willstrafach

“Facebook Research” was the Onavo codebase, under a different name, signed by Facebook’s Enterprise certificate.

iOS devices must be activated to use them. This is indeed stored in a database. AppleCare and third-party repair centers can query activation information using GSX.

You are correct about pre-T1 Intel Macs though. Apple will have a blind spot by design, until support is dropped for old machines.

> That said, doesn’t iOS notify you when an app wants to use location services? Did all of these users just opt into that? That seems crazy, if so.

Not so crazy.

Local news, weather, and similar apps with a reasonable rationale for Location Services access are often the culprits.

They will put phrases like “See privacy policy.” in the justification text (When asking permission) so they can claim that the user consented.

I think the pitch here is “Semi-managed WireGuard peer provisioning and NAT punching as a service” usable by anyone who may not otherwise have a clue how WireGuard works (eg. friends sharing access to a file/media server), within 5 minutes or less from download/login to “done”

How would that work? Connections are mainly peer-to-peer with Tailscale. An attack (I suppose pushing new key pairs to specific peers and pointing them through a malicious endpoint?) would likely require a very noisy and detectable process.

This may make sense if they were replying via e-mail to the issue.

Different poster here but just curious: Are you a Deutsche Telekom user, by chance?

The face:b00c part is in the Interface ID, so this did not even need a large block (Though I am sure they have one).

In current versions? What permission is this?

.icu, .club, and a few other gTLDs can often be found for sale at $1-2/year, so they are used by entities in need of low cost disposable domains.

That is incorrect, Corellium does not ship Apple code.

If it had a T2, that will store the Apple ID.

1. You’re allowed to use IDFA. But users will now have to allow access, as a permission dialog will pop up first.

2. The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud. There is no way to validate anything about it or affirm that it ties to a genuine device.