Slashdot Mirror
Siri Protocol Cracked
First time accepted submitter jisom writes with something that will probably not be working come morning. Quoting the source: "Today, we managed to crack open Siri's protocol. As a result, we are able to use Siri's recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri! Or use Siri on an iPad! And we're going to share this know-how with you."
Basically, Siri sends the data to the processing server using non-standard HTTP extensions. Of note is that the audio is encoded using Ogg Speex.
While you could write an Android app or anything else, the protocol sends an unique ID with the request. That ID is unique to every iPhone 4S. End result being, you can probably use your own for your personal use, but if you try to sell an App for Android and include your ID with it, Apple will just blacklist it. So you will still need your own iPhone 4S.
They are already sending everything with HTTPS. That's why the researchers had to use gateway machine and certificate tricks to do man-in-the-middle attack.
I, too am shocked at how many people didn't realize this was all done server side -- especially here.
Doing the processing on the server seems very slow to me - I can find a contact much faster by pressing the first few letters than waiting for the round-trip latency to siri.
Heaps of people have tried to demo siri to me and most of the time it was a gimick that failed badly - either was slower than manual methods or just innacurate.
I knew this long ago... I just asked "Siri, what protocols are you using to communicate with your server?"
When the copyright term is "forever minus a day", live every day like it's the last.
"Siri, Don't sue. Confirm.", Siri, "I'm afraid I can't do that Dave."
The most alarming fact, for me, is that they are sending all my speech data over the Internet to some enormous Cloud database. Oh, and while they have it all, I must trust Apple now that they are not gonna mine this data and send it backdoor to advertisers and other interests.
Speech recognition isn't too CPU intensive, but it's *massively* memory intensive. It's not unreasonable for speech recognition engines to eat up a gig of ram, and the 4S only has 512mb. However, push it to a server with lots of ram and it can handle lots and lots of simultaneous speech recognition queries. It's tailor made to be a server-side task. At least until phones have gigs of free memory that aren't needed.
What? I think that may be the primary purpose of Siri in the end. Only a small minority give a crap about security anyway.
I asked Siri that question, and it responded: "You've already asked one time too many." It then displayed a map showing me how to get to Mexico.
TFA is actually pretty interesting:
Some Apple software (parts of iTunes) goes further and checks that the certificate presented by the server is actually signed by Apple. If the Siri software did this then the server would be impossible to fake man-in-middle-wise without hacking the client itself. Just checking that the certificate is valid is pretty useless protection - any certificate could be valid, what you care about is whether the server is who it says it is.
sheep.horse - does not contain information on sheep or horses.
planes have wifi these days.
in other news, you're no longer allowed to smoke.
Crickey! Loo' at that. We're very lucky! You almost never see a four digit this far from its native habitat of lurking. Ah she's a beaut!
"Chinese Amazons, power armor, laser swords.... things just meant to be." - Shampoo, A Very Scary Bet
Yet the music player still doesn't support Ogg Vorbis.
Doing the processing on the server seems very slow to me - I can find a contact much faster by pressing the first few letters than waiting for the round-trip latency to siri.
Yep. It's extremely annoying, actually, because Siri replaces the existing voice commands. So doing something like "call brother" - which used to take maybe a half second - takes a good three seconds or so of lag time. More annoyingly is things like "play playlist driving songs" - first you have to wait for the three seconds round-trip processing, then you have to wait for the iPhone to decide which playlist that matches ("Looking for playlist driving songs," Siri says), then you have to wait for her to narrate "playing playlist driving songs" before the music actually starts.
Compare to the previous, non-Siri version:
"Play playlist driving songs."
(half-second pause) "Playing playlist driving songs." (music starts)
Yay progress. About the only thing I use Siri for is asking dumb questions and seeing what responses I get. For actual voice controls, it's - well, not useless, exactly, just obnoxiously slow.
You are in a maze of twisty little relative jumps, all alike.
Crickey! Will you loo' at that. We're so very lucky! You almost never see a four digit this far from its native habitat of lurking an' she's being stalked by this five digit that's almost as rare. It's times like this I'm gla' I don't work with lizards that might eat me! //Window seat please...
"Chinese Amazons, power armor, laser swords.... things just meant to be." - Shampoo, A Very Scary Bet
Haha! They fooled you too. The dirty little secret is that Siri is actually a nice old lady in Delhi.
So turn it off : "If you wish to use Voice Control while you are not connected to the Internet, turn Siri off from Settings > General > Siri. Make sure to turn Siri back on when you have Internet connectivity and you wish to use it again."
If all else fails, immortality can always be assured by spectacular error.