Slashdot Mirror
Siri Protocol Cracked
First time accepted submitter jisom writes with something that will probably not be working come morning. Quoting the source: "Today, we managed to crack open Siri's protocol. As a result, we are able to use Siri's recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri! Or use Siri on an iPad! And we're going to share this know-how with you."
Basically, Siri sends the data to the processing server using non-standard HTTP extensions. Of note is that the audio is encoded using Ogg Speex.
While you could write an Android app or anything else, the protocol sends an unique ID with the request. That ID is unique to every iPhone 4S. End result being, you can probably use your own for your personal use, but if you try to sell an App for Android and include your ID with it, Apple will just blacklist it. So you will still need your own iPhone 4S.
3.. 2.. 1...
A feeling of having made the same mistake before: Deja Foobar
The quality of the anonymous coward troll posts is declining. I expected more.
To offset political mods, replace Flamebait with Insightful.
I thought it ran on the phone itself.
So the iPhone can't really do the speech recognition and synthesis by itself? That's quite underwhelming.
Circumcision is child abuse.
Appears that Xiph came out on top for speech codecs.
This also shortly after apple realized that ALAC was going to fail (at least as a closed source product, they may push it better as an open source project now it can be played by everyone).
They still have the very entrenched AAC though.
> I thought it ran on the phone itself.
Nope, and that is the scam. Basically you are calling a service. Thus they could make Siri available on every iProduct with zero effort. That they decided to hold it as an exclusive feature for the 4S to try and create the 'gotta upgrade' stampede is truly lame. Keeping it to iProducts is ok, they ain't giving away a hefty compute farm after all, who do ya think they are after all, Google? But locking access to the service to one submodel of one product line is a terrible idea.
Democrat delenda est
I knew this long ago... I just asked "Siri, what protocols are you using to communicate with your server?"
When the copyright term is "forever minus a day", live every day like it's the last.
"Siri, Don't sue. Confirm.", Siri, "I'm afraid I can't do that Dave."
If Apple is learning anything from Google, it's that customer info is valuable. Siri could easily become an advertising platform that rivals Google. Targeted advertising, where companies pay Apple for premium listings ( eg Asking Siri about a Pizza place returns Pizza Hut who paid the most for that key word).
If that's their angle, they might welcome more traffic to Siri.
.. can you ask Siri "where to hide a body" before a backend notification gets emailed to a detective at your local PD?
That's what she said.
TFA is actually pretty interesting:
Some Apple software (parts of iTunes) goes further and checks that the certificate presented by the server is actually signed by Apple. If the Siri software did this then the server would be impossible to fake man-in-middle-wise without hacking the client itself. Just checking that the certificate is valid is pretty useless protection - any certificate could be valid, what you care about is whether the server is who it says it is.
sheep.horse - does not contain information on sheep or horses.
planes have wifi these days.
in other news, you're no longer allowed to smoke.
I have just done this. That exact text (as far as I can tell) is included in the text about 7/8ths of the way through.
So it looks like Apple is in the clear on this point.
sheep.horse - does not contain information on sheep or horses.
I knew they were doing some heavy lifting on the server side, cause obviously it doesn't work without a network connection.
However, I figured they would at least do an initial processing pass on the phone and pass up the data points to the server instead of the raw audio. That at least would make sense, and you'd be able to pass much smaller amounts of data. It would also explain the need to have better hardware on the phone. Sending the raw audio seems insane.
There's an awfully big chance the codec was determined and implemented way before Apple even touched the product.
I was promised a flying car. Where is my flying car?
It seems fairly ill-advised for a company whose business is developing iOS apps to post their reverse engineering exploits on the corporate blog.
I don't understand these hackers, they only promote the lock-in policies of Apple. Because having Siri for a while may lure more users to Apple. After a while, Apple will just close the hole by using the UID's of the phone, like others mentioned, or some kind of unbreakable private-key cryptosystem.
Further, all those jailbreaking tools which are available just give Apple users a reason to say "hey, I'm not locked in, I can always jailbreak my device".
While you can root your device now, it does not mean you can root it forever. Apple devs are smart enough to make the system close to unbreakable, because cryptography is not that hard, and by the way, they are baking their own ICs now.
So I think Apple is just happy with this (relatively small) jailbreaking scene, just like Microsoft was happy with their software being illegally copied for a long while.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
Another thing to consider is that Siri remembers things about you. For example, you can tell it "Justine is my mom", then later say "Call mom". Also, there are sessions — your command can be a interpreted in the context of recent commands. I would guess that the state is saved on the server side and tied to your unique ID. If so, then sharing an ID among multiple users would result in a nasty user experience, and would certainly defeat the point of Siri's more intelligent features.