WWDC, DOJ, and Smart Rings – Intego Mac Podcast Episode 337

Posted on March 28th, 2024 by Kirk McElhearn

New macOS updates with fixes arrived this week: we’ve got some details. Rumors of an Apple Ring compelled us to look into the market-leading Oura ring. A security setting for Apple’s Journal app has generated some confusion: we’ll try to straighten things out. And the dates for Apple’s annual Worldwide Developers Conference have been announced. We’ll have some guesses of what might be coming.

If you like the Intego Mac Podcast, be sure to follow it on Apple Podcasts, Spotify, or Amazon.

Intego Mac Premium Bundle X9 is the ultimate protection and utility suite for your Mac. Download a free trial now at intego.com, and use this link for a special discount when you’re ready to buy.

Get Apple security news delivered straight to your inbox, for free. Intego’s twice-monthly newsletter will keep you informed about Apple-related privacy and security, along with tips and tricks for getting the most out of your Mac or iPhone. Subscribe for free—no strings attached.

Transcript of Intego Mac Podcast episode 337

Voice Over 0:00
This is the Intego Mac Podcast—the voice of Mac security—for Thursday, March 28 2024.

This week’s Intego Mac Podcast security headlines include: New MacOS updates with fixes arrived this week. We’ve got some details. Rumors of an Apple Ring compelled us to look into a similar ring wearable that’s already available. A security setting for Apple’s Journal app has generated some confusion. We’ll try to straighten things out. And the dates for Apple’s annual Worldwide Developers Conference have been announced. We’ll have some guesses of what might be coming. Now here are the hosts of the Intego Mac Podcast. Veteran Mac Journalist, Kirk McElhearn and Intego’s Chief Security Analyst, Josh Long.

Kirk McElhearn 0:52
Good morning, Josh. How are you today?

Josh Long 0:53
I’m doing well. How are you, Kirk?

When will Apple hold its Worldwide Developers Conference this year?

Kirk McElhearn 0:55
I’m doing just fine. Do you have any plans for June 10?

Josh Long 0:58
June 10. Oh, yes, I do. I’m gonna be watching the WWDC keynote.

Kirk McElhearn 1:03
Well, I thought it was gonna surprise you here and you already knew about it.

Josh Long 1:05
No, man. And this is on my calendar. This. This is like probably Apple’s biggest event of the year. So once upon a time, it used to be Macworld Expo keynote, right and Steve Jobs or somebody would get up on stage and present all the stuff that Apple’s going to be doing this year, all the big new announcements of the year. Apple doesn’t do that anymore. Of course, Macworld Expo doesn’t exist. And even the last few years at Macworld Expo, Apple had pulled out of the show. And so now the one big event of the year is WWDC, although this is the Worldwide Developers Conference, it’s something that really does give a lot of insight into what’s going on at Apple, what we can expect the rest of the year in the second half of the year. Because Apple is showing off all the new features and functionality that you know, with a little bit of a developer twist, like here’s some things as developers that you can do with all these new things that we’re adding to our operating systems that are coming out in the fall. But everyone also knows that it’s really an opportunity for Apple fanboys and to to watch this, this great event where we get to find out all the great things that are coming in the operating systems later in the year. And sometimes they do other things to some hardware announcements. So we’ll see what we’re gonna get. There’s some things we kind of no we’re gonna get, but other things we’re not sure we’re gonna get yet.

Kirk McElhearn 2:28
It’s a weird event, because it’s a tease, right, with the exception of the occasional hardware, and maybe we’ll get the M series Mac Pro this year with an M three super ultra Max, whatever they’re gonna call it, but they tease the operating systems that are coming out in the fall, which is going to be iOS 18 and iPad os 18, macOS 15, watch os 11. In our show notes, you put vision os 2.0 with a question mark, wouldn’t count on it, but you never know. And probably AI features or how would you call it AI inspired features or AI infused features? I don’t think it’s going to be a purely generative AI tool. Yet there have been some speculation that Apple’s been negotiating with Google to use Google’s AI for generative AI. But remember, there are two types of AI the one and I think I mentioned this a few weeks ago, the perfect place for this is in spotlight, that it would get more ways of finding things even if it doesn’t find the exact keywords you’re looking for. Spotlight is great if you know exactly what you’re looking for. But if not, it doesn’t work that well improved Siri. I can’t say any improvement to Siri will be an improvement to Siri because it still fails in so many levels. So we’ll find out and we’ll get a glimpse of what we’re going to be spending our money on on the phone.

Josh Long 3:44
You mentioned that it’s kind of a teaser or things to come with. And of course, whenever Apple announces WWDC, there’s all kinds of teasers. So they have Greg Johnson back aka Jaws, one of the Apple executives posted this on social media the other day saying mark your calendars for WWDC 24, June 10 through 14th it’s going to be absolutely incredible with the A and the AI in absolutely incredible capitalized. So yeah, I wonder if that was a hint. Apple does this very often. They drop little teasers here and there. People are also speculating a lot about the interesting w w in the stylized logo for WWDC, because it kind of looks like not two W’s next to each other. It looks like three connected V’s or maybe WV or even VW. Did Apple cancel the Apple Car project because they’re going to buy VW. What do you think Kirk?

Kirk McElhearn 4:44
Well, I think actually what stuck out to me was I’ll put a link in the show notes to the Apple press release about this as the top line is the W V whatever. The second line is DC and that made me immediately think that Apple is buying the DC Universe.

Josh Long 4:57
Or they’re buying Washington, DC Maybe not. Okay. Well, this see this is the problem is…

Kirk McElhearn 5:04
Well, that suggests some serious political lobbying. And I don’t know that that’s the tenor that Apple wants to give.

Josh Long 5:10
Well people do get really ridiculous. By the way, these are not the craziest theories that I’ve seen people speculating on. So people have a lot of fun predicting what all of the hidden meanings are in these announcements, but at least we I think we can be pretty certain that we’re getting some AI related features. It’s kind, it’s kind of inevitable. I mean, Apples really behind the curve in a lot of ways. You mentioned that the search algorithms already kind of use some of that type of technology. There’s a lot of things that actually do use artificial intelligence that are already built into Apple products. But of course, everybody’s really interested in like generative AI and like, what could Apple be doing in that area?

What operating systems did Apple update this week?

Kirk McElhearn 5:51
Okay, we had some updates this week, they were minor updates, they were dot one updates, and Apple released an update for the iPhone and the iPad, but very strange that most people won’t be able to install.

Josh Long 6:02
Okay, let’s start with the macOS updates. So on Monday, this week, Apple actually released updates for a whole bunch of operating systems. Last week on the 21st. We got iOS 17, point 4.1 and iPad os17.4.1. And also a vision OS update. One point 1.1. This week on Monday, we got a macOS Sonoma, update 14 point 4.1. And also some related patches for the two previous macOS versions. MacOS Ventura got the two same patches that are in Mac was Sonoma OS update. And also Mac was Monterey got one patch just for the Safari browser. But what did Apple update? Well, technically, it was just one vulnerability, but in two different components of the operating system. Apple says that processing an image may lead to arbitrary code execution. And so they improved the input validation to prevent malicious images from being able to execute arbitrary code on your device. Basically, this is one of those types of vulnerabilities that somebody could use to potentially infect your device, or, you know, jailbreak it or things like that.

Kirk McElhearn 7:17
This is the kind of no click attack that we’ve seen in the past with things like the Pegasus spyware, that just previewing an image in the Messages app, or in an email message could run code. And this is actually, it sounds kind of obscure when you describe it. But this is actually quite a serious vulnerability.

Josh Long 7:35
That’s true. And this was found or reported to Apple, at least by somebody who works for Google’s project zero, which does a lot of investigation of potential vulnerabilities and then reporting those to the companies that are in charge of fixing those things. Now, it kind of makes sense why Apple didn’t really tell us last week, what was in the iOS and iPad OS updates, and made us wait until Monday this week to find out once they patched everything else. Because basically, yeah, this could be used for jailbreaking could be used, like you said, even for potentially zero click attacks. So I think this is really important to make sure that your devices are up to date on all the latest Apple operating systems to make sure that people can’t exploit this vulnerability.

Kirk McElhearn 8:19
Okay, so what about this strange iOS iPad OS update that you can’t install, unless you have a desktop computer, so Apple seems to have re released the 17.4.1 update. But the only way you can install it is by connecting your phone to a Mac or to a PC and using the Finder on the Mac or iTunes on the PC to do the installation, the old way. Now since the vast majority of iPhone users don’t have desktop computers, they won’t be able to install it. But could this be that the version of the 17.4.1 update that people got to install by a computer’s had a problem that was being fixed here? That doesn’t affect people who got the over the air update?

Josh Long 9:00
If you’ve already got 17.4.1 installed, not something you need to worry about. And if you haven’t installed it yet, well, you’re going to get the new version of it when you go to install it. So not something anyone needs to worry about. But just in case you happen to see headlines about it.

Apple tech Journalists may be out of their depth discussing DOJ lawsuits.

Kirk McElhearn 9:14
Okay, we are experienced podcasters. And as such, we have opinions about everything. And we know about everything. And there is nothing that is over our heads. If you paid attention to the news at all. In the past week, the US Department of Justice has filed a lawsuit against Apple for antitrust violations. And as intelligent responsible podcast is we’re going to rip this apart paragraph by paragraph and tell you whether the Department of Justice has a case. We’re not going to do that we are not lawyers. We don’t know anything about antitrust law. We’re going to link to an article in The New York Times where you can read about this. We were both discussing before the show. It’s a little bit annoying to read tech journalists writing about this if they’re not lawyers, and they’re claiming to understand and explain why Apples right and the Department of Justice is wrong. I don’t think the Department of Justice would have launched a lawsuit. If it was as clueless, as some of the commentators are saying, we wanted to mention it because it’s in the news. But we don’t know anything about it.

Josh Long 10:13
Right. You know, I’ve seen some interesting points made by some of these tech journalists, but also they’re not lawyers. And so depending on the particularities of the law, or laws that Apple is supposedly violating here, there may actually be a case where it doesn’t look like one from a technical perspective from a purely technical perspective. So I think that’s it’s let’s wait and see kind of how this all shakes out. The US is claiming that Apple has an monopoly when it comes to the iPhone. And as a result of that, there’s certain things that Apple may need to change if it’s found that Apple has violated the law.

Does Apple’s Journal app broadcast my contact information?

Kirk McElhearn 10:54
Okay, there has been a story that’s made a lot of noise on social media recently about the Journal app that’s in the iPhone. And we want to briefly discuss this and explain why it’s not as scary as it sounds. But so there is this setting for the Journal app that’s on by default that allows you to be discoverable by others. So that means that let’s say, Josh and I are having lunch, the Journal app might say to me, Hey, you had lunch with Josh, maybe you want to write about a new Journal, and Josh might get the same thing in his Journal app. Some people were thinking that this is a real privacy issue. Others are realizing it’s just saying, Well, you were near this person who’s in your contacts, who you know, et cetera. We’re going to link to Joanna Sterns article in the Wall Street Journal, which kind of explains how this works. But you see, there’s a flip side. And the scenario that I thought of earlier, imagine you’re cheating on your spouse. And you go and have lunch with someone who’s in your contacts in the Journal app is saying later, well, you had lunch with so and so would you like to write about it. Imagine that your spouse knows the passcode for your iPhone, because they have been shoulder surfing and you’ve put the passcode in 100 times when they were the nearby and never paid attention. And they happen to look at your Journal app and they see this well, this could lead to some problems.

Josh Long 12:10
Well, that’s interesting. And here’s what Apple had a company spokesperson tell Joanna Stern, they say that the phone can use Bluetooth to detect the number of devices nearby that are in your contacts. However, Apple says that it doesn’t store which of these specific contacts were around, but instead may use this as context to improve and prioritize Journaling suggestions. So if that’s accurate, and it’s not actually storing any data about who in your contacts was nearby. See, that seems kind of weird, because like, obviously, your phone does know which of your contacts are nearby, it’s able to tell that based on Bluetooth and knows that this particular phone is associated with this particular phone number that’s in your contacts, so your phone knows who’s nearby, but it’s not recording specifically who’s nearby. It’s just kind of…

Kirk McElhearn 13:02
But should your phone even know who’s nearby?

Josh Long 13:05
If you find any of this concerning, you can actually turn this off in the settings. If you go into the Settings app on your iPhone, you scroll down to privacy and security, tap on that. And scroll down again to Journaling suggestions and tap on that. One of the settings that you’ll see there is discoverable by others. And you’ll notice that beneath that it says allow others to detect you or nearby to help prioritize their suggestions. So that’s what kicked off this whole like, you know, social media frenzy about oh my gosh, like what’s Apple doing? I can’t believe this is on by default. If this concerns you, you can turn that setting off, it’s one tap to turn that off. And once you actually navigate to the right place, but it is easy enough to turn it off if if you find any of this concerning.

Kirk McElhearn 13:50
So you might think that if you don’t use the Journal app at all, you shouldn’t worry about it. But as long as the setting is enabled, other people will be notified if you’re around even if you’re not using the Journal app because they’re using the Journal app. So if you’re worried as Josh to turn it off, let’s take a break. We’ll be back in a minute.

Voice Over 14:07
Protecting your online security and privacy has never been more important than it is today. Intego has been proudly protecting Mac users for over 25 years. And our latest Mac protection suite includes the tools you need to stay protected. Intego’s Mac Premium Bundle X9 includes Virus Barrier, the world’s best Mac anti-malware protection, Net Barrier, powerful inbound and outbound firewall security, Personal Backup to keep your important files safe from ransomware. And much more to help protect, secure and organize your Mac. Best of all, it’s compatible with macOS Sonoma, and the latest Apple Silicon Macs. Download the free trial of Mac Premium Bundle X9 from intego.com today. When you’re ready to buy, Intego Mac Podcast listeners can get a special discount by using the link in this episode’s show notes at podcast.intego.com. That’s podcast.intego.com and click on this episode to find the special discount link exclusively for Intego Mac Podcast listeners. Intego. World class protection and utility software for Mac users made by the Mac security experts.

Dozens if not hundreds of requests to reset your Apple ID are likely a scam.

Kirk McElhearn 17:03
Okay, we have a story by Brian Krebs on his blog, Krebs on security called recent MFA bombing attacks target Apple users. MFA is multi factor authentication, we often talk about two factor authentication, but the industry standard is a code multi-factor. Because there can be more than two, there seems to be a way that people can attack users with a request to reset their Apple ID password. And it’s not just one request, it’s dozens, it’s hundreds, and you’re swiping away, you’re tapping No, but eventually, you type the wrong thing. And then someone can reset your password. It’s kind of like a distributed denial of service attack on your brain, because you may be busy doing something and you can’t pay attention to you getting all these notifications. If this happens to you, what do you do you ignore it, you tap the little X to clear all notifications rather than tapping each individual one. If you see one, you should already start worrying if you didn’t request a password reset. But if you see more than one, then you know, it’s definitely this sort of attack.

Josh Long 18:03
And by the way, this also means that you should make sure that you change your password because it’s very likely that somebody else knows your password, and he’s trying to break into your account using that password. So make sure that you actually do go to Apple.com and reset your password for your Apple ID. If you don’t do that, then people are going to still probably continue to send you these requests. And you may accidentally click on it and approve it at some point and give somebody else access to your account, which you definitely do not want to do.

Old routers are the targets of a new attack hack.

Kirk McElhearn 18:40
So routers, again, this is our weekly router segment where routers are being swept into a proxy service. Unbeknownst to users. Basically, routers that haven’t been updated in a long time are being hacked. They’re added into a sort of a botnet. These are routers in many cases that are no longer receiving security updates or that people have just forgotten about it. When was the last time you looked at your router set thing in the in the corner that does the stuff that gets you the internet, you don’t pay attention to it. You need to check your router. Joshua said this 100 times Josh just sent me a t shirt said update your router firmware, check your router, update the firmware, if it’s old, buy a new router, don’t rent a router from an ISP, buy a router because it’ll end up being cheaper.

Josh Long 19:18
Yeah, very often, if you’re buying a router on your own, it’s going to pay for itself like very quickly because it doesn’t cost that much usually to buy a router. So yes, it’ll save you money. And it gives you the opportunity to granularly look at at the security settings on the router yourself and make sure that it meets your standards. And it makes sure that you can easily update the firmware yourself because sometimes if you get a router from your internet service provider, you may not necessarily be able to manually check for firmware updates yourself, or you may not know how to do that. And if you’re setting up your router on your own, then well you by necessity you need to know how to how to update it.

The Oura Ring may provide ideas of what an Apple Ring could do.

Kirk McElhearn 20:00
Okay, Josh and I have been talking for quite a while about the Apple Watch. And Josh has an Apple Watch. And so do I. And I use my Apple Watch to track my sleep. And Josh doesn’t want to do that. He doesn’t want to wear a watch at night. And we got talking about specifically…,

Josh Long 20:15
Because my watch battery is so bad, I’m probably gonna get an Apple Watch Series 10 When they get released later this year, but until then, yeah, my battery, life’s not so great. And so I charged it overnight.

Kirk McElhearn 20:29
Okay, so we got to talking about smart rings, and particularly when there was some information recently about Apple potentially working on a smart ring. So what I’ve done is I have looked at the Oura Ring, which is the best selling smart Ring that tracks activity and sleep. And I’ve compared it to the Apple Watch, we have an article on the Intego Max security blog. And we’re gonna go through some of the basic details. It’s important to note that in this article, I only compared what can be compared activity tracking and sleep tracking. The Oura doesn’t have a display, you can’t make phone calls, it doesn’t have notifications, you can’t play games, it doesn’t have a web browser. They’re totally different devices. However, what’s really interesting is that the Oura, and I’m wearing it now and Josh can see it. And there’s a photo at the head of the article showing me wearing the Oura Ring next to the Apple Watch. It’s small, it’s discreet, it doesn’t get in the way. As for battery life, they say it has from four to seven days battery life, I find that three days is about what you get, you need to have 30% battery life before you go to sleep for it to track your sleep. And I find it uses about 25% in 24 hours. So basically three days you’re okay. But it takes 15 minutes to charge. I put it on the charger when I take a shower in the morning. And 15 minutes later was charged. So it’s not a real hassle. So activity and sleep. When I started looking into this, I worked on Reddit and Facebook and other places. And pretty much everyone says as an activity tracker. It’s not very good. And I’ll give a couple examples why. In the article, I have a screenshot of a walk that I took, I recorded this on my Apple Watch is a workout and also with the Oura app. So the Oura app only tracks your heart rate when you’re still. But if you record a workout, then it will track your heart rate. And at the end, my outdoor walk was 1.44 kilometers from the Apple Watch. But according to the Oura Ring, it was only 1.3 kilometers. Now the Oura gets location information from my phone. We’re talking three devices here already right the watch the Ring and the phone and they’re all competing with each other. The Oura app can show a map of where I walked, but he got the distance wrong. So if you really care about how far you’re running, or cycling or walking, this is not very good. The only thing I found and this was really interesting. A few days after I got it, I was looking at the step count. Now, Apple uses those three rings, the move ring, the exercise ring and the standard ring, and they use calories. And every device that calculates calories based on activity. It’s an estimate, it’s not really precise. The Oura app lets you choose to goals either calories or steps. And steps make a lot of sense because the first trackers were like Fitbits. And all they tracked was steps. And it’s an easy metric to think of. You want to do 10,000 steps or 8000 or 5000. It’s an easy metric. You know how long a step is, but you know how long the category is. So I noticed at one point, early afternoon, the Oura app was showing like 2000 more steps than the Apple activity app. And I did some research into it. And it turned out that it was counting as steps the movements of my fingers on the keyboard as I was typing.

Josh Long 23:44
Wow, that’s, that’s weird. It is weird.

Kirk McElhearn 23:47
Well, it has an accelerometer. And the way an accelerometer works is it’s like imagine a sphere with something floating in it. And when you move it touches on any sign that counts as a step as a movement, right. And since I touch type, and I’m wearing it on my little finger, because the only finger to get one to fit for, I don’t use my little finger as much as the others. But I use it enough apparently, for it to kind of step so it’s not reliable for distance. It’s not reliable for steps.

Josh Long 24:12
This is actually really interesting because, you know, comparing that to the Apple Watch, think about when you’re typing, you know, you’ve got your hands in front of you. And if you’re if you’re typing, your fingers are moving, but your wrist is pretty much staying still the whole time. And so your watch is stationary, it might detect some vibrations, maybe a little bit of movement, but it’s not moving around nearly as much as your Ring.

Kirk McElhearn 24:36
Yeah. So for activity, the Apple Watch is clearly better because it has all these things like a display. So you can see your heart rate and your distance and your pacing and your splits and all of that which you can’t see with the Oura. You can’t even open the app and hold the phone in front of you when you’re running to see this sort of data. It’s not designed for that for sleep tracking. However, it’s really quite interesting because the Apple Watch detects your heart rate from The top of your wrist and the Oura detects it from the arteries under your finger. So it’s getting a better access to information. Now I’ve put a screenshot in the article of one night where Apple told me I was time in bed was eight hours, 36 minutes time asleep was 745. The Oura told me time asleep was seven hours three, they don’t agree, we’ll have another article soon about sleep tracking on the Apple Watch where you can compare between the Apple Watch and a third party app. None of these things ever agree totally. What’s interesting though, is the Oura app pays attention to your heart rate and to your heart rate variability. I won’t go into anything about heart rate variability HRV, there’s a link in the article that you can follow. The Oura app is good for sleep tracking in the sense that like all of these devices, it will alert you to trends, you’re sleeping more you’re sleeping rest, you can’t consider that the numbers that they give you are absolute. If you compare in my screenshot, the time for REM sleep and deep sleep, they’re very different. But you do get a trend of how long you’re sleeping from night to night. And for someone like you, Josh, who doesn’t want to wear a watch at night. And maybe even when you do have a better battery, you don’t want to wear it at night, it’s not really that comfortable. I mean, I’ve gotten used to it. In fact, if I get up to go to the bathroom, I can put the flashlight on my watch. And I really liked that that’s practical. But I can understand wanting to wear something much slimmer, like a Ring at night to track your sleep.

Josh Long 26:27
Yeah, so we’d have no idea, of course, whether Apple is ever going to release a Ring. But this is probably something that they’re at least working on behind the scenes. But there’s I think a lot of interest, especially now that a lot of competitors. Samsung is about to release their Galaxy Ring. We’ve got a lot of other manufacturers like Oura that already have a ring on the market that does the stuff fairly well. And so it would be really nice to see Apple come out with yet another wearable that works in tandem with the watch. And remember, if you’ve got multiple data points, these things can work very well together. So I would love to see an Apple Ring. If we don’t get that in, you know, let’s say the next year or two, maybe maybe the next Apple Watch that I get will be fine. And I don’t really need a ring, but I don’t know we’ll see. I do love the idea of a potential Apple Ring, though, I think there’s a lot of cool stuff that they could do.

Kirk McElhearn 27:18
Okay, just one point is the Oura Ring, you pay upfront anywhere from 299 to $449. But you also have to pay a subscription of $6 a month, that’s $72 a year. Now, if you don’t pay the subscription, when you open the app, you get the scores like the sleep score and the activity score. It seems weird to buy a hardware device and then have to pay a subscription to see the data that it’s collecting. You’re not paying for to collect the data. It’s just the way that it’s presented to you. But there is a workaround to use the website if you want to save that kind of money. It’s a lot $72 a year. I like the Oura Ring, it’s light. It does certain things. I don’t know if I’m gonna keep wearing it all day long for activity tracking, but I’ll probably keep wearing it for sleep tracking, just out of curiosity.

Josh Long 28:10
Well, I can definitely see myself getting a Ring at some point. So I am glad that you took the time to check it out and compare how it does relative to the Apple Watch.

Kirk McElhearn 28:19
Okay, that’s enough for this week. Until next week, Josh stay secure and sleep well tonight.

Josh Long 28:23
All right, stay secure.

Voice Over 28:26
Thanks for listening to the Intego Mac Podcast—the voice of Mac security—with your hosts, Kirk McElhearn and Josh Long. To get every weekly episode, be sure to follow us on Apple Podcasts, or subscribe in your favorite podcast app. And, if you can, leave a rating, a like or review. Links to topics and information mentioned in the podcast can be found in the show notes for the episode at podcast.intego.com. The Intego website is also where to find details on the full line of Intego security and utility software: intego.com.

About Kirk McElhearn

Kirk McElhearn writes about Apple products and more on his blog Kirkville. He is co-host of the Intego Mac Podcast, as well as several other podcasts, and is a regular contributor to The Mac Security Blog, TidBITS, and several other websites and publications. Kirk has written more than two dozen books, including Take Control books about Apple's media apps, Scrivener, and LaunchBar. Follow him on Twitter at @mcelhearn. View all posts by Kirk McElhearn →

Share