36
votes
Accepted
Stolen MacBook: should I worry about my data?
Your data is probably* safe if the following three criteria are met:
You have FileVault turned on (full disk encryption).
Your laptop requires a password on boot and every time you open the lid (auto ...
- 2,366
20
votes
Stolen MacBook: should I worry about my data?
I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account ...
- 301
7
votes
Can Apple technically intercept iMessage messages
If you make use of Apple's iMessage service then you are implicitly trusting Apple, as they wrote all the code that you are running and therefore could make it do anything they want it to.
So either ...
- 62.5k
5
votes
Accepted
Best strategy to recover running Macbook "modern" Pro ram
The best strategy depends on what your constraints and goals are. A quick answer...
Perhaps an alternative is to powerbutton-off the laptop and then bootup a USB Linux which does not "touch"...
- 67.1k
4
votes
Accepted
Is Apple compromising network security with its default settings, which allow users to provide network credentials to other users with one tap?
First off - why would anyone consider this a security risk? Apple's implementation of the WiFi password sharing feature is much better implemented than Microsoft's attempt from a while ago. For ...
- 3,404
4
votes
Accepted
VPN profile working in Iphone
Your base assumption is correct, your VPN provider is very literally a MitM and can use that position to conduct all the questionable snooping and tampering an attacker can normally do. As you said, ...
- 2,761
3
votes
How to prevent Apple and Google from accessing Telegram messages
Telegram uses the Firebase Cloud Messaging system for its push notifications on Android, and APNS (Apple's equivalent) on iOS devices. These notifications to the Telegram app on your phone come from ...
- 132k
3
votes
How safe is it to give a device that has malfunctioned to just anyone?
It's going to be impossible to tell what can be extracted from a non-functioning device without inspecting it. It is impossible for us to know what has malfunctioned or how or if storage is accessible ...
- 132k
3
votes
Does Apple supply hardware keyloggers?
There is no evidence that Apple has ever installed a hardware keylogger into any of their products. I can find no reference to such a feature or option existing or being advertised, either for ...
- 136k
2
votes
How can I check if my second hand Apple wireless keyboard contains a keylogger?
This would be practically impossible. Off course, you could open it up and see if there's any strange looking components who doesn't seem to belong there. But how would one tell what's legitimate and ...
- 65.7k
2
votes
Apple ID scam, gave control of my computer for a few minutes
Worst case.
Strictly speaking, a machine where someone got to run something you don't know - whatever it actually did - is to be treated as "compromised", i.e., all accounts on it have to have their ...
- 22.9k
2
votes
Apple bluetooth keyboard insecure connection?
Sounds like your keyboard is trying to establish an unencrypted connection.
This allows any attacker (with physical proximity) to sniff the connection with the keyboard and logging the keys, thus ...
- 173
2
votes
Accepted
secure Microphone Blocker for Apple devices (macOS and iOS)
The dummy, i.e. unconnected, microphone plug was a commonly recommended security method many years ago. It worked by mechanically breaking the circuit to the internal microphone in order to connect to ...
- 8,193
2
votes
Apple’s private relay TLS connection
I found the answer. The TLS connection is established with the intended website. On my Mac with the Monterey beta it is possible in Safari to check the TLS certificate which is exactly the same with ...
- 51
2
votes
Should I be worried about an "untrusted enterprise developer" on iOS?
The iPhone refuses to run unsigned apps. In iOS, the primary way to distribute released apps to the public is the App Store. However, most companies don't want to distribute their internal apps for ...
- 43
2
votes
Accepted
Prove Private Key came from Apple Secure Enclave
I suspect this is too late for you, but in case anyone else has similar question in the future, there is a new AppAttest functionality (https://developer.apple.com/documentation/devicecheck/...
- 136
2
votes
Accepted
Does Apple’s Hide my Email feature really work?
Hide my Email is basically creating a mail alias. As long as you choose this alias as sender in E-mail communication with the site it will hide your original address.
But if you deliberately or ...
- 206k
1
vote
Is the "trusted phone number" inside your Apple ID a security flaw?
I'm not familiar with the details of this system, but using a phone number as a single authentication factor is indeed insecure. Both device theft and SIM-swapping attacks are real, ongoing threats - ...
- 50.3k
1
vote
How does the Apple/Google Exposure Notification system prevent infected users from being identified?
I am not sure if this answers your question, but in theory you can do the following:
Set up a Raspberry Pi with a camera and a Bluetooth card on a trafficked location in a pedestrian street.
When ...
- 898
1
vote
secure Microphone Blocker for Apple devices (macOS and iOS)
You can easily build yourself a "mic lock" by getting the cheapest wired microphone solution that will work for your hardware (for example a Bluetooth dongle with a microphone that goes in. ...
- 22.9k
1
vote
How to prevent Apple and Google from accessing Telegram messages
@schroeder is correct in the way that the infrastructure works, it's considered "secure". However, there is another vector, and anybody who is coming here to learn about security should be ...
- 471
1
vote
Shared Apple Dev Accounts Two Factor Auth
One of the purposes of 2FA is to prevent the sharing of a single/central account by multiple members of a developer team, the way you say you have been doing.
Just considering issues you raised, with ...
- 518
1
vote
Accepted
How to verify secure erasure of Android and Apple mobile devices
Factory reset, open the camera and let it record a movie in the highest resolution and framerate until all storage is full, factory reset again.
The first factory reset will free all storage, then ...
- 55.1k
1
vote
How to Perform a Security Review of Apps from Mac App Store
The most basic review is stuff already provided by Apple, such as "what permissions does the app request" and "who published it". You can also instruct the OS to not give the app some of the ...
- 50.3k
1
vote
How to close port 445 (Apple Time Capsule smbd)
Don't trust random devices to be secure.
Instead, implement a firewall between 'the internet' and your device, and make sure to block this unrequired traffic at the firewall level. Apple have ...
1
vote
Accepted
How Homebrew may impact your Mac's security
You can change your path order in /etc/paths to prevent such malicious behaviour. However $PATH could be overrided in shell script (like .bash_profile or .zshrc) so check/change them too.
Regarding ...
- 692
1
vote
How can Telegram find my phone number on iOS 11 after uninstall?
From my understanding iOS 11 doesn't delete the keychain keys for an app when you delete the app, I'm talking about the keychain on the device so cloud settings won't affect this. No other apps can ...
- 111
1
vote
How secure is the new MacBook Pro's Touch ID?
The sensors are always improving so the answer will change over time. For example, photos don't fool iPhone Face ID because of infrared mapping, and in the future perhaps it'll use Lidar for more ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible