MacRumors

Google's Project Zero last week shared details about multiple serious iOS vulnerabilities that allowed malicious websites to access a victim's phone. There were a total of 14 vulnerabilities that were being exploited, and while those have now been fixed, some of the security holes were abused for several years.

Apple today responded to Google's Project Zero blog post in an effort to address customer concerns with all of the facts.

Apple says the attack was "narrowly-focused" rather than a broad-based exploit of iPhones as described. Fewer than a dozen websites targeting Uighur Muslims were affected, according to Apple. Further, Apple says that Google created a false impression of mass exploitation, causing fear among iPhone owners.

Google also got the length of the attacks wrong. Apple says the websites were operational for approximately two months rather than two years, with the vulnerabilities fixed 10 days after Apple learned about them. Fixes were already in the works when Google approached Apple.

Apple's full letter is included below:

Last week, Google published a blog about vulnerabilities that Apple fixed for iOS users in February. We've heard from customers who were concerned by some of the claims, and we want to make sure all of our customers have the facts.

First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones "en masse" as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community. Regardless of the scale of the attack, we take the safety and security of all users extremely seriously.

Google's post, issued six months after iOS patches were released, creates the false impression of "mass exploitation" to "monitor the private activities of entire populations in real time," stoking fear among all iPhone users that their devices had been compromised. This was never the case.

Second, all evidence indicates that these website attacks were only operational for a brief period, roughly two months, not "two years" as Google implies. We fixed the vulnerabilities in question in February -- working extremely quickly to resolve the issue just 10 days after we learned about it. When Google approached us, we were already in the process of fixing the exploited bugs.

Security is a never-ending journey and our customers can be confident we are working for them. iOS security is unmatched because we take end-to-end responsibility for the security of our hardware and software. Our product security teams around the world are constantly iterating to introduce new protections and patch vulnerabilities as soon as they're found. We will never stop our tireless work to keep our users safe.

According to Google, the websites in question that targeted iPhone users were able to steal private data like messages, photos, and GPS location in real time with little effort after a visitor went to an infected website.

Google believes thousands of visitors accessed these websites per week over two years, with the vulnerability present in iOS 10, iOS 11, and iOS 12. Apple addressed the issues in iOS 12.1.4 back in February 2019.

In a statement to The Verge, Google said that it stands by its original report despite Apple's comments.

Project Zero posts technical research that is designed to advance the understanding of security vulnerabilities, which leads to better defensive strategies. We stand by our in-depth research which was written to focus on the technical aspects of these vulnerabilities. We will continue to work with Apple and other leading companies to help keep people safe online.

Last week, MacRumors revealed new details about Apple's upcoming Tile competitor, with internal iOS 13 code suggesting that Apple plans to release small, circular "tags" that can be attached to electronic devices, backpacks, keys, and other personal belongings to keep track of their locations.

Ultra-wideband is a short-range, low-power radio technology that is able to provide more precise indoor positioning than Bluetooth LE and Wi-Fi, suggesting that Apple's tags will be more accurate at pinpointing the location of lost items than Tile's current item trackers, which rely on Bluetooth LE.

The distance between two UWB devices — such as an upcoming iPhone and Apple Tag — can be measured precisely by calculating the time that it takes for a radio wave to pass between the two devices, according to Electronic Design, which notes that UWB is up to 100× more accurate than Bluetooth LE and Wi-Fi:

In practice, UWB signals are able to effectively measure distance between two devicesNo with 5- to 10-cm accuracy, compared to roughly 5-m accuracy for Wi-Fi and Bluetooth. When implemented in a system of fixed beacons tracking tag locations, the locations can be calculated to within 10-cm accuracy.

It is unclear if Apple's tags will rely solely on UWB, which would seemingly limit their compatibility to 2019 and newer iPhones, or if they will also incorporate Bluetooth LE for use with older devices.

Last week, MacRumors revealed that Apple's tags will be closely integrated with the new "Find My" app in iOS 13, which merged the Find My iPhone and ‌Find My‌ Friends apps into one package. Specifically, Apple has been working on an "Items" tab in the app for tracking the location of Apple-tagged items.

iPhone users will receive a notification when they are separated from a tagged item, according to an internal version of the "‌Find My‌" app obtained by MacRumors. If necessary, users can then tap a button in the app that will cause Apple's tag to chime to help them locate the lost item.

"Safe Locations" can be set where the user will not be notified if this item is left in those locations, and users will also be able to share the location of items with friends and family members, based on internal iOS 13 code.

If users are unable to find an item, they can place the attached tag into a "Lost Mode." Then, if another iPhone user comes across the lost item, the owner will be instantly notified. The stranger will also be presented with the owner's contact information, possibly via push notification or in the ‌Find My‌ app.

Like the Pixie Tracker, the ‌Find My‌ app will likely incorporate functionality from Apple's ARKit platform. An internal build of iOS 13 includes an asset for a 3D red balloon that could help a user pinpoint a lost item after scanning a room with their iPhone. There's also an image of a 2D orange balloon.

"Walk around several feet and move your iPhone up and down until a balloon comes into view," a string in the internal ‌Find My‌ app bundle reads.

Apple is hosting an event at Steve Jobs Theater next Tuesday, where it is widely expected to unveil new iPhone and Apple Watch models. It certainly seems like development of Apple's tags has reached an advanced stage, but it is unclear if the product will be introduced at the keynote or later.

Apple is working on a new Siri feature for release by iOS 15 in fall 2021 that will allow users to have a back-and-forth conversation about health problems, according to internal documentation obtained by The Guardian.

The report does not offer any further details about the feature, but Siri will presumably become more capable of responding to physical and possibly mental health questions. Apple CEO Tim Cook has repeatedly said that Apple's health-related initiatives will be the company's "greatest contribution to mankind."

Apple has increased its presence in the health and fitness space over the past few years. In 2018, for example, it launched an ECG app for the Apple Watch that can detect signs of atrial fibrillation, a condition that can lead to potentially life-threatening complications such as stroke and cardiac arrest.

Also in 2018, Apple rolled out Health Records, a feature that allows patients to view medical records from multiple hospitals and clinics directly in the Health app on the iPhone, including allergies, vital signs, conditions, immunizations, lab results, medications, procedures, and other information.

In explaining why the service should deflect questions about feminism, Apple's guidelines explain that "Siri should be guarded when dealing with potentially controversial content." When questions are directed at Siri, "they can be deflected … however, care must be taken here to be neutral".

For those feminism-related questions where Siri does not reply with deflections about "treating humans equally", the document suggests the best outcome should be neutrally presenting the "feminism" entry in Siri's "knowledge graph", which pulls information from Wikipedia and the iPhone's dictionary.

In a statement, Apple said it aims for Siri to be "factual with inclusive responses rather than offer opinions":

Siri is a digital assistant designed to help users get things done. The team works hard to ensure Siri responses are relevant to all customers. Our approach is to be factual with inclusive responses rather than offer opinions.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Apple today launched a new Apple Music web experience, which is available to all users in a beta capacity.

The Apple Music website is similar to the ‌Apple Music‌ app on Macs, offering up dedicated "For You," "Browse," and Radio" sections, along with playlists, recommendations, and more.

‌Apple Music‌ users can sign in to ‌Apple Music‌ to access their customized content, and Apple is offering free trials for those who are new to the service.

You do need to sign up for ‌Apple Music‌ through Android, iOS, or Mac, as at the current time, there is no option to sign up on the web. Apple does plan to offer web signups in the future.

Content played on ‌Apple Music‌ for web plays right in the web player, with access to the entire ‌Apple Music‌ library on the left side of the interface.

With ‌Apple Music‌ on the web, the ‌Apple Music‌ service is accessible on any device that has a web browser, including Windows 10, Linux, and ChromeOS machines. Apple is aiming to make ‌Apple Music‌ as widely available as possible, allowing the company to better compete with other services like Spotify.

According to TechCrunch, over the course of the beta testing period, Apple will be soliciting feedback from customers as it works to streamline features and take care of bugs.

Those who want to give the new ‌Apple Music‌ web experience a try can visit beta.music.apple.com.

Apple in iOS 13 introduced a change that limits data collection practices using VoIP APIs, which has consequences for messaging apps like Facebook Messenger and WhatsApp.

According to a new report from The Information, the makers of encrypted messaging apps like Signal, Wickr, Threema, and Wire are now scrambling to overhaul their software to protect key privacy features that they believe may be compromised by the changes.

In a statement to The Information, an Apple spokesperson said that Apple is working with developers to alleviate their concerns.

"We've heard feedback on the API changes introduced in iOS 13 to further protect user privacy and are working closely with iOS developers to help them implement their feature requests."

Julia Weiss, a spokesperson for Threema, said that Apple's changes may actually result "in the opposite of the privacy goals the changes were supposed to achieve."

What Apple is doing is limiting the PushKit API, which was designed to be used for VoIP calls but over time, has also been used for other purposes such as collecting data and, in the case of messaging apps, encryption. In iOS 13, the PushKit API is limited to internet calls, with Apple eliminating its other uses.

Encrypted messaging apps currently use the VoIP APIs Apple is restricting for decrypting messages on the iPhone in the background, and the change disables that functionality.

App developers will be able to work around Apple's changes, but Tom Leavy, a VP at encrypted Messaging app Wickr said that it's a "significant engineering effort" that was unexpected. Makers of encrypted messaging apps are said to be exploring "alternative tools" in iOS to work, but they're said to be "way inferior" to the existing PushKit option.

Apple is giving app developers until April 2020 to comply with the changes to the PushKit API, but developers who want to update their apps for iOS 13 and take advantage of new features must follow PushKit restrictions sooner.

Ahead of the upcoming Galaxy Fold launch, Samsung canceled pre-orders for customers who had previously signed on to purchase the device earlier this year.

Samsung this morning sent out emails to pre-order customers letting them know that their existing pre-orders, many of which were placed back in April, have been canceled. Samsung cites a rethinking of the customer experience as the reason why pre-orders were canceled.

Ensuring that you have the best possible experience with this revolutionary new technology is our top priority. We are taking the time to rethink the entire customer experience - from purchase to unboxing, to post-purchase service - so in the meantime, we have, regrettably, decided to cancel your existing pre-order. While not an easy decision to make, we believe this is the right thing to do.

Customers who had pre-orders will need to place orders once again when the Galaxy Fold launches in the United States later in September. Samsung is planning to launch the Galaxy Fold in South Korea on Friday, September 6, but the U.S. rollout is being delayed.

Part of the new ordering process will include Samsung's "Galaxy Fold Premier Service," which offers customers "direct access" to Samsung experts and an optional one-on-one onboarding session that walks users through the Galaxy Fold features.

Pre-order customers who had their orders canceled are receiving a $250 Samsung credit that's redeemable for anything on the Samsung.com website.

Samsung initially delayed the Galaxy Fold after multiple reviewers ran into issues with the device. Some experienced screen failures, while others mistakenly removed a protective screen component that wasn't meant to be removed.

Samsung reengineered the Galaxy Fold to address the problems and improve durability. The top protective layer of the display was extended beyond the bezel so that it looks integrated and not like a screen protector to be removed.

The top and bottom hinge areas were strengthened with protection caps to prevent dust from getting under the display, additional metal layers under the display were included for reinforcement, and the space between the hinge and the body was reduced.

The Galaxy Fold is Samsung's first smartphone with a foldable display, able to convert from a 4.6-inch smartphone when folded to a 7.3-inch phablet when opened up. It features a 7-nanometer processor, 12GB RAM, 512GB storage, six cameras, and an operating system designed for the folding mechanism.

The Galaxy Fold is priced starting at $1,980, and its new September launch date will put it in competition with Apple's 2019 flagship devices, which will be unveiled at a September 10 event next week.

Apple Pay vice president Jennifer Bailey recently sat down with CNN anchor Christine Romans at a private event in San Francisco to discuss the future of payments, including ‌Apple Pay‌ and the Apple Card.

On cryptocurrency, Bailey said it is an "interesting" field with "long-term potential":

We're watching cryptocurrency. We think it's interesting. We think it has interesting long-term potential, but we're primarily focused on what consumers are using today… and are happy with. Most people are pretty happy with their debit card as an example. And so helping people do that in a more secure way on our platform and in a more real time way is what we're focused on.

On tipping, Bailey said it is one area where Apple still needs to "work more on that":

We get that feedback a lot from customers about when they start using mobile payments and Apple Pay, they stop carrying cash. And one of the key areas where they would like us to do more is actually in tipping. You'll see in some of the point-of-sale systems now great tipping functionality if you pay with mobile payments, but still that personal touch is one area where we still need to work more on that.

Apple Pay and the Wallet app have already provided digital alternatives to credit and debit cards, student IDs, movie tickets, boarding passes, and more. Asked what the hardest remaining item in a wallet would be to digitize, Bailey said identities, such as a driver's license or a passport:

I think the hardest thing is identity. And the reason is that identity, to be legal, has to be government issued… it has to be authenticated by the government. We see across the globe many countries starting to use mobile to add passport… you might use mobile passport when you're going through airports today. It is moving, and I think it will continue. It's not too far away… it just won't be as fast as some of the other activities we have.

Bailey also confirmed that Apple is "working on" allowing users to export their Apple Card financial data to a budgeting app like Mint.

Sonos today introduced its first portable Bluetooth speaker, the Sonos Move.

The battery-powered Sonos Move features both Wi-Fi and Bluetooth for listening at home or on the go, AirPlay 2 support, built-in Amazon Alexa and Google Assistant, and up to ten hours of continuous music playback per charge. The speaker features an oval-shaped design with IP56-rated water and dust resistance.

‌AirPlay‌ 2 support means music playback on the Sonos Move can be controlled with Siri, and the speaker will also appear in the ‌AirPlay‌ picker on iOS devices and in the Home app across iPhone, iPad, Mac, and Apple Watch.

Sonos Move pre-orders begin today on Sonos.com. The speaker will be available starting September 24, priced at $399 in the United States.

Sonos also unveiled a lower-priced version of its Sonos One smart speaker without built-in microphones. Priced at $179, the Sonos One SL costs $20 less than the regular Sonos One. Like the Sonos Move, the One SL supports ‌AirPlay‌ 2.

The new One SL replaces the Sonos Play:1 and will be available globally starting September 12.

Apple is developing an in-display fingerprint scanner for future iPhones, according to Bloomberg's Mark Gurman and Debby Wu.

The report claims Apple is considering including the in-display scanner in a 2020 iPhone if testing is successful, but adds there is a possibility the tech will not be ready until 2021. This lines up with a prediction from noted Apple analyst Ming-Chi Kuo, who expects an iPhone with both Face ID and in-display Touch ID in 2021.

The upcoming fingerprint reader would be embedded in the display, enabling users to unlock the iPhone by placing a finger almost anywhere on the screen, and it would complement rather than replace the existing Face ID system. This would give users the convenience of two biometric authentication options.

‌Face ID‌ and Touch ID each have their weaknesses, such as ‌Face ID‌ not working well when an iPhone is laying flat on a table, or ‌Touch ID‌ not playing friendly with wet fingers. With both systems, users would have the best of both worlds, using the authentication option that is better in a given situation.

Several major Android smartphone makers have adopted in-screen fingerprint scanners over the past few years, including Samsung.

Apple is also working on its first low-cost iPhone since the iPhone SE, which could launch as early as the first half of 2020, according to Bloomberg. As Nikkei reported earlier this week, the device is said to look similar to the iPhone 8, including a 4.7-inch display and a ‌Touch ID‌ home button.

The iPhone 8 currently retails for $599 and up, while the iPhone SE started at $399, but was later discounted to $349.

Samsung has announced the Galaxy Fold will go on sale in South Korea on Friday, September 6, over five months after its original scheduled launch date and just days ahead of Apple's annual iPhone event.

According to The Verge, the Galaxy Fold will also be available in France, Germany, and Singapore come September 18. Samsung hasn't revealed an exact date for the UK or US, but the handset is expected to arrive in those countries in the coming weeks. Initially at least, the phone will be available in just a single configuration, offering 512GB of storage, 12GB of memory, and 5G support, with a Montblanc luxury case thrown in.

Samsung will be crossing its fingers and its toes in the hope of a fault-free rollout this time around. The folding smartphone was initially meant to be in the hands of customers in April, but it was delayed following multiple reports from reviewers of broken units after just a few days' use. Many reviewers experienced issues while testing the device, including random bulges appearing on the 7.3-inch display and flickering screens. In many cases, the issues were enough to make the $1,980 device completely unusable.

An independent investigation revealed that the folding phone lacked adequate protection against the ingress of debris between the OLED screen and the chassis bezel. Samsung recalled all Fold devices that were distributed to reviewers and said it was postponing the launch of the hybrid handset while it completed a redesign to resolve the display failures. The South Korean firm said in July that the phone would relaunch in September, but didn't specify a date.

Samsung is already working on its next bendable smartphone, according to a Bloomberg report earlier this week. Projected to launch early next year, it's said to be a flip phone-style 6.7-inch device that can be folded down into a compact-sized square.

Apple's iPhone event takes place on September 10, when the company is expected to launch three new iPhones with more advanced cameras. The line-up includes two OLED models in 5.8 and 6.5 inches and one LCD model that's 6.1 inches. Apple is said to be exploring folding screen technology, but nothing suggests it plans to release a foldable smartphone in the near future.