MacRumors

Shortly after the iPhone X was unveiled, United States Senator Al Franken, who is a member of the Senate Judiciary Committee on Privacy, Technology, and the Law, sent a letter to Apple CEO Tim Cook to ask several questions about the security and the privacy of Face ID.

Franken asked Apple to address his questions by October 13, 2017, which Apple did through a letter sent by Cynthia Hogan, the company's Vice President for Public Policy in the Americas.

In the letter, Hogan highlights its recent Face ID security paper and Face ID support document, which outline how Apple protects customer privacy and keeps customer data secure.

She also addresses several of Franken's questions, reiterating much of the information that's in the two documents and that's been previously published about Face ID. One of Franken's questions, for example, concerned how Face ID was trained, with Apple's response below:

The accessibility of the product to people of diverse races and ethnicities was very important to us. Face ID uses facial matching neural networks that we developed using over a billion images, including IR and depth images collected in studies conducted with the participants' informed consent.

We worked with participants from around the world to include a representative group of people accounting for gender, age, ethnicity, and other factors. We augmented studies as needed to provide a high degree of accuracy for a diverse range of users. In addition, a neural network that is trained to spot and resist spoofing defends against attempts to unlock your phone with photos or masks.

Hogan ends the letter with an offer to provide Senator Franken with briefings on Apple products should additional information be required.

Following his receipt of the letter, Franken today issued a statement where he said he appreciates Apple's willingness to provide information on Face ID.

All the time, we learn about and actually experience new technologies and innovations that just a few years back were difficult to even imagine. While these developments are often great for families, businesses, and our economy, they also raise important questions about how we protect what I believe are among the most pressing issues facing consumers: privacy and security.

I appreciate Apple's willingness to engage with my office on these issues, and I'm glad to see the steps that the company has taken to address consumer privacy and security concerns.

I plan to follow up with Apple to find out more about how it plans to protect the data of customers who decide to use the latest generation of iPhone's facial recognition technology.

In addition to offering up a Face ID white paper and detailed support document, Apple has also provided information on Face ID through a series of interviews software engineering chief Craig Federighi did with various media sites.

Face ID will be available to consumers starting on November 3, the official launch date for the iPhone X. Apple plans to begin accepting pre-orders for the iPhone X on October 27.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Apple considered purchasing medical clinic startup Crossover Health as part of its push into healthcare, reports CNBC. Apple is said to have participated talks with the healthcare company up until recently, but after months of discussion, no deal materialized.

According to its website, Crossover Health works with major companies to provide employees with on-site medical clinics. Some of its existing customers include Facebook, Microsoft, LinkedIn, Square, and Apple, with many of these companies offering on-campus medical care.

Citing three sources with knowledge of the talks, CNBC says it's not clear why no acquisition ultimately happened between the two companies. Apple also talked to One Medical, another startup that offers patient clinics in several different cities.

Whether Apple would use such a startup to develop public-facing actual medical clinics or use existing facilities to sell products and gather data is not known.

The discussions about expanding into primary care have been happening inside Apple's health team for more than a year, one of the people said. It is not yet clear whether Apple would build out its own network of primary care clinics, in a similar manner to its highly successful retail stores, or simply partner with existing players.

Apple has made serious inroads into medical care with the introduction of CareKit and ResearchKit. CareKit is aimed at helping app developers create health-related apps to allow consumers better access to healthcare data, while ResearchKit is aimed at helping medical professionals develop studies to further medical research using data gathered from Apple customers.

Apple is said to be aiming to make the iPhone a "one-stop shop" for medical info, offering a centralized way to store all of a person's health data.

In the past, Apple CEO Tim Cook has said that health is an area that interests Apple because it's where hardware, software, and services can come together into "something that's magical." "We believe that health is something that is a huge problem in the world," said Cook in 2016. "We think it is ripe for simplicity and sort of a new view, and we'd like to contribute to that."

Today marks the third anniversary of the last update of the Mac mini, Apple's most affordable and compact desktop computer. The Mac mini was refreshed on October 16, 2014, and since then, the machine has seen no additional updates.

The Mac mini is positioned as a "bring your own" machine that comes without a mouse, keyboard, or display, and the current version is still running Haswell processors and integrated Intel HD 5000/Intel Iris Graphics.

Pricing on the Mac mini starts at $499 for the entry-level base configuration, making it far more affordable than the iMac, which starts at $1,099 for a non-4K 21-inch version.

With the 2014 refresh, fans were disappointed as Apple ceased offering a quad-core processor option and support for dual hard drives, features that have not returned.

At this point, it's not clear if and when Apple will introduce a new version of the Mac mini. Prior to the 2014 refresh, the Mac mini was updated in 2006, 2007, 2009, 2010, 2011, and 2012, so it's never before gone three years sans update.

Many Apple customers are eagerly awaiting a new Mac mini, including businesses that rely on the machine, like Brian Stucki's MacStadium.

When Apple announced plans for a modular Mac Pro, Apple marketing chief Phil Schiller said the Mac mini "is an important product" in the company's lineup, suggesting Apple doesn't have plans to abandon the machine. He declined to offer up any information on a potential refresh, though.

Aside from a single rumor from Pike's Universum hinting at a new high-end Mac mini with a redesign that "won't be so mini anymore," we've heard no details at all about work on a possible Mac mini refresh.

If a new Mac mini is in the works, though, it could use either Seventh-Generation Kaby Lake chips or Eighth-Generation Kaby Lake Refresh chips, both of which are available now.

The Mac mini typically uses the same 15W U-series chips that are found in the 13-inch MacBook Pro. With Intel's Eighth-Generation chips, the U-series all feature four cores, so should a future Mac mini adopt Kaby Lake Refresh chips or later, quad-core performance will return.

Given that it's October and there are no rumors, it's not likely we're going to see a Mac mini refresh in 2017, but sometime in 2018 is fair game.

Apple has already patched serious vulnerabilities in the WPA2 Wi-Fi standard that protects many modern Wi-Fi networks, the company told iMore's Rene Ritchie this morning.

The exploits have been addressed in the iOS, tvOS, watchOS, and macOS betas that are currently available to developers and will be rolling out to consumers soon.

Using a key reinstallation attack, or "KRACK," attackers can exploit weaknesses in the WPA2 protocol to decrypt network traffic to sniff out credit card numbers, usernames, passwords, photos, and other sensitive information. With certain network configurations, attackers can also inject data into the network, remotely installing malware and other malicious software.

Because these vulnerabilities affect all devices that use WPA2, this is a serious problem that device manufacturers need to address immediately. Apple is often quick to fix major security exploits, so it is not a surprise that the company has already addressed this particular issue.

Websites that use HTTPS offer an extra layer of security, but an improperly configured site can be exploited to drop HTTPS encryption, so Vanhoef warns that this is not a reliable protection.

Apple's iOS devices (and Windows machines) are not as vulnerable as Macs or devices running Linux or Android because the vulnerability relies on a flaw that allows what's supposed to be a single-use encryption key to be resent and reused more than once, something the iOS operating system does not allow, but there's still a partial vulnerability.

Once patched, devices running iOS, macOS, tvOS, and watchOS will not be able to be exploited using the KRACK method even when connected to a router or access point that is still vulnerable. Still, consumers should watch for firmware updates for all of their devices, including routers.

Ahead of the release of the update that addresses the vulnerabilities, customers who are concerned about attacks should avoid public Wi-Fi networks, use Ethernet where possible, and use a VPN.

While the iMac Pro doesn't launch for another six weeks or so, possible benchmarks for the computer may have already surfaced on Geekbench. The results provide us with an early look at just how powerful Apple's $4,999-and-up desktop workstation will be when it is released in December.

Interestingly, the iMac Pro models benchmarked appear to have custom, downclocked Xeon chips that Intel hasn't publicly announced yet. There is a benchmark result for a model with a 3.2GHz 8-core Xeon W-2140B processor, while a third listing exists for a model with a 3.0GHz 10-core Xeon W-2150B chip.

All of the models are identified as "AAPJ1371,1," and unlike other Xeon chips, the processors have a "B" suffix. A few of the benchmark results are from late August, while the rest are from October.

MacRumors spoke with Geekbench founder John Poole, who speculated that the iMac Pro may require chips with lower thermal design power, and thus lower frequencies, due to its all-in-one form factor. He noted that the other chips in the Xeon Processor W family have relatively high TDPs of up to 140W.

The multi-core Geekbench score for the 8-core model averages out to 23,536, which is the highest performance of any iMac ever. It's nearly 22 percent faster than the latest 5K iMac equipped with a maxed-out 4.2GHz quad-core Core i7 processor, which has an average multi-core score of 19,336.

The higher-end 10-core iMac Pro has a multi-core score of 35,917, which is roughly 41 percent faster than the latest Mac Pro maxed out with a 2.7GHz 12-core Xeon E5 processor. Even its single-core score of 5,345 is faster than all but the highest-end 5K iMac released earlier this year.

All in all, the benchmarks point to the iMac Pro being unsurprisingly powerful from top to bottom. And that's not even looking at the 18-core iMac Pro, which hasn't been benchmarked yet and will surely blow every other Mac out of the water—at least until the modular Mac Pro is ready.

Apple said the iMac Pro will also feature top-of-the-line Radeon Pro Vega graphics, up to 4TB of SSD storage, and up to 128GB of ECC RAM. The computer will share the same design as the standard iMac, but with an all-flash architecture, a new thermal design, and four Thunderbolt 3 ports.

Apple today seeded the third beta of an upcoming iOS 11.1 update to developers, one week after releasing the second iOS 11.1 beta and a month after releasing the iOS 11 update to the public.

Registered developers can download the iOS 11 beta from Apple's Developer Center or over-the-air once the proper configuration profile has been installed from the Developer Center.

iOS 11.1 introduces a range of new Unicode 10 emoji like crazy face, pie, pretzel, t-rex, vampire, exploding head, face vomiting, shushing face, love you gesture, brain, scarf, zebra, giraffe, fortune cookie, pie, hedgehog, and more.

Several emoji have also seen some small design changes in iOS 11.1, including the dolphin, octopus, bee, snail, and whale characters, among others. The new designs are more detailed and realistic than existing designs.

The update also brings back the 3D Touch App Switcher gesture that has been missing from iOS 11 since its release. With the return of the gesture, iPhone users can once again 3D Touch at the left edge of the display to bring up the multitasking App Switcher interface.

A few other small features are included in the iOS 11.1 beta. The built-in keyboard in iOS 11.1 now offers up multiple emoji symbols when using an emoji-related word like "cake" or "happy," with each of the suggestions displayed at the end of the predictive text suggestions.

There's also an updated camera icon under Restrictions, a new animation when tapping the status bar to scroll upwards, and a faster unlock animation.

iOS 11 marks a major update to the operating system with systemwide design tweaks, a new Lock screen experience, a revamped Control Center, ARKit, new app features, and an entirely new interface for the iPad that includes a Dock, Drag and Drop support, and a redesigned App Switcher for better than ever multitasking.

Update: Today's beta fixes a Reachability bug that prevented the iOS 11 Cover Screen with Notifications from being accessible in the middle of the iPhone's display. Apple engineering chief Craig Federighi recently said a fix for the issue, which has been present since iOS 11 launched, would be coming soon.

Update 2: The new beta is now available for public beta testers.

VirnetX today announced that the United States District Court for the Eastern District of Texas has denied all of Apple's motions in a longstanding FaceTime-related patent lawsuit between the two companies.

The court also granted all of VirnetX's motions in the retrial and increased the royalty rates that Apple owes during the infringement period, resulting in a revised final judgment amount of $439.7 million.

"We are elated with the Court's Final Judgement of $439 million in that not only did it affirm the jury's verdict of $1.20 per infringing iPhone, iPad and Mac Product, but also added for willful infringement, interest and attorney fees. This is the third time a jury has ruled in our favor against Apple," said Kendall Larsen, VirnetX CEO.

VirnetX originally sued Apple in 2010 over allegations that FaceTime's peer-to-peer connection technology infringed upon its patents. VirnetX won its case in 2012, and Apple was hit with a $368.2 million judgment, but the appeals and retrial process has dragged on for over seven years until now.

Of note, the United States District Court for the Eastern District of Texas is a hotbed for patent infringement lawsuits given several favorable outcomes for patent holding entities like VirnetX. Some would even call the company a patent troll, although it does appear to offer at least one product of some kind.

A spokesperson for Apple confirmed that it plans to appeal this final judgment, according to TechCrunch. It noted that the motions can still be appealed even if the original case was already appealed and lost.

Just over a decade after the iPhone launched, and six years after Steve Jobs passed, some critics believe that Apple's pace of innovation has slowed. Unsurprisingly, Apple's services chief Eddy Cue doesn't share that opinion.

"I disagree vehemently with that and I think we've been incredibly innovative," said Cue, in a recent interview with Indian publication Livemint.

Cue pointed out that both the iPad and Apple Watch launched after the iPhone, while noting that revolutionary products take time. He also believes that Apple's work on Mac, macOS, and iOS has led the market.

Apple historically has a track record of coming out with industry-defining products, whether it's the Mac or iPhone or iPod. But over the past decade, there's a been perception that the pace of innovation and the pace at which Apple has come out with game-changing, breakthrough products has slowed somewhat. What do you have to say about that?

No way! First of all, the iPhone is 10 years old. That is the last decade. The iPad came after that and the Watch came after that. So, I disagree vehemently with that and I think we’ve been incredibly innovative. That doesn’t even take into account the work that has been done on the Mac, iOS and MacOS, from that standpoint where I think we’ve led the market. When you think of the products that we’ve built over time, you own a lot of them. And you just assume that every year was a new product. But it wasn’t. You can’t do revolutionary new products, every two months or six months or whatever. They take time.

The rest of the interview was primarily focused on Apple's roadmap for India, which Cue described as a "very long-term opportunity."

Cue said Apple is focused on three areas in India, including the App Store, Apple Maps, and a bundle of other services such as iCloud and Apple Music. Of note, he said Apple is "working on" bringing Apple Pay to India.

The digital payments business is widely being seen as the biggest battleground in India now and in the near future. What are Apple's plans on that front?

Our head of Apple Pay, Jennifer Bailey, is here with me. And Apple Pay is something that we definitely want in India. The challenge with payment mechanisms is that there isn't really a lot of global scale. You deal with individual markets at a time … but India is one of those markets where we hope to bring Apple Pay to.

Cue said Apple doesn't have an exact launch date to announce for Apple Pay in India at this point since it's not "a 100 percent" yet.

In the full-length interview, Cue also reflects upon the leadership styles of past and present Apple CEOs Tim Cook and Steve Jobs, and on Apple's increasing efforts to produce original content.

Mathy Vanhoef, a postdoctoral researcher at Belgian university KU Leuven, has discovered and disclosed major vulnerabilities in the WPA2 protocol that secures all modern protected Wi-Fi networks.

Vanhoef said an attacker within range of a victim can exploit these weaknesses using so-called KRACKs, or key reinstallation attacks, which can result in any data or information that the victim transmits being decrypted. Attackers can eavesdrop on network traffic on both private and public networks.

As explained by Ars Technica, the primary attack exploits a four-way handshake that is used to establish a key for encrypting traffic. During the third step, the key can be resent multiple times. When it's resent in certain ways, a cryptographic nonce can be reused in a way that completely undermines the encryption.

As a result, attackers can potentially intercept sensitive information, such as credit card numbers, passwords, emails, and photos. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

Note that the attacks do not recover the password of any Wi-Fi network, according to Vanhoef. They also do not recover any parts of the fresh encryption key that is negotiated during the four-way handshake.

Websites properly configured with HTTPS have an additional layer of protection, but an improperly configured site can be exploited to drop this encryption, so Vanhoef warned that it is not reliable protection.

Since the vulnerabilities exist in the Wi-Fi standard itself, nearly any router and device that supports Wi-Fi is likely affected, including Macs and iOS devices. Android and Linux devices are particularly vulnerable since they can be tricked into installing an all-zero encryption key instead of reinstalling the real key.

This vulnerability appears to be caused by a remark in the Wi-Fi standard that suggests to clear the encryption key from memory once it has been installed for the first time. When the client now receives a retransmitted message 3 of the 4-way handshake, it will reinstall the now-cleared encryption key, effectively installing an all-zero key.

As a proof-of-concept, Vanhoef executed a key reinstallation attack against an Android smartphone. In the video demonstration below, the attacker is able to decrypt all data that the victim transmits.

Fortunately, the vulnerabilities can be patched, and in a backwards-compatible manner. In other words, a patched client like a smartphone can still communicate with an un-patched access point like a router.

Vanhoef said he began disclosing the vulnerabilities to vendors in July. US-CERT, short for the United States Computer Emergency Readiness Team, sent out a broad notification to vendors in late August. It is now up to device and router manufacturers to release any necessary security or firmware updates.

Despite the vulnerabilities, Vanhoef says the public should still use WPA2 while waiting for patches. In the meantime, steps users can take to mitigate their threat level in the meantime include using a VPN, using a wired Ethernet connection where possible, and avoiding public Wi-Fi networks.

Vanhoef is presenting his research behind the attack at both the Black Hat Europe and Computer and Communications Security conferences in early November. His detailed research paper (PDF) is available today.