Slashdot Mirror

← Back to Stories (view on slashdot.org)

iOS 11's Misleading 'Off-ish' Setting For Bluetooth and Wi-Fi is Bad for User Security (eff.org)

Posted by msmash on from the things-apple-does dept.

Last month, we covered a story about how turning off Wi-Fi and Bluetooth in iOS 11's Control Center doesn't really turn off Wi-Fi and Bluetooth. EFF has called the situation bad for user security. From the report: Instead, what actually happens in iOS 11 when you toggle your quick settings to "off" is that the phone will disconnect from Wi-Fi networks and some devices, but remain on for Apple services. Location Services is still enabled, Apple devices (like Apple Watch and Pencil) stay connected, and services such as Handoff and Instant Hotspot stay on. Apple's UI fails to even attempt to communicate these exceptions to its users. It gets even worse. When you toggle these settings in the Control Center to what is best described as "off-ish," they don't stay that way. The Wi-Fi will turn back full-on if you drive or walk to a new location. And both Wi-Fi and Bluetooth will turn back on at 5:00 AM. This is not clearly explained to users, nor left to them to choose, which makes security-aware users vulnerable as well. The only way to turn off the Wi-Fi and Bluetooth radios is to enable Airplane Mode or navigate into Settings and go to the Wi-Fi and Bluetooth sections. When a phone is designed to behave in a way other than what the UI suggests, it results in both security and privacy problems. A user has no visual or textual clues to understand the device's behavior, which can result in a loss of trust in operating system designers to faithfully communicate what's going on.

35 of 162 comments (clear)

  1. Does turning off the device work? by lucasnate1 · · Score: 2, Interesting

    Since the battery can't be removed, I'm beginning to wonder if there is any way to turn off wifi AT ALL.

    --
    Avantgarde Hebrew science fiction
    1. Re:Does turning off the device work? by Aaden42 · · Score: 2

      Hold Power+Home or Power+VolumeDown for 10 seconds, depending on model. Forces a reboot. Google is your friend. https://9to5mac.com/2016/09/18...

    2. Re:Does turning off the device work? by Aaden42 · · Score: 3, Informative

      You'll be waiting a long time for that. Myth Busted, and even the FAA has relaxed the requirement.

    3. Re:Does turning off the device work? by TheCastro1689 · · Score: 2

      You say most other, but that's less and less true everyday.

    4. Re:Does turning off the device work? by Paradise+Pete · · Score: 2

      Airplane mode in iOS 11 does disable the radios and the control panel UI changes to reflect that

      It does, yes. But airplane mode also disables phone calls. They are so close to getting it right. Just make the switches toggle through the three states.

    5. Re:Does turning off the device work? by TheFakeTimCook · · Score: 4, Informative

      Since the battery can't be removed, I'm beginning to wonder if there is any way to turn off wifi AT ALL.

      Yes. Going to "Settings", WiFi , and flipping the "switch" will Turn it off (same with BT); and putting the phone in "Airplane Mode" does, too.

      The only place that it does a "Warm shut-off" is in the Control Panel. And Apple has an (IMHO quite reasonable) explanation as to why that is the case:

      http://www.idownloadblog.com/2...

    6. Re:Does turning off the device work? by ayesnymous · · Score: 2

      And Apple has an (IMHO quite reasonable) explanation as to why that is the case:

      http://www.idownloadblog.com/2...

      That link does NOT provide any explanation about why I'd still want to use those specific features after disabling Wi-Fi, nor does it explain what constitutes a "new location" or what's so special about 5 am.

    7. Re:Does turning off the device work? by TheFakeTimCook · · Score: 2

      You say that your linked article explains why iOS doesn't shut off WiFi or bluetooth when you tell it to shut off WiFi and Bluetooth. And the title of the article you link is: "Apple clarifies why iOS 11 Control Center toggles don’t fully disable Bluetooth and Wi-Fi" but... the article does not offer a reason why iOS does this. It only describes how iOS does this.

      That's good information to have too, but it's pretty far from a reasonable explanation. It's not any explanation.

      I'm not sure what you would consider a "reasonable explanation"; but the first paragraph of the article makes it pretty clear to those that can read:

      "In a support document published today on its website, Apple explains that toggling off Wi-Fi and Bluetooth by tapping their corresponding icons in the new Control Center still leaves the radios on for features like AirDrop, AirPlay, Handoff, Instant Hotspot, Apple Pencil, Apple Watch and Location Services."

      I don't know about you, but, IMHO, a paragraph with the phrase "Apple explains..." Is a pretty good place to start looking for an explanation...

      Remember: Reading is FUNdamental!

    8. Re:Does turning off the device work? by TheFakeTimCook · · Score: 2

      That link only explained WHAT it does, which TFA already did, so the link was worthless. It did not explain WHY it is doing what it does.

      The WHY is simple: As the linked article says: So you can continue to have access to the listded Apple-specific, mostly PEER TO PEER services, without having to:

      1. Try to use them

      2. Get an Error

      3. Turn WiFi/BT BACK ON

      4. Try the Service again

      5. Remember to turn WiFi/BT BACK OFF ...for EACH AND EVERY time you want to use one of the listed Services.

      Yeah, that sounds like a User Experience I (or any sane individual) would want... NOT!!!

      If that doesn't help you understand, then just go to Settings and flip the little Switch on WiFi and BT to "OFF" and guess what?

      IT'S ***OFF***

      Simple as that. It even puts a slash through the WiFi and BT Symbols in the Control Panel to remind the user that those Subsytems are actually O-F-F.

    9. Re:Does turning off the device work? by pots · · Score: 2

      So, you want some sort of "admission of guilt" for something that was CLEARLY a design decision?

      I gave three examples of possible explanations there, only one of those was an admission of guilt.

      You seem to have mistaken the problem here, along with several other things, so I'm going to try to summarize our conversation: the problem is not that Apple has given additional options for partially turning off wifi. The problem is that Apple has provided an option that says it will turn off wifi, but which does not turn off wifi.

      You posted a link to an article which claimed to offer an explanation for why Apple did this, but it did not offer an explanation for why Apple did this.

      I pointed out that the article did not offer an explanation for why Apple did this.

      You repeated that it did, and said that I couldn't read.

      I described what such an explanation would look like, with examples, and pointed out that there is no such thing in the article.

      You... evidently read none of that, and stepped up your abuse.

      So that's the conversation so far. Even if you hadn't decided to throw a tantrum and leave, I'm not sure that this could go anywhere. I doubt that you know why Apple did this, and I certainly don't, so it's not like we would have figured anything out between us. But the fact remains: what Apple has provided is not an explanation for why this is the way it is. It is only a description of how it works.

  2. We Know Better Than You by Bing+Tsher+E · · Score: 2, Interesting

    Apple's paternalistic approach to their users results in a 'we know better than you how to protect you' attitude.

    It's unfortunate for Apple, because it means that only the duller customers will continue to trust Apple's judgement.

    1. Re:We Know Better Than You by Anonymous Coward · · Score: 5, Funny

      It's unfortunate for Apple, because it means that only the duller customers will continue to trust Apple's judgment.

      And thus the perception of anyone using Apple products is "Oh, an Apple user. Here, take my handicapped parking spot, you poor thing."

    2. Re:We Know Better Than You by TheFakeTimCook · · Score: 2

      It's unfortunate for Apple, because it means that only the duller customers will continue to trust Apple's judgment.

      And thus the perception of anyone using Apple products is "Oh, an Apple user. Here, take my handicapped parking spot, you poor thing."

      Would you like a list of all the 2, 3 and 4-digit Slashdot UID owners are also rocking Apple computers and other devices?

  3. Re:We need a new Steve by Bing+Tsher+E · · Score: 2

    The original Steve, who actually did all the initial design at Apple, is still living. One can't blame him for not being much inclined to get involved in the company at this point in time.

    And to be fair it was a 'right time to be there' situation that got the Woz his fame. There are thousands of other nice, adept nerds in the world who could do what he did.

  4. Re:You'll never know if your phone is off by Anonymous Coward · · Score: 2, Insightful

    Mic is always hot on an iPhone ever since they added "hey Siri" support and all audio recorded is almost certainly sent to Apple to help them train their voice AI. We know that with the iPhone X, the camera will also always be active and scanning for faces.

    Ever wondered why the battery life in new iPhones is so abysmal? Because it's always spying.

  5. "UI fails to even attempt to communicate..." by tk77 · · Score: 4, Informative

    Saying the UI doesn't communicate the differences is not entirely true. There is a visual difference in the control center between the radio being "on",m "disconnected" and "off".

    In the normal "compact" control center mode if the device is "disconnected", the icon is displayed with a gray background (blue background is "on"). If the device is "off" the icon has a cross through it. In the expanded view (tap and hold on a button will bring up the expanded view), it will actually say "on", "disconnected" and "off" based on the mode.

    I'm not saying this makes everything better, as the user would still have to know what the visual cue's mean. But to say that the UI fails to communicate this is not true.

    1. Re:"UI fails to even attempt to communicate..." by JohnFen · · Score: 3, Insightful

      I'm not saying this makes everything better, as the user would still have to know what the visual cue's mean. But to say that the UI fails to communicate this is not true.

      "Communication" is different from "signalling". "Communication" requires understanding on the part of the recipient, or it's not communication.

      If it isn't clear to the user what the color-coding means, then the UI is failing to communicate to the user.

    2. Re:"UI fails to even attempt to communicate..." by JohnFen · · Score: 2

      Yeah, that's a good point.

      The failure here is that the UI is not being clear. I think people are overreacting to this a bit, but it is understandable given that it's an Apple UI, and Apple's reputation with user interfaces is that they are designed to be very clear.

    3. Re:"UI fails to even attempt to communicate..." by mrbester · · Score: 2

      ISTR on an old Android phone that it had three states on an icon when you wanted to turn something off: the on state, a greyed out "lost connectivity" state and disabled line-through-it state when it was off. I don't think it was lying but I never cared enough to check and assumed off meant off.

      Which is also why I bought a Rio Karma instead of an iPod (besides being able to play FLACs). Off was off, not some nebulous "low power just in case you want to turn it on again" state that just drained your battery overnight if you didn't put it on charge.

      --
      "Wait. Something's happening. It's opening up! My God, it's full of apricots!"
    4. Re:"UI fails to even attempt to communicate..." by berj · · Score: 2

      What's the problem with negotiating/initiating over bluetooth and then sending the data high-speed over WiFi?

      Both devices have to be newer than 2012-2013-ish vintage.. is that really a huge deal? Of the tens of people I've needed to do file transfers with while working not a single one of them had a device that wouldn't work.

      No neither device needs to be connected to Apple. The connection is entirely peer to peer. I've done it between two laptops, nether of which had an external internet connection.

      But most importantly.. why are you getting so riled up about this? AirDrop is an *incredible* feature. It works very reliably, can transfer huge files (multiple gigabytes in my experience) and is pretty much dead simple to use.

      Seems like you just want to be upset about this for no real reason other than you want to be upset.

      You do you.

    5. Re:"UI fails to even attempt to communicate..." by berj · · Score: 2

      Ahhh.. now we get to the heart of the matter.

      I defend things that work for me and the people I work for and with. If someone has an incompatible machine (it's rare that I run into someone with an android phone or a windows machine in my work.. but it happens) they can upload to dropbox, ftp, email or message me the files.. or even.. gasp.. give it to me on a USB stick. It's substandard.. but the number of people I deal with that have macs and/or iPhones/iPads is sufficiently close to 100% enough that I couldn't really care less.

      There's no standard, open, non-proprietary protocol (on either Android or Windows) that I know of that does anything even close to as well or as simply or across as many different devices and OS versions as airdrop does. Nobody's even close. So it would be pretty damned silly of me to be upset at Apple for giving me exactly what I want.

    6. Re:"UI fails to even attempt to communicate..." by thegarbz · · Score: 2

      It did,...
      From the very beginning,...
      And pressing the button cycled through all three states.

      There was never any confusion about the fact that there were 3 states which did three things and at no point did they change one behaviour for another in some way that wasn't obvious to the user.

      The problem here is not that WiFi or Bluetooth aren't disabled, it's the way that Apple chose to do it and present it to the user made it not immediately obvious that this is the case nor made it obvious how the user can actually control it (by hiding one setting in the settings menu while the other controlling with a button press).

      The entire problem here is simple UI interaction.

  6. Misleading settings by Hognoxious · · Score: 2

    Misleading settings are bad - period. A thing should say what it does and do what it says.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  7. This isn't so hard people ... by seth_hartbecke · · Score: 4, Insightful

    The anti-apple hate here is just ... something else. Two stories on this, really?

    So, on iOS there is this control panel you can access when you swipe up from the bottom of the screen. In there is a WiFi logo, that is normally blue if you are connected to WiFi. If I tap it, it disconnects from the currently connected WiFi network. It's really nice for when I decide "hey, I don't want to access this NSFW thing while on the work WiFi" or "the hotspot in my Car (which has a different carrier then my cell phone)" is in a cellular dead spot and I need to disconnect from it. But when I come in range of another known network, the phone will associate with it again (like, when I get home and I'd like my phone using my home WiFi, I don't have to remember to turn it back on).

    When you do this you even get a blurb of text on the screen "Disconnecting from {wifi name}." NOT "I've powered the WiFi radios down."

    You still CAN actually power the WiFi radios down. You just have to go to Setting -> WiFi -> and flip the off switch. Now they are off, period.

    So yea, the button in the control panel really means: disconnect from this wifi network because I don't like it right now.

    Bluetooth does the same thing. Tapping that in the control center basically drops all connected devices. But two hours later when you turn your bluetooth headset on, it'll pair up just fine.

    Queue freakout.

    --
    END
    1. Re:This isn't so hard people ... by Aaden42 · · Score: 3, Informative

      For those people, there's the switch in Settings that won't turn itself back on. It's in the same place it's always been and does the some thing it's always done. This new switch that looks different in a new place does something different.

      You've always pushed a bright red switch on the right side of the panel to do a thing. One day there's a brand new orange switch on the left side, but the same bright red switch is still in the same place. Perhaps there's a chance the orange switch might do something different than the red one?

      For every time I've come home after a day in flaky WiFi land and forgot to turn WiFi back on until I've sucked down a bunch of LTE data, this is an improvement.

    2. Re:This isn't so hard people ... by millertym · · Score: 2

      Did you hold a monocle over your eye while you typed that? And then walk out to lunch with your top hat on?

    3. Re:This isn't so hard people ... by tlhIngan · · Score: 2

      For those people, there's the switch in Settings that won't turn itself back on. It's in the same place it's always been and does the some thing it's always done. This new switch that looks different in a new place does something different.

      You've always pushed a bright red switch on the right side of the panel to do a thing. One day there's a brand new orange switch on the left side, but the same bright red switch is still in the same place. Perhaps there's a chance the orange switch might do something different than the red one?

      For every time I've come home after a day in flaky WiFi land and forgot to turn WiFi back on until I've sucked down a bunch of LTE data, this is an improvement.

      There's also a situation where a lot of Apple services require proximity to each other. Like Continuity - if my phone rings, I can the the call on my Mac, or iPad or Watch. But if the WiFi is off, that won't happen. The user turned WiFI off, but forgot to turn it back on, breaking a common use case.

      Or if you use AirDrop to send objects from one device to another - it requires use of Bluetooth. But if you have Bluetooth off, it will break AirDrop and you'll spend the next 15 minutes trying to figure out why. Then you'll keep Bluetooth on, until you turn it off again for some reason and then wonder why it broke. The disconnected state lets you still use all the proximity services

  8. Looks to be a copied "feature" from android by will_die · · Score: 3, Informative

    My samsung android has a similar feature I can turn off wifi but if I move to a new location it is turned back on. Like what happen just implemented you have to go into a deep menu and change that setting so off means off.

  9. Re:Another msmash Apple freakout by dgatwood · · Score: 2

    I turn it off to stop it connecting to bad APs. I want it to turn back on if I'm at work or home or Starbucks where I don't want it using up my contract data balance because there's working wifi.

    You know there's an button to forget a Wi-Fi network and an option to not automatically connect to unknown networks, right? And that those features have been around since... IIRC iPhone OS 1.0, give or take?

    --

    Check out my sci-fi/humor trilogy at PatriotsBooks.

  10. Re:You'll never know if your phone is off by TheFakeTimCook · · Score: 3, Informative

    Mic is always hot on an iPhone ever since they added "hey Siri" support and all audio recorded is almost certainly sent to Apple to help them train their voice AI. We know that with the iPhone X, the camera will also always be active and scanning for faces.

    Ever wondered why the battery life in new iPhones is so abysmal? Because it's always spying.

    You're dead wrong on the "Hey, Siri" thing. That is decoded ON-CHIP. That's why it required a new model iPhone (with a new SoC) when it was first announced.

  11. Re:You'll never know if your phone is off by TheFakeTimCook · · Score: 3, Informative

    Mic is always hot on an iPhone ever since they added "hey Siri" support and all audio recorded is almost certainly sent to Apple to help them train their voice AI. We know that with the iPhone X, the camera will also always be active and scanning for faces.

    Ever wondered why the battery life in new iPhones is so abysmal? Because it's always spying.

    Same thing for the FaceID. ALL done ON CHIP, in the Secure Enclave IC. NOTHING sent to Apple.

    NOTHING. Not even during "Enrollment". And no FaceID Data available outside of the Secure Enclave chip. They provide a low-res "face tracker" mesh to the outside for Apps to use; but nothing that approaches the resolution of the FaceID data.

  12. Bow down before the one you serve by GrumpySteen · · Score: 2

    You're going to get what you deserve

  13. Re:You'll never know if your phone is off by TheFakeTimCook · · Score: 2

    There is no way of verifying this information. We simply have to trust apple that its true. Did we forget 'Trust, but Verify'?

    Really? NO way to use a Packet Sniffer to see a burst of data when you say "Hey, Siri"?

    But you won't; because it DOESN'T.

  14. Re:We need a new Steve by TheFakeTimCook · · Score: 2

    The original Steve, who actually did all the initial design at Apple, is still living. One can't blame him for not being much inclined to get involved in the company at this point in time.

    And to be fair it was a 'right time to be there' situation that got the Woz his fame. There are thousands of other nice, adept nerds in the world who could do what he did.

    But in stark contrast with those other "nice, adept nerds", Woz actually DID do it.

  15. Re:You'll never know if your phone is off by spire3661 · · Score: 2

    I guess slashdot has forgotten 'trust, but verify'. Dont fucking tell me to trust something if i cant see the source code. Its a principle of computing and im tired of morons like you saying 'just go with it'

    --
    Good-bye