Hacker News Reader

I believe this is theoretically fixed in Ventura via the mechanism of always checking notarization status upon execution, in which case Apple could publish a notarization revocation ticket for the old insecure AppleMobileBackup binary to make it inoperable without significant intentional user action.

View on HN

And that doesn’t help if the entire purpose for the passcode requirement is to keep other actors from backing up your phone.

That shouldn't be an issue because to start a backup, the computer must be "trusted" which requires you to enter your pin.

Unless there is a security vulnerability that allows for the host to be spoofed.

https://theevilbit.github.io/posts/cve-2022-32929/

I don't think that page demonstrates how the host itself could be spoofed. Maybe you could show me what you mean.

The issue may be that the old binary is still able to run.

Reply on news.ycombinator.com