← Feed

Posts

• View post

  If you've installed iOS 27 RC, there's an update for you.

• View post

  RE: https://mastodon.social/@macrumors/117270852288219467 The iCloud Private Relay bug that leaks the IP isn't mentioned, although it had been fixed.

• View post

  @cynblogger Thank you!

• View post

  Apple acknowledges fixing the Private Relay bug leaking the IP in the secure release notes of iOS 26.6.1 and macOS 26.6.2. CVE-2026-65352 was assigned to it

• View post

  🚀 We’re working on a small new iOS app (…applet? 😃) It’s not a privacy app. It’s our take on a common app and web utility that are usually ad-infested hellscapes 😬 so ours of course will have zero tracking or ads

• View post

  Happy Duplicate Day! All security reports submitted to the Apple Security Bounty program that have the status "Resolved" or "Open" are now marked as "Duplicate". This seems to affect all accounts. This is clearly a huge bug. 🤯🤯🤯🤯🤯

• View post

  According to Apple documents, there's no one switch to turn off Apple Intelligence. You need to turn off the features one by one. The documents indeed refer to Screen Time for blocking Siri completely. It's hidden there by design.

• View post

  Pixel phones can clearly extract text from photos on-device, as Gboard shows. But Google Photos hands this task off to Google Lens, making users upload photos to Google just to copy text. This video captures how differently Google and Apple think about privacy: #Apple #iOS #Google #Android #privacy #infosec #privacymatters

• View post

  2025: Cloudflare outage made half the internet offline 2026: Google Analytics for Firebase caused thousands of iOS apps to crash Do we learn?

• View post

  RE: https://infosec.exchange/@psylo/117486557379886282 We’re making good progress on Psylo 1.4, which brings full iPhone Duo support! Though there’s one little caveat about being an early iPhone Duo adopter: Since it’s a brand-new device with a unique form factor, and likely limited availability in the coming months, using one across apps and websites could be a fairly strong fingerprinting signal. We’re trying to figure out a way to mitigate this, and we’ll keep everyone posted if we come up...

• View post

  🚨 We're disclosing a macOS security bug that Apple says is not an issue. Using a simple archive-and-restore trick, an attacker can silently replace the main executable of virtually any application downloaded from the web—no password or warning is required. Here's a demo using Signal to steal its encryption key. 📝 Blog with technical details: link in the replies. Do you think this should be considered a security bug? 🎬👇 #Apple #privacy #infosec #security #macOS https://youtu.be/0bOC8S3NQ...

• View post

  Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart. With the macOS bug we described in https://mysk.blog/2026/07/23/macos-overwrite-app-executables/, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy) https://youtu.be/lLJkxWR71B0 *This is also a good reminder to uninstall Chrome 😎

• View post

  So on a Pixel 9 with Android 17, there’s no way to copy text from a photo offline and without sending it to Google? All these AI features on Pixel phones and basic OCR still can’t run locally?

• View post

  RE: https://mastodon.social/@mysk/117264670021439841 Happy iOS 27 Day! Bookmark this post if you want to disable Apple Intelligence. Apple buries the option in "Screen Time". Apple joins other Big Tech companies in making it tougher to opt out of AI features that send data off-device.

• View post

  In iOS 27, there’s no longer simple toggle to disable Apple Intelligence entirely. Some features like Writing Tools can also send data off-device for processing through Private Cloud Compute After some digging, here’s how to disable Writing Tools: 1️⃣ Settings → Screen Time 2️⃣ Content & Privacy Restrictions → turn it on 3️⃣ Siri → Writing Assistance → Don’t Allow #Apple #Privacy

• View post

  📝 New Blog Post: Thoughts on Responsible Disclosure We recently disclosed issues in WebKit that affected Psylo and iCloud Private Relay. This has sparked some debate, so we want to explain our reasoning and share some thoughts on responsible disclosure https://mysk.blog/2026/08/25/responsible-disclosure/

• View post

  Good news to hackers: this hasn't been fixed in 26.6. Actually, it won't be fixed. Enjoy what you collect from people's clipboards. BTW you can also do the same with Microsoft Edge. Cheers! https://youtu.be/lLJkxWR71B0

• View post

  RE: https://mastodon.social/@mysk/116889369517349322 iOS 26.6 resets the clipboard counter after a reboot. This is the same change that Apple introduced in iOS 27 beta a while ago. Sadly no acknowledgment to Team Mysk or Project Loupe in the security release notes 😑

• View post

  Many of you have asked for a way to support the Loupe project. We want to keep Loupe free of in-app purchases, so instead we’ve created a Buy Me a Coffee page for anyone who’d like to show their appreciation. ☕ https://buymeacoffee.com/mysk

• View post

  RE: https://mastodon.social/@mysk/116974847786124516 🚨 PSA: Uninstalling Google Chrome on macOS doesn't remove Chrome's background updater. It keeps running until you remove: ~/Library/Application Support/Google/GoogleUpdater ~/Library/LaunchAgents/com.google.GoogleUpdater.wake.plist Then, restart.

• View post

  RE: https://mastodon.social/@mysk/116969508089535193 appleinsider inaccurately assumed that for the attack to succeed the user has to perform certain steps like archiving an restoring. This is wrong. All the user needs to do is run the malicious script. Now all websites are citing appleinsider 🤬 https://appleinsider.com/articles/26/07/24/trusted-mac-apps-could-possibly-be-swapped-out-for-malware

• View post

  Another change seems to be motivated by Loupe. Apple has deprecated the canOpenURL API that apps use to detect which apps are installed on the iPhone in iOS 27 Beta 4. Moreover, the deprecated API will only allow a maximum of 25 apps to be queried instead of 50 #privacy #infosec #Apple #ioS

• View post

  UPDATE: Apple doesn't see an issue here. We will disclose this issue on our blog. Stay tuned. https://mastodon.social/@mysk/116816065579359109

• View post

  Apparently Apple has fixed the clipboard counter in iOS 27 beta 3 thanks to Loupe. ✌️ Now the counter resets after a restart. Hey Apple, a little shoutout to the Loupe project would have been nice! Loupe is free and open source. You can download Loupe here: https://apps.apple.com/us/app/loupe-what-apps-can-see/id6766152470 #privacy #iOS #Apple #beta #infosec #security

• View post

  Cool, so in the future we should expect an email like this: https://blog.playstation.com/2026/07/01/physical-disc-production-ending-in-january-2028-for-new-games-releasing-on-playstation-consoles/

• View post

  Just out of curiosity, I let Claude attempt to port Loupe to Android using skiptools. If you haven’t heard of Skip, it’s a tool that lets you produce native Android apps from a SwiftUI codebase. Loupe is written entirely in Swift and SwiftUI, so it should be a good match It’s still so surprising to me that this works at all. That said, I don’t think Loupe for Android is coming anytime soon since we have other stuff going on right now

• View post

  Loupe has earned 1,000 5-star ratings on the App Store and its GitHub repo has reached 1,2k stars. ✌️

• View post

  UPDATE: Michael Tsai @mjtsai confirms that all his search queries were included in the data he requested from Apple. Every iPhone user should learn that Apple's definition of privacy is different. Think different. Visit https://privacy.apple.com and request a copy of your data. #privacy #Apple #infosec

• View post

  🚨PSA: If you think you're a targeted individual, don't install macOS apps from the web. macOS code signing and TCC are broken. We accidentally found a bug that lets any command modify the binaries of other apps, including Signal, Brave, Chrome, and even Xcode. Watch the demo👇 #privacy #Apple #security #infosec #cybersecurity

• View post

  Techlore reviewed Loupe in this great video: #privacy https://youtu.be/_n_SpEWtqog