MacRumors

Apple this afternoon published an updated version of its iOS Security white paper for iOS 11 [PDF], with information that covers features introduced in iOS 11.1 and iOS 11.2, like Face ID and Apple Pay Cash.

Much of the information in the document on Face ID has been previously shared by Apple in a dedicated Face ID white paper and accompanying support document that was released in September following the iPhone X's announcement, but the Face ID section is worth a re-read for those who are interested in Face ID security.

The document also covers several other topics, such as Shared Notes, CloudKit, Siri Suggestions, and more, with a full list of updates below:

Updated for iOS 11.2
- Apple Pay Cash

Updated for iOS 11.1
- Security Certifications and Programs
- Touch ID/Face ID
- Shared Notes
- CloudKit end-to-end encryption
- TLS
- Apple Pay, Paying with Apple Pay on the web
- Siri Suggestions
- Shared iPad

The document explains in detail how Apple features work and how they're protected. With Apple Pay Cash, for example, Apple says transaction data is stored for troubleshooting and fraud protection, while all money transfers are done securely using the Secure Element as with other Apple Pay transactions.

There are many small but significant details in the paper about all of the topics listed above, and for anyone who is interested in the security of their iPhones and iPads, it's worth checking out in detail.

Prior to today's update, the last update to the iOS security document was in July of 2017 following the release of iOS 10.3.

Intel CEO Brian Krzanich today wrote an open letter to Intel customers following the "Meltdown" and "Spectre" hardware-based vulnerabilities that impact its processors.

In the letter, Krzanich says that by January 15, updates will have been issued for at least 90 percent of Intel CPUs introduced in the past five years, with updates for the remainder coming at the end of January.

For Apple customers, macOS and iOS devices have been patched with protection against Spectre and Meltdown. Meltdown was addressed in macOS High Sierra 10.13.2 and iOS 11.2, while Spectre mitigations were introduced in a macOS 10.13.2 supplemental update and iOS 11.2.2, both of which were released this week. The vulnerabilities have also been addressed in older versions of macOS and OS X.

According to Krzanich, going forward, Intel promises to offer timely and transparent communications, with details on patch progress and performance data. Because Spectre and Meltdown are hardware-based vulnerabilities, they must be addressed through software workarounds. In some cases, these software patches cause machines to perform more slowly.

Apple users do not need to worry about performance impacts. According to Apple, Meltdown had no measurable reduction in performance on devices running macOS and iOS across several benchmarks. Spectre, fixed through a Safari mitigation, had no measurable impact on most tests, but did impact performance by less than 2.5% on the JetStream benchmark. Apple says it plans to continue to refine its mitigations going further.

In addition to remaining transparent about the performance impact of the software fixes, Krzanich says Intel will commit to disclosing security vulnerabilities and sharing hardware innovations that will, in the future, prevent such attacks.

Our customers' security is an ongoing priority, not a one-time event. To accelerate the security of the entire industry, we commit to publicly identify significant security vulnerabilities following rules of responsible disclosure and, further, we commit to working with the industry to share hardware innovations that will accelerate industry-level progress in dealing with side-channel attacks. We also commit to adding incremental funding for academic and independent research into potential security threats.

For those who missed the news last week, Spectre and Meltdown are serious hardware-based vulnerabilities that take advantage of the speculative execution mechanism of a CPU, potentially allowing hackers to gain access to sensitive information.

Spectre and Meltdown impact all modern processors, including those used in Mac and iOS devices, and these two vulnerabilities will continue to be an issue for the foreseeable future as addressing them entirely requires new hardware design. Apple has prevented Spectre and Meltdown from affecting customers through software updates, but all hardware and software manufacturers will need to be wary of additional speculative execution attacks going forward.

Apple customers should make sure to keep their Macs and iOS devices up to date with the latest software to remain protected from malicious attacks that might take advantage of the exploits.

This year's Consumer Electronics Show felt a little more muted than past shows, with fewer new and exciting products coming out. Much of that may be due to the fact that there was a lot of focus on Alexa and Google Assistant, two platforms that aren't applicable to a lot of Apple users.

Though CES 2018 may not have been quite as interesting as past events, there were still quite a few Apple-related products shown off that we're looking forward to seeing in 2018. Below, we've rounded up some of the most interesting accessories and devices relevant to those who own iPhones, iPads, Macs, and other Apple devices.

Philips Hue Outdoor Bulbs and Hue Entertainment

Philips is planning to expand its line of popular HomeKit-compatible Hue light bulbs with new outdoor bulbs that can be used on porches, yards, balconies, and other outdoor areas. Pricing hasn't yet been announced, but these will be a welcome addition to the Hue lineup.

Philips is also introducing a new "Hue Entertainment" feature that will allow Hue lights to react to games, movies, music, and more through a series of partnerships with other companies. One of the first partnerships is with Razer.

Later this year, Philips will update its iOS app with a revamped design and it will introduce a new "Hue Sync" Mac app for creating and customizing light scripts for games, movies, and music.

Nanoleaf Remote and Square Panels

Nanoleaf, another company that does HomeKit-enabled lighting, announced a new $49 Nanoleaf Remote for controlling its Nanoleaf Light Panels and other HomeKit-compatible products. Some MacRumors readers aren't a fan of the design, but it is undeniably unique with its dodecahedron shape, and it also offers more preset options than other remotes. You can activate 12 HomeKit scenes with the Nanoleaf Remote by flipping it around, and it can also be used for dimming.

Nanoleaf is also going to be introducing new square light panels in the future, though a pricing and release date aren't available. The square panels are a major update to the existing triangle panels. They're touch sensitive so you can turn them on and off or activate another color preset with just a tap or a swipe, and there will also be built-in motion sensing to tweak the lights when you walk by.

HomeKit-Enabled Kohler Faucet and Moen Shower System

Kohler and Moen took HomeKit to an interesting new place at CES with the announcement of HomeKit-enabled faucets and shower systems.

Kohler's Sensate faucet will let you use Siri voice commands to turn the water on or off or dispense set amounts of liquid, while the DTV+ shower system will let homeowners create and automate personalized shower experiences with different presets for sound, water, steam, and lighting, which can be activated by voice.

Moen's "U by Moen" shower system will let you use voice commands to start your shower and activated pre-set temperature choices.

Voice-enabled shower systems aren't cheap, with Moen charging $1,160 for the "U." Pricing for the Kohler system hasn't been announced, but the current non-HomeKit-enabled Sensate faucet is priced at $523 while the DTV+ shower system is priced at $794.

Belkin HomeKit for Wemo and Wireless Charging Docks

At CES, Belkin finally debuted HomeKit integration for its Wemo devices, allowing smart plugs, light switches, and dimmers to be used with HomeKit. HomeKit integration is limited right now, but the good news is that future Belkin Wemo products will likely support it.

Adding HomeKit to your Wemo setup will require the new Wemo Bridge, priced at $40.

Belkin's other major announcement was a whole slew of new wireless chargers for the iPhone X, iPhone 8, and iPhone 8 Plus. There are chargers in bright colors, upright chargers, and chargers that go in the car.

Osmo Mobile 2

If you capture video on your iPhone, the Osmo Mobile 2 from DJI is worth checking out. It's way cheaper than the original version at around $160, has simpler controls, and longer battery life.

It works by using a three-axis gimbal to cancel out movement in three directions for stable footage even when you have shaky hands.

HyperDrive 8-in-1 USB-C Hub

Hyper's new 8-in-1 USB-C Hub may be a Kickstarter project, but Hyper has a proven track record for delivering solid products. The HyperDrive USB-C Hub is designed for USB-C MacBook models with a 4K HDMI port, a Gigabit Ethernet port, a microSD slot, an SD card slot, three USB-A 3.1 ports and one USB-C power delivery port.

It also includes a built-in 7.5W wireless charger and convertible stand for wirelessly charging the iPhone X, iPhone 8, and iPhone 8 Plus.

Hyper's Kickstarter campaign for the USB-C Hub will start on January 15.

Incase IconConnected PowerSleeve for MacBook Pro

Incase's new IconConnected Power Sleeve combines protection with power for Apple's 2016 and 2017 MacBook Pro models. It takes a standard Incase Icon sleeve and then adds a 14,000 mAh battery with a USB-C port that can be used for charging purposes.

There's also a USB-A port built into the Power Sleeve so you can charge your other devices, too. Incase plans to offer 13 and 15-inch versions of the Power Sleeve, which will be available for $199.95 when it launches in the third quarter of 2018.

We highlighted tons of other Apple-related products at the Consumer Electronics Show this year, so make sure to check out our CES hub to see all of our CES 2018 coverage. What was your favorite product at the show? Let us know in the comments.

Back in 2008, Angela Guzman was a graphic design student at the Rhode Island School of Design (RISD) and an intern at Apple, where she joined the iPhone team and worked alongside another Apple designer, Raymond, to come up with the first 500 emoji characters that were available on the iPhone.

To celebrate the 10th anniversary of her internship, Guzman has taken a look back at her time at Apple and her work on emoji in an interesting retrospective shared on Medium.

Regardless of how fast I could crank one out, I constantly checked the details: the direction of the woodgrain, how freckles appeared on apples and eggplants, how leaf veins ran on a hibiscus, how leather was stitched on a football, the details were neverending. I tried really hard to capture all this in every pixel, zooming in and zooming out, because every detail mattered.

Some emoji, says Guzman, have interesting back stories. The happy poop swirl, for example, was reused as the top of the ice cream cone. Harder, more detailed emoji were left last, such as the now-iconic dancer with the red dress.

Guzman's emoji were first launched in Japan in November of 2008, and in the time since then, emoji have changed the way we communicate. Emoji have become an important part of the iOS and macOS ecosystem, and Apple has continued refining and improving its emoji offerings with each Unicode update.

As with the first Apple emoji designed by Guzman and her partner Raymond, emoji today feature incredible detail thanks to the talented artists at Apple who take the time to make sure each and every pixel is perfect.

iOS 11.1 was the last iOS update that introduced new emoji, bringing Unicode 10 characters like crazy face, pie, pretzel, t-rex, vampire, exploding head, face vomiting, shushing face, love you gesture, brain, scarf, zebra, giraffe, fortune cookie, pie, hedgehog, and more.

The next emoji update will come with the release of Unicode 11 in 2018, and emoji proposals for that update include smiling face with three hearts, blue face with icicles, smiling face with cape, mango, cupcake, kangaroo, llama, peacock, and red hair options for existing emoji.

Apple today seeded the fifth beta of an upcoming iOS 11.2.5 update to developers and public beta testers, a few days after seeding the fourth beta and releasing iOS 11.2.2, an update designed to mitigate a serious hardware-based vulnerability called "Spectre."

Registered developers can download the iOS 11.2.5 beta from Apple's Developer Center or over-the-air once the proper configuration profile has been installed from the Developer Center. Public beta testers can get the beta over-the-air.

iOS 11.2.5 introduces a new feature that allows Siri to play daily news podcasts when queried about the current news. Siri will offer up news from The Washington Post by default, but you can also choose to switch to Fox News, CNN, or NPR.

The new audio news feature, which appears to have been developed for use with Apple's upcoming HomePod speaker, is invoked when using Hey Siri or asking Siri about the news when using CarPlay or with headphones connected - essentially any situation where you're not looking at the display of an iOS device. If you activate Siri using the side button or Home button of a device, standard Apple news headlines are provided instead of the audio-based news highlights.

It's not clear what other new features, if any, will be included in the iOS 11.2.5 beta. We didn't discover other noticeable outward-facing changes in the first four iOS 11.2.5 betas, so it's possible this update focuses mainly on bug fixes and security improvements aside from the Siri news update.

If that's the case, we may not know the extent of what's in the update until it sees a public release.

Apple is supposed to be releasing an iCloud Messages feature that was pulled from the iOS 11 release, but there has been no indication of when we can expect iCloud Messages to be reintroduced. Should new features be discovered in the fifth beta of iOS 11.2.5, we'll update this post.

Senior FBI forensic examiner Stephen R. Flatley spoke at the International Conference on Cyber Security yesterday, and during the talk he discussed Apple and the FBI's differing opinions on the topic of smartphone encryption. According to Motherboard, Flatley described the company as "jerks" and "evil geniuses" for creating iOS device encryption that is so powerful as to prevent Apple itself from entering users' iPhones.

Flatley said that recent updates to Apple device encryption have made password guesses slower, by increasing hash iterations from 10 thousand to 10 million, "making his and his colleagues' investigative work harder." This extended brute force crack time from a few days to two months, leading to Flatley stating that Apple is "pretty good at evil genius stuff." No detailed context was given regarding his "jerks" comment.

That means, he explained, that “password attempts speed went from 45 passwords a second to one every 18 seconds,” referring to the difficulty of cracking a password using a “brute force” method in which every possible permutation is tried. There are tools that can input thousands of passwords in a very short period of time—if the attempts per minute are limited, it becomes much harder and slower to crack.

"Your crack time just went from two days to two months," Flatley said. “At what point is it just trying to one up things and at what point is it to thwart law enforcement?" he added. "Apple is pretty good at evil genius stuff."

Flatley's comments come nearly two years after the Apple-FBI dispute began, when a federal judge ordered Apple to help the FBI enter the iPhone owned by Syed Farook, one of the shooters in the December 2015 attacks in San Bernardino. The FBI said it wanted Apple's help to enter just Farook's iPhone 5c, but Apple explained that the software it was asked to create could become a "master key" and be able to get information from any iPhone or iPad.

For this reason, Apple denied the request and CEO Tim Cook penned an open letter describing the potential for setting a "dangerous precedent" if the company did go along with the order. The battle eventually ended a few months later after the government discovered an alternative way of entering Farook's iPhone 5c, reportedly with the help of Israeli firm Cellebrite.

Flately mentioned Cellebrite as well during the security conference, describing the firm as "another evil genius" that counters Apple's encryption and can help the FBI when it needs to enter a smartphone. The forensic examiner was described as not clearly stating Cellebrite's name, but "facetiously coughing" at the same time to somewhat obscure the comment.

Although the Apple-FBI dispute has ended, debates over smartphone encryption have remained ongoing the past few years. In October 2017, a report came out stating that the FBI was unable to retrieve data from 6,900 mobile devices it had attempted to gain access to over the previous 11 months. That number accounted for half of the total devices the FBI tried to get into, and FBI Director Christopher Wray described the FBI's inability to retrieve information from these devices as a "huge, huge problem."

At the end of the case in 2016, Apple issued a statement explaining that the company will continue to assist the FBI when it can, but not at the expense of the data protection, security, and privacy of its customers: "Apple believes deeply that people in the United States and around the world deserve data protection, security, and privacy. Sacrificing one for the other only puts people and countries at greater risk."

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

iPhone 6 Plus users hoping to take advantage of Apple's discounted $29 battery replacements may have to wait a few months.

Apple says iPhone 6 Plus replacement batteries are in short supply and won't be available until late March to early April in the United States and other regions, according to an internal document distributed to Apple Stores and Apple Authorized Service Providers this week and later obtained by MacRumors.

Apple's internal document quotes a shorter wait of "approximately two weeks" for iPhone 6 and iPhone 6s Plus battery replacements, and adds that batteries for all other models like the iPhone 6s, iPhone 7, iPhone 7 Plus, and iPhone SE are expected to be available "without extended delays" in most countries.

Apple noted that lead times may vary in some regions, including the Middle East, Africa, Latin America, Russia, and Turkey.

MacRumors has already received a few emails from readers with an iPhone 6 Plus who were quoted a late March to early April timeframe for the replacement service to be completed at Apple Stores in New York and North Carolina, in line with the information outlined in Apple's document.

A reliable source at an Apple Authorized Service Provider indicated that they recently received a package with dozens of replacement batteries, the majority of which were for iPhone 7 and iPhone 7 Plus models.

Apple lowered its battery replacement fee to $29 last month for any customer with an iPhone 6 or newer as part of an apology over its lack of transparency about slowing down some older iPhone models to prevent unexpected shutdowns. Apple noted that initial supplies of some batteries may be limited.

As with any supply-demand situation, availability of replacement batteries will likely vary by location. Keep in mind that many Apple Authorized Service Providers like MacMedics and ComputerCare are able to replace iPhone batteries, so this may be an option worth considering beyond an Apple Store.

A source adds that Apple Authorized Service Providers are permitted to set their own prices for out-of-warranty parts and repairs, so some third-party repair shops are charging more than $29 for battery replacements, even if Apple might not prefer it, to ensure they are being fairly compensated.

Also keep in mind that Apple's discounted rate is available until December 31, 2018, so unless you absolutely need a battery replacement now, you may wish to consider waiting until later in the year to initiate the process.

If you are replacing your iPhone's battery for the first time, the $29 price is available regardless of whether the device passes or fails Apple's battery diagnostic test. To be eligible for any additional replacements at the discounted rate, however, the device must explicitly fail the test or the standard $79 applies.

To get started, read our guide on how to get your iPhone's battery replaced with an appointment at an Apple Store or Apple Authorized Service Provider. There's also a mail-in option, but we've heard that Apple's repair center may only be replacing batteries that fail a diagnostic test, and sending back devices that pass.

Apple's Tim Cook on Wednesday joined over 100 other CEOs in urging the U.S. Congress to pass a bill to protect young immigrants before the Deferred Action for Childhood Arrivals (DACA) program expires. For those unfamiliar with the program, DACA gives about 800,000 illegal immigrants who entered the U.S. at age 16 or younger work permits and protection from deportation by two-year deferral. Many of those protected by DACA have been in the United States for most of their lives.

In an open letter to House and Senate leaders, the group called on lawmakers to introduce legislation supporting so-called Dreamers by Friday, which is the deadline for Congress to pass a bill for government funding to avert a shutdown. The DACA program actually expires on March 5, but the CEO signatories say the government needs time to implement a new program before that deadline.

"We write to urge Congress to act immediately and pass a permanent bipartisan legislative solution to enable Dreamers who are currently living, working, and contributing to our communities to continue doing so," the letter reads. "The imminent termination of the DACA program is creating an impending crisis for workforces across the country."

Facebook's Mark Zuckerberg, Microsoft president Brad Smith, Amazon’s Jeff Bezos, and Verizon CEO Lowell McAdam were additional signatories of the letter, which cited a CATO Institute study that found ending the DACA program could cause a $215 billion decline in the gross domestic product.

"In addition to causing a tremendous upheaval in the lives of DACA employees, failure to act in time will lead to businesses losing valuable talent, cause disruptions in the workforce, and will result in significant costs," the group wrote. "While delay or inaction will cause significant negative impact to businesses, hundreds of thousands of deserving young people across the country are counting on you to work in a bipartisan way to pass permanent legislative protection for Dreamers without further delay."

Tim Cook has been consistent in his support for a legislative solution to protect those affected by the end of the DACA program. Following U.S. President Donald Trump's September announcement that DACA would be phased out over six months, Cook sent an email to employees saying Apple would try to help Congress find a solution and would be working with impacted Apple employees to provide support, including access to immigration experts. Apple employs 250 "Dreamers", Cook previously revealed in a tweet.

In December, Cook teamed up with Koch Industries CEO Charles Koch to write an opinion piece in The Washington Post about DACA, asking Congress to work quickly to come up with a solution before the end of the year. That never happened, and the government's stance on the issue now appears to be mired in confusion.

On Tuesday, a federal judge in California issued a nationwide injunction ordering the Trump administration to maintain the DACA program on a nationwide basis while legal challenges to the president's decision go forward.

In another development this week, concerns grew among hardliners after Trump met with lawmakers during a freewheeling televised session, in which he signaled he was open to compromise and seemed to express support for a number of legislative options to legalize Dreamers.

Indeed, the president appeared to suggest that the details of a legislative solution didn't matter to him, telling congressional leaders that he would approve whatever they sent him. "I will be signing it," Trump said towards the end of the meeting. "I'm not going to say, 'Oh, gee, I want this or I want that.' I'll be signing it."

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Apple's announcement on Wednesday that its iCloud services in mainland China will be handed over to a Chinese company has already run into controversy, after it emerged that accounts registered overseas are being swept up in the migration.

Apple said yesterday that customers based in China had been contacted and advised to examine new terms and conditions, which include a clause that both Apple and the Chinese firm will have access to all data stored on iCloud servers, which will be transferred from February 28. Customers living in mainland China who did not want to use iCloud operated by GCBD had been given the option to terminate their account.

However, according to some users who spoke to TechCrunch, in the data to be handled by local partner Guizhou-Cloud Big Data (GCBD), Apple is including iCloud accounts that were opened in the U.S., are paid for using U.S. dollars, and/or are connected to U.S.-based App Store accounts.

The operation of iCloud services associated with Apple IDs that have China in their country or region setting will be subject to this transition. You will be notified of this transition via email and notifications on your devices. You don’t need to take any further action and can keep using iCloud in China.

After February 28, 2018, you will need to agree to the terms and conditions of iCloud operated by GCBD to keep using iCloud in China.

As it stands, this could result in thousands of users temporarily living in China to study or work having their data migrated to servers under the control of GCBD, which is owned by the Guizhou provincial government in southern China.

The situation is said to have left many users feeling trapped into the migration, but one user has discovered an apparent opt-out. This involves switching an iCloud account back to China before signing out of all devices. The user then switches their iPhone and iCloud settings to the U.S., and after signing back into iCloud, their account should no longer be part of the migration.

"What will Apple do when the Chinese authorities request a backdoor to access data that is encrypted?" Charlie Smith, founder of censorship monitoring site Great Fire, told TechCrunch. "Will they continue to adhere to local laws and regulations and submit to the request? Or are they leaving this decision squarely in the hands of GCBD, their local partner?"

Updated: Apple says a very small number of customers whose Apple ID country is not China received this notice by mistake, as noted by TechCrunch. Apple says no changes have been made to these users' iCloud accounts.

You recently received an email from us notifying you about an upcoming change for iCloud services in China. This email was sent in error. No changes have been made to your iCloud account.

We are very sorry that you received this email. This email was intended only for customers whose Apple ID country is China. A very small number of our customers who Apple ID country is not China also received this email by mistake.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.