Light

Episode #938 Quiz

Apple Says No
Date: 2023-09-05 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Apple rejected demands to add iCloud CSAM scanning, arguing that scanning private cloud data would imperil user security, enable mass surveillance, and create new attack surfaces. Apple instead expanded on-device Communication Safety features for child accounts, Messages, AirDrop, FaceTime, and third parties, preserving privacy through local processing without Apple accessing content.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What did Apple’s Security Research Device Program say researchers could do on the specially fused iPhone 14 Pro hardware variant?

Question 1

What did Apple’s Security Research Device Program say researchers could do on the specially fused iPhone 14 Pro hardware variant?

Use it only through a remote shell, with no ability to change entitlements or boot custom firmware Install third-party app stores, bypass code signing entirely, and persist jailbroken state across restores Run arbitrary code only within the sandbox, with no access to platform or root privileges Install and boot custom kernels, run arbitrary code with any entitlements, and customize the kernel

Question 2: According to the university research discussed, what was the core flaw in many browser text input fields that allowed malicious extensions to extract secrets?

Question 2

According to the university research discussed, what was the core flaw in many browser text input fields that allowed malicious extensions to extract secrets?

Extensions could read the DOM and access plaintext values stored in HTML source code Extensions could only read values after the user submitted the form to the server Extensions could break TLS and recover credentials from the encrypted network traffic Extensions could decrypt encrypted passwords using keys exposed by the browser process

Question 3: Which set of websites did Steve specifically call out as lacking the required protection and therefore vulnerable right now?

Question 3

Which set of websites did Steve specifically call out as lacking the required protection and therefore vulnerable right now?

proton.me, fastly.com, walmart.com, and sec.gov gmail.com, cloudflare.com, amazon.com, and irs.gov yahoo.com, verisign.com, target.com, and nasa.gov outlook.com, akamai.com, ebay.com, and treasury.gov

Question 4: Why did Apple say it had not proceeded with the proposed hybrid client-server CSAM scanning approach for iCloud Photos?

Question 4

Why did Apple say it had not proceeded with the proposed hybrid client-server CSAM scanning approach for iCloud Photos?

Because it was not practically possible without imperiling user security and privacy Because Apple concluded it would only work if users manually uploaded photos for review Because Apple lacked the engineering staff to operate a large-scale scanning service Because the feature had already been fully replaced by Communication Safety on all devices

Question 5: What did Steve say was the practical limitation of the ReadSpeed DOS utility in relation to USB-connected drives?

Question 5

What did Steve say was the practical limitation of the ReadSpeed DOS utility in relation to USB-connected drives?

It could analyze USB drives only after a destructive surface scan rewrote the entire device It could analyze USB drives only if they were formatted with NTFS and attached through a hub It could not analyze USB-connected drives until SpinRite 7 adds USB and NVMe support It could analyze USB-connected drives only on UEFI systems running the new RTOS32 boot environment

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.