Apple Addresses Privacy Concerns Surrounding App Authentication in macOS
Following the release of macOS Big Sur on Thursday, Mac users began to experience issues with opening apps while connected to the internet. Apple's system status page attributed the situation to issues with its Developer ID notary service, with developer Jeff Johnson specifying that there were connection issues with Apple's OCSP server.
Shortly after, security researcher Jeffrey Paul shared a blog post titled "Your Computer Isn't Yours," in which he raised privacy and security concerns related to Macs "phoning home" to Apple's OCSP server. In short, Paul said that the OCSP traffic that macOS generates is not encrypted and could potentially be seen by ISPs or even the U.S. military.
Apple has since responded to the matter by updating its "Safely open apps on your Mac" support document with new information, as noted by iPhoneinCanada. Here's the new "Privacy protections" section of the support document in full:
macOS has been designed to keep users and their data safe while respecting their privacy.
Gatekeeper performs online checks to verify if an app contains known malware and whether the developer's signing certificate is revoked. We have never combined data from these checks with information about Apple users or their devices. We do not use data from these checks to learn what individual users are launching or running on their devices.
Notarization checks if the app contains known malware using an encrypted connection that is resilient to server failures.
These security checks have never included the user's Apple ID or the identity of their device. To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.
Apple clarifies that user-specific data is not harvested during the security check and that it plans on removing all IP information from the logs. In addition, it plans on introducing several changes to the system over the next year, including:
- a new encrypted protocol for Developer ID certificate revocation checks
- strong protections against server failure
- a new preference for users to opt out of these security protections
Some users have advocated blocking the traffic to Apple's authentication servers, but it appears that Apple will provide this option to end-users in the future as well.
Popular Stories
iOS 18.1 will be released to the public in the coming weeks, and the software update introduces the first Apple Intelligence features for the iPhone. Below, we outline when to expect iOS 18.1 to be released. iOS 18.1: Apple Intelligence Features Here are some of the key Apple Intelligence features in the iOS 18.1 beta so far: A few Siri enhancements, including improved understanding...
Things are firming up for a big Halloween week for Apple, with the company's next operating system updates reportedly coming early in the week and hardware launches coming a few days later. Ahead of those hardware launches, we've recently seen what appears to be one of the most significant physical product leaks in years, while some of the new features in Apple's recent software updates have ...
While the iPhone 16 series was released just a few weeks ago, there are already many rumored features for the iPhone 17 models, and especially for the Pro models. Below, we recap five key new features rumored for the iPhone 17 Pro and Pro Max so far: 24MP front camera for all iPhone 17 models: All four iPhone 17 models will feature an upgraded 24-megapixel front-facing camera, according...
On this week's episode of The MacRumors Show, we discuss the unprecedented leak of Apple's M4 MacBook Pro models and the company's rumored move to more staggered hardware and software releases. Subscribe to The MacRumors Show YouTube channel for more videos Multiple leaks surrounding Apple's unannounced 14-inch MacBook Pro with the M4 chip recently surfaced online. The leaks began with unboxin...
In iOS 18.1, there is a new option to set a "Primary" email address in the Settings app, which means it is easier to change the main email address associated with your Apple Account. The Primary email address is the one that is visible to other people when collaborating on and sharing documents, sending calendar invites, and more. Apple did not previously make it easy to change an Apple...
Apple today stopped signing iOS 18.0, preventing iPhone users who have upgraded to iOS 18.0.1 from downgrading to iOS 18. Apple released iOS 18.0.1 a week ago on October 3. It is not unusual for Apple to stop signing older versions of iOS within a week or two after a new version of iOS is released. When Apple stops signing an update, it can no longer be installed on an iPhone due to a...
Rumors strongly suggest Apple will release the seventh-generation iPad mini in November, nearly three years after the last refresh. Here's a roundup of what we're expecting from the next version of Apple's small form factor tablet, based on the latest rumors and reports. Design and Display The new iPad mini is likely to retain its compact 8.3-inch display and overall design introduced with...
Apple often releases new Macs in the fall, but we are still waiting for official confirmation that the company has similar plans this year. We're approaching the middle of October now, and if Apple plans to announce new Macs before the holidays, recent history suggests it will happen this month. Here's what we know so far. As of writing this, it's been 220 days since Apple released a new...
Alleged photos and videos of an unannounced 14-inch MacBook Pro with an M4 chip continue to surface on social media, in what could be the worst product leak for Apple since an employee accidentally left an iPhone 4 prototype at a bar in California in 2010. The latest video of what could be a next-generation MacBook Pro was shared on YouTube Shorts today by Russian channel Romancev768, just...
