Podcast: 5: ‘Be Curious and Be Humble’ with Casey Liss

The fifth episode of Magical & Revolutionary is now available. I’m joined by Casey Liss, known for the Accidental Tech Podcast, Analog(ue), Liss is More, Callsheet, as well as some other apps. Naturally, they also discuss fast food, cars, and a specific early 2000s sitcom…

Snippet: If Apple Sends You a Push Notification Alerting You to a Spyware Attack, Take It Seriously ☇

Zack Whittaker for TechCrunch:

Apple has sent out a new batch of notifications to customers who it suspects have been targeted with spyware capable of hacking into their devices. The tech giant sends out these notifications on occasion to alert its customers that their iPhones, iPads, or Macs might have been compromised with spyware typically used by governments. […]

In a new support article on its website, Apple says it will notify users directly on their iPhone lock screen with a push notification that urges the person to take action. Apple told TechCrunch that it has updated the user experience, making it easier for recipients to access important information on what to do next.

When received, a threat notification will read: “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.”

This is a nice addition, although I could see how it could be mistaken for phishing/spam.

Snippet: Native Apps Should Be Avoided Whenever Possible ☇

No One’s Happy (via Matt Birchler):

Most native apps collect far more data than their website equivalents ever could. They request permissions to hardware, sensors, and background processes that browsers deliberately restrict. The third-party software embedded in these apps frequently transmits your location, device identifiers, and behavioral data to third parties before you even see a consent prompt. This data is in tandem bought, sold, and aggregated by brokers. It has been used to out individuals, track immigrants, and enable prosecution over reproductive healthcare.

Although I’ve scaled back the number of apps on my devices in an effort to de-clutter, I’ve been finding that so many apps take up space and provide few extra features over simply visiting the mobile web site. Considering that Safari Extensions such as ad blockers and other privacy tools have no effect within apps that use WebView to display content, that also means that there’s nothing to prevent you being tracked and your device profiled. I think Apple could probably do more to take away surveillance power from apps, but it doesn’t seem to be a priority. Maybe it’s worth re-evaluating if you need that fast food chain or retailer app on your phone? As so many apps are a mobile web site with a few extra things bolted on, why not try the web version of some other apps, too?

Snippet: Where Apple and Lumon Differ ☇

John Gruber paraphrasing a report from Aaron Tilley at The Information:

If you use your personal Apple ID, you get a magic “Apple Work” folder in iCloud Drive. When you leave Apple, that “Apple Work” folder disappears. But any other files or folders that were shared with you that were outside that magic folder are still in your iCloud Drive, because it’s still your personal iCloud account.

Another factor that plays into this, I think, but which Tilley doesn’t address, is that your Apple ID is not an email address. Your Apple ID is an account that has one or more email addresses associated with it. Let’s say your personal iCloud account has two email addresses associated with it: example@icloud.com and example@gmail.com. Then you take a job at Apple and get the address example@apple.com. When you leave Apple, you lose access to the @apple.com address. But anything shared with your Apple ID through iCloud is still shared with you. You still have the same Apple ID account, even though you no longer have an employee @apple.com email account…

As many things I know about Apple, this whole thing both makes perfect sense and feels absolutely bonkers. I immediately thought of my many years in higher education—when former students come to work at our institution, we don’t turn their alumni accounts that they get to keep indefinitely into employee accounts, but rather create separate ones in case their employment ends. Many employers allow you to put your work email and cloud storage on your phone, but again, it’s all siloed off and can be revoked. Apple’s makes sense for the current constraints, although I’m really surprised that that hasn’t created more friction. With all the concerns for secrecy, I wonder why they haven’t explored separate Apple IDs for employees and the ability to load them in a minimal way (email, storage, maybe not iCloud and App Store) alongside personal Apple IDs?