and doing so can lead to app rejection from the App Store. They express concern that these banking apps were able to get through the review process despite this violation.
The discussion also touches on the motivations behind using private APIs. One commenter speculates that developers might resort to private APIs due to limitations or perceived deficiencies in the public APIs provided by Apple. They suggest that this situation highlights a potential gap in functionality offered by official means. Another commenter cynically suggests that the developers might be knowingly taking shortcuts to achieve desired functionality without going through proper channels or investing in more robust solutions.
A few commenters discuss the implications for users of these banking apps. One expresses concern about the potential for data breaches or other security compromises due to the use of these private APIs. Another commenter questions the overall security posture of these Vietnamese banks, suggesting a lack of due diligence in their app development practices.
The conversation also drifts towards the broader issue of private API usage and app store review processes. One commenter questions the effectiveness of Apple's app review process in catching these violations. Another commenter mentions the cat-and-mouse game between developers trying to use private APIs and Apple trying to prevent them. They note that this is an ongoing issue and that developers often find creative ways to circumvent the restrictions.
Finally, one commenter questions the severity of the issue, suggesting that the specific private APIs mentioned in the article might not pose a significant security risk. However, this is countered by another commenter who emphasizes that any use of private APIs is a violation of Apple's guidelines and opens the door to potential security vulnerabilities, regardless of the specific APIs used.