Erm, you can refuse to give Signal access to your contacts and it will still work. I just tried it.
You will see phone numbers instead of names, and starting a new conversation is a bit tricky, just like when you don't give WhatsApp your contacts. But it works.
Facebook Messenger doesn't need your phone contacts because it operates on the basis of Facebook contacts and Facebook already has all your Facebook contacts.
Facebook may be evil, but I don't understand why we blame Facebook for this "exploit".
The user grants Website X permission to use their Facebook data. Website X obtains that data. Website X subsequently runs a malicious script on their own website which harvests that data.
Wouldn't this be, like, the fault of Website X?
EXACTLY. The summary is horrible. It made it sound like Google invented a novel technique that makes the KPTI/Variant 3 (Meltdown) mitigation slowdown "negligible". But actually the blog post simply says:
FTP pretty much died as mainstream when NAT routers became ubiquitous. Switching from active (PORT) to passive (PASV) ftp on the client side only worked until the FTP servers themselves were also behind a NAT.
If both sides are behind a NAT, HTTP wouldn't work either (without the serious reconfiguration they you mentioned), no?
You can't really compare this to desktop OSes like Windows or Mac OS.
The security model there is different. All "apps" you run on them are implicitly trusted; there is no security barrier between apps.
You don't need to fake a Gmail login prompt on Windows because you can simply read the memory of the browser or Gmail app and it will gladly give the memory contents including the password to you (if it still has it).
In iOS, each app is supposed to be isolated from each other and from the OS so this is a big(ger) deal.
If your browser would let any web site show https://myaccount.google.com/ in the address bar with the green padlock, is that not a security flaw?
Not saying this is exactly the same, but if a platform makes it very hard or impossible for the user to detect a phishing attack, it is a security flaw.
When the break-in first came to light, lots of people criticized Equifax, but a vocal minority said something along the lines of "No system is absolutely secure. We don't know if the hackers used a zero-day vulnerability against Equifax. They could have followed all the security best practices and still be hacked."
My response was "If the past is any guide, every time a major company was hacked, it was eventually traced to vulnerabilities in outdated software that should have been patched months ago. I am going to assume this is the same."
Turns out I was right. Companies never learn.
FORTRAN rots the brain. -- John McQuillin
