MacRumors

Researcher Bhavuk Jain in April discovered a critical Sign in With Apple vulnerability that could have resulted in a takeover of some user accounts. The bug was specific to third party apps that used Sign in With Apple and didn't implement additional security measures.

Jain notes that Sign in With Apple works by authenticating a user through a JWT (JSON Web Token) or a code that's generated by Apple's server. Apple then gives users the option to share either the email tied to their Apple ID or a private relay email address,which creates a JWT that's used to log in a user.

Jain then discovered that once JWTs for both Apple ID emails and private relay email addresses were requested and the token's signature was verified using Apple's public key, it "showed as valid." Should the bug have not been discovered, a JWT could be created and used to gain access to one's account.

In an interview with The Hacker News, Jain spoke about the severity of the bug:

The impact of the this vulnerability was quite critical as it could have allowed a full account takeover. Many developers have integrated Sign in with Apple since it is mandatory for applications that support other social logins. To name a few that use Sign in with Apple - Dropbox, Spotify, Airbnb, Giphy (now acquired by Facebook).

According to Jain, Apple conducted an investigation and concluded that no accounts were compromised using this method before the vulnerability was patched. Jain was paid $100,000 by Apple under its Apple Security Bounty Program for reporting the bug.

This week saw an interesting mix of news and rumors on the Apple front, led by the release of macOS 10.15.5, which brings a new battery health feature to newer Mac notebooks, while we also saw the official announcement of new colors for the Powerbeats Pro earphones.

On the rumor front, we heard a few tidbits about not just this year's iPhone 12 but also next year's iPhone, while we saw photos and videos of a new style of Leather Loop Apple Watch band. And finally, there was a weird iOS bug last weekend that saw users unable to open some popular apps. Apple fixed the issue, although it appears to have required users to redownload a bunch of recent app updates.

Read on for more details on all of this week's top stories!

Apple Releases macOS Catalina 10.15.5 With Battery Health Management Features, Fix for Finder Freezing

After releasing operating system updates for most of its products last week, Apple this week pushed out macOS Catalina 10.15.5, an update that brings a new battery health management feature to recent notebook models, as well as some other updates and bug fixes.

Not all of the changes are being greeted with applause, however, as there appears to be a bug related to creating bootable backup drives, and a change by Apple will make it harder for users to escape being nagged to upgrade to the latest macOS updates going forward.

Apple Confirms 'No Longer Shared' App Bug Has Been Fixed

Late last week, many iOS users found themselves unable to open a number of popular apps, with their devices displaying a "This app is no longer shared with you" alert whenever an affected app was launched.

While there were some workarounds for the issue, Apple ultimately fixed the issue late Sunday, but it required reissuing recent updates for a number of apps, which for many users resulted in dozens or even hundreds of app updates.

On Tuesday, Apple confirmed that it had fixed the issue, although it didn't offer any additional explanation about the cause of the problem.

Leaker: Apple to Stick With Lightning Over USB-C for 'iPhone 12' Before Going Port-Less Next Year

Noted Twitter leaker @choco_bit has shared that the iPhone 12 will unsurprisingly continue to feature a Lightning port for charging rather than transitioning to USB-C, but it's what the leaker has to say about next year's iPhone that's more interesting.

Apple will reportedly be eliminating the charging port entirely on the 2021 iPhone, shifting to a Smart Connector similar to that seen on recent iPad models to allow for power and data transfer with accessories like keyboard cases.

Powerbeats Pro Debut in Four New Colors: Spring Yellow, Cloud Pink, Lava Red, and Glacier Blue

Following a couple of leaks in recent weeks, Beats today is officially announcing four new colors for its Powerbeats Pro wireless earphones: Spring Yellow, Cloud Pink, Lava Red, and Glacier Blue. The new earphones will go on sale June 9 and sell for the same $249.95 price as the existing color options.

Aside from the colors, the new ‌Powerbeats Pro‌ models are otherwise identical to the original Powerbeats Pro, offering up to nine hours of listening time with the charging case bringing the total listening time to over 24 hours. Apple's H1 chip brings easy pairing, seamless switching between devices via iCloud, and "Hey Siri" functionality, while on-ear volume and track buttons on each earbud offer simple controls and adjustable earhooks help secure the earphones during vigorous workouts.

Apple Could Be Planning Redesigned Leather Loop Apple Watch Band

Recently surfaced photos and videos show what could be a redesign for Apple's Leather Loop Apple Watch band, shifting from a single-piece loop style to two pieces that attach magnetically.

It remains to be seen whether these are ready for launch in the near future, perhaps at WWDC next month or in September alongside the Apple Watch Series 6. Alternatively, these could be prototypes that were ultimately scrapped, or even knockoffs meant to mimic Apple's band style.

Jailbreak Tool 'unc0ver' 5.0 Released With iOS 13.5 Compatibility

Jailbreaking to install unauthorized apps and modifications on iOS devices has waned in popularity over the years, but the team behind the "unc0ver" jailbreaking tool has released a blockbuster new update that claims to be able to jailbreak "every signed iOS version on every device" ranging from iOS 11.0 to iOS 13.5.

Apple will undoubtedly move to fix the vulnerability that allows the jailbreak to work, so expect to see a new iOS update in the not-too-distant future.

MacRumors Newsletter

Each week, we publish an email newsletter like this highlighting the top Apple stories, making it a great way to get a bite-sized recap of the week hitting all of the major topics we've covered and tying together related stories for a big-picture view.

So if you want to have top stories like the above recap delivered to your email inbox each week, subscribe to our newsletter!

There are tons of hidden features and shortcuts for Macs that Apple has built into macOS over the years, ranging from shortcuts to keyboard commands to other little hacks to make Mac usage just a bit simpler. In our latest YouTube video, we highlighted several of these tips and tricks, and some of them might just be new to you.

• Transfer Files Fast - If you hold down "T" when your Mac is booting up, you can enter Target Disk Mode. In this mode, use a Thunderbolt 3 cable to transfer large files at fast speeds between two Macs.
• Paste With Style Matching - When pasting something, if you use Option-Shift-Command-V instead of just Command-V, you can transform the pasted content into the style of the content that already exists in a document. If you have a block of text that's bold, for example, and then want to paste in text from the web and make it bolded too, you can use this keyboard shortcut.
• Turn a Website Into a Dock App - You can add any website to your dock by dragging the URL bar over to the bottom section of the dock that houses open and recently used apps. Adding a website to the dock makes it quicker to open because you can click from that spot alongside all your apps.
• Quick Print Shortcut - If you go to the Printers and Scanners section of System Preferences and drag the icon for your favorite printer to your desktop, you can then drag and drop files onto the printer icon to print them automatically.
• Screen Sharing in Messages - In a Messages conversation with someone, click on the "Details" link and then click on the icon that looks like two screens together to initiate screen sharing with the person who you're talking to. This is super handy for troubleshooting problems for less tech savvy family members from afar, provided you can get them to click the screen sharing option.
• Preview Files From the Dock - In the Downloads or Documents folder on the Dock, hover your mouse over a file and then press the space bar to see a preview. This also works for selected files in Finder.
• See Where Files are Stored - If you have a Downloads or Documents folder on your dock, you can hold Command and click on a folder or file to display its location in Finder.
• Move Files Quickly - To move files from one location to another using keyboard shortcuts, just use Command-C to copy the files you want to move and then Option-Command-V to move those files to a new spot.

Know of other useful Mac tips and tricks that we didn't cover here? Let us know in the comments and we might highlight them in a future video.

Following a couple of leaks in recent weeks, Beats today is officially announcing four new colors for its Powerbeats Pro wireless earphones: Spring Yellow, Cloud Pink, Lava Red, and Glacier Blue. The new earphones will go on sale June 9 and sell for the same $249.95 price as the existing color options.

Aside from the colors, the new ‌Powerbeats Pro‌ models are otherwise identical to the original Powerbeats Pro, offering up to nine hours of listening time with the charging case bringing the total listening time to over 24 hours. A five-minute Fast Fuel charging feature gives you up to an hour and a half of playback time.

As with every other recent Beats and AirPods product, the ‌Powerbeats Pro‌ include Apple's H1 chip for easy pairing, seamless switching between devices via iCloud, and "Hey Siri" functionality.

Designed with a sports focus, ‌Powerbeats Pro‌ offer IPX4 sweat and water resistance, so you can use them in the gym without worry. You should avoid submerging them in water, although the original models stood up to splashes, brief submersion, and even more extended dunking in our testing.

‌Powerbeats Pro‌ include on-ear volume and track controls on each earbud, and adjustable earhooks help secure the earphones during vigorous workouts. Four sizes of eartips are included to maximize comfort and provide a good seal in the ear, although the earphones don't offer any active noise cancellation.

The ‌Powerbeats Pro‌ charging case is considerably larger than the case for the AirPods or AirPods Pro, primarily due to the larger design of the earphones themselves. The case also charges solely through a Lightning port and does not charge wirelessly, though a Lightning to USB-A cable is included.

Bluetooth accessory maker Tile has written to the European Union accusing Apple of abuse of power and of illegally favoring its own products.

According to a report by Financial Times, in a letter sent on Tuesday to the European Commissioner for Competition, the accessory maker said that Apple is making it harder for users to use Tile products on iPhone because it has its own rival Find My app.

In a letter sent to European competition commissioner Margrethe Vestager on Tuesday, California-based tracking app maker Tile argued that Apple was making it more difficult for users to operate its product on their smartphones compared to Apple's own rival application, FindMy, by selectively disabling features that allow for seamless user experience.

Tile asked the EU to investigate Apple's business practices, echoing previous calls made by the accessory maker in the United States. Specifically, Tile complains about changes Apple made to location services in iOS 13, which encourage customers not to use always-on location tracking. In addition, Tile said changing these options involve navigating between "complex settings not easy to find."

The report notes that Apple is also rumored to be launching its own AirTags item tracking tags soon. MacRumors uncovered evidence of AirTags within iOS 13 code last year. The tags will be closely integrated with the new ‌Find My‌ app, which will be getting an "Items" tab. Users will receive a notification when they are separated from a tagged item, and if necessary, they can set an AirTag to start making sounds to help locate the lost item.

In the letter, Tile goes on to claim that its product is being denied "equal placement" on the App Store and that Apple has terminated its agreement to sell Tile products in its retail stores, perhaps with one eye on the upcoming launch of AirTags.

Apple responded to the letter with the following statement:

"We strenuously deny the allegations of uncompetitive behavior that Tile is waging against us. Consistent with the critical path we've been on for over a decade, last year we introduced further privacy protections that safeguard user location data. Tile doesn't like those decisions so instead of arguing the issue on its merits, they've instead decided to launch meritless attacks."

The EU has said it intends to reply to Tile's letter and will launch preliminary investigations following the allegations.

Apple maintained its consummate lead in the global wearable products market in the first quarter of this year, based on research conducted by IDC.

According to the report, Apple's lot grew by 13.3 million units, or 59.9 percent year on year, handing it a 23.7 percent share of the market.

Despite difficulties in the supply chain for Apple Watch, the company saw strong results thanks to its Beats and AirPods range (the report treats "hearables" as a subset of wearables).

IDC put the strong demand for AirPods and Beats down to the ongoing health crisis and the increasing number of people working from home who are in need of headphones.

"Consumers were clamouring for these sophisticated earpieces not only for the abilty to playback audio but also to help them increase productivity, as many of them were forced to work from home and sought ways to reduce surrounding noise while staying connected to their smartphones and smart assistants."

Xaiomi came second in place after Apple, with 10.1 million units shipped in the first quater of this year, amounting to 14 percent market share.

Samsung, Huawei, and Fitbit were the other major companies to make up the rest of the wearables market in the report. Global shipments of wearable devices grew 29.7 percent in Q1 2020 compared to Q1 2019, totalling 72.6 million units.

Production of Apple's rumored over-ear wireless headphones is already said to be underway, and Apple's virtual Worldwide Developers Conference in June could be a good opportunity to introduce them.

Apple is also expected to debut Powerbeats Pro in four new Colors soon, so there would appear to be plenty of reasons for Apple to be confident of maintaining its dominance in the wearables market going forward.

Twitter says it has added the ability to schedule tweets using its web interface, suggesting the same option could eventually make it to the platform's iOS app.

Previously, users who wanted to schedule tweets have had to use third-party apps like Buffer and TweetDeck. Now they can do so in Twitter's native web app, via a calendar icon on the bottom of the compose window.

In addition, users can now also save draft tweets in the web app, although currently they won't be synced to drafts in Twitter's mobile app, and vice versa.

Apple today began selling certified refurbished iPhone XR models in select colors and capacities for the first time in the United States. Refurbished iPhone XR models are priced at a roughly 16 percent discount compared to current pricing on brand-new units, knocking $100–120 off of the regular price.

In addition to the 64GB and 128GB capacities matching current brand-new ‌iPhone‌ XR models, refurbished units are also available with 256GB of storage, although currently only in black. The ‌iPhone‌ XR was initially offered in all three capacities at its launch in 2018, but when the ‌iPhone‌ XR moved down the lineup as a lower-priced option in September 2019, the 256GB models were discontinued.

• 64GB: $499, down from current $599 price and $749 launch price
• 128GB: $539, down from current $649 price and $799 launch price
• 256GB: $629, down from former $749 clearance price and $899 launch price

All current refurbished ‌iPhone‌ XR models come carrier unlocked and without a SIM, so they can be activated with any carrier you choose.

Apple says all refurbished ‌iPhone‌ models are thoroughly inspected, tested, cleaned, and repackaged with a new white box and all manuals and accessories. Apple also installs a new battery and replaces the outer shell, making it nearly impossible to distinguish between a refurbished and brand new ‌iPhone‌.

Any refurbished ‌iPhone‌ model comes with Apple's standard one-year warranty effective on the date the device is delivered, which can be extended with AppleCare+ at a flat rate of $149 or for $7.99 per month on the ‌iPhone‌ XR. Upgraded ‌AppleCare‌+ with theft and loss coverage is available for a flat rate of $249 or for $12.99 per month.

(Thanks, Shan!)

Apple sends out Apple Pay promotional emails on a regular basis, and this week's promotion provides a 30 percent discount on custom sunglasses or eyeglasses from Ray-Ban when using ‌Apple Pay‌ and the promo code APPLEPAY at checkout.

The deal applies only to custom orders on the Ray-Ban.com website, and the promotion is valid until June 3, 2020. The Ray-Ban website features a Custom Lab that allows users to choose from 37 styles, 149 lens types, and 290 color options.

Pricing for sunglasses varies based on the style chosen and add-ons, but prices are over $100. Apple's promotional email also highlights other retailers that accept ‌Apple Pay‌, such as Daily Harvest, Old Navy, Pacsun, and Bath & Body Works.

Apple regularly adds new games to its Apple Arcade gaming service, and this week's addition features characters from the popular SpongeBob cartoon. Described as a platform running game, SpongeBob: Patty Pursuit allows players to take on the role of SpongeBob to defeat Plankton's minions and rescue SpongeBob's friends.

Trouble has come to Bikini Bottom! The evil "mastermind" Sheldon J. Plankton has once again hatched a plan to steal the secret Krabby Patty formula. This time he has enlisted his army of cousins to capture all of SpongeBob's friends! Play as SpongeBob on his epic, most side-scrolly quest through Bikini Bottom ever! Explore, collect coins and spatulas, and crush obstacles as SpongeBob races to rescue his friends, defeat Plankton's minions and take back the formula. Keep an eye out for your favorite Bikini Bottom residents...you never know who you might run into!

Gameplay includes familiar locations like Bikini Bottom, Glove World, and Chum Bucket, along with mechanics like trampolines, zip lines, and transformation machines to morph SpongeBob into a range of silly forms.

SpongeBob universe characters that include Patrick, Sandy, Squidward, and Plankton are present in the game, and there are plenty of enemies to defeat, such as the Jellyfish King.

SpongeBob: Patty Pursuit is available in the App Store for iPhone, iPad, and Apple TV and in the Mac App Store for Macs. Playing the game requires a subscription to ‌Apple Arcade‌, which is priced at $4.99 per month or $49.99 per year.

‌Apple Arcade‌ provides access to more than 100 games on ‌iPhone‌, ‌iPad‌, ‌Apple TV‌, and Mac with no in-app purchases or ads.