Joe Rossignol (PDF):

The complaint alleges that Apple violated California’s Consumers Legal Remedies Act and other laws by failing to adequately review and monitor apps distributed through the App Store, despite marketing it as “a safe and trusted place to discover and download apps.” Due to these assurances in Apple’s marketing, the complaint said the plaintiffs trusted that a Sparrow Wallet app they downloaded from the App Store on iOS was legitimate, when in reality it was a fraudulent spoof designed to steal Bitcoin from users.

Sparrow Wallet is only available on Windows, macOS, and Linux. The popular Bitcoin wallet is not available on iOS, but scammers have released fake lookalike apps in the App Store that can trick users into giving up control of their funds.

[…]

Even when victims reported fraud, the lawsuit alleges that Apple often took little to no action, and it says other fake Sparrow apps remain in the App Store.

Sparrow Wallet developer Craig Raw has publicly addressed Apple’s slow response to multiple fake versions of his app appearing in the App Store. In a January 2024 social media post, for example, he said “there is still a scam ‘Sparrow Wallet’ app on the @Apple App Store, despite myself and others having reported it weeks ago.”

Craig Raw:

My attempt to protect users from scam apps on the @AppStore has gotten my Apple Developer account flagged for termination - ironically, for “dishonest activity”.

[…]

I’m the developer of the real Sparrow Wallet, a desktop app, and I hold the registered US trademarks for the name and logo. I have publicly warned @Apple and the community about these fake apps from early 2024, but they keep appearing.

The app @Apple flagged was a placeholder that was never published. Its only purpose was to warn users that Sparrow is desktop-only and that other “Sparrow” apps aren’t mine. This approach may have been misguided, but there was nothing dishonest about it.

Joe Rossignol:

In response to our request for comment, Apple said it has taken swift action to remove any apps impersonating Sparrow Wallet[…] Apple says it takes immediate action against apps that do not comply with its guidelines.

Previously:

• Hide My Email Vulnerability Exposes Real Address
• Sirius Pomodoro
• The App Store Scammer Strikes Back
• Sanctioned Entities Slip Through App Store Controls
• Some of the Apps in the App Store
• Fake Bitcoin Wallet in the App Store
• Fraudulent Rabby Wallet App

Update (2026-07-28): Sarah Perez:

The complaint targets one of Apple’s longtime competitive arguments: that its tight control over its App Store makes its platform safer than those offered by its rivals. The company has used this claim to push back against deregulation of the app ecosystem, including third-party app stores and sideloading.

“As part of a sustained marketing campaign, Apple has positioned itself, its products and services, as offering a level of security and trustworthiness superior to any competing technology company,” the new filing states. “This includes assurances about the safety of applications distributed through its App Store. By retaining exclusive control over which apps are permitted on Apple devices, Apple has structured its platform to ensure that consumers depend entirely on its promise of safety and reliability,” it reads.

With third-party app stores, there would be an incentive to do better vetting than Apple, and with sideloading it would be clear that the app was not being downloaded from sparrowwallet.com.

Update (2026-07-29): Jeff Johnson:

What struck me about Apple’s response is that it places the burden of curating the App Store on developers and users rather than taking responsibility for it. After all, Apple reviews every version of every app before it can be published to the App Store. If Apple is curating the App Store, then why do scams have to be reported and removed? One wonders how the scams get past Apple review in the first place, and even if Apple review “is not perfect” (a gross euphemism), how the second line of defense, Apple employees patrolling the App Store for scams that the review team missed, also fails. The burden of App Store curation should not fall to me, a lone indie developer.

Apple’s response also ignores that the indie developer did report the scams, multiple times.

Previously:

• Hidden Gambling Apps in Brazilian App Store

In early 2025, Atlanta resident Samuel Tunick was on his way home following a trip abroad. After landing in the US, customs agents demanded access to his Pixel phone, which was running an alternative version of Android called GrapheneOS. Rather than hand over his data, Tunick used a clever feature of the software to delete everything. Now, he's facing federal charges.

The first hearing in this case happened last week, according to The Guardian, during which government attorneys and agents claimed that Tunick was subjected to a standard secondary interrogation at an international airport. During that encounter, agents were "looking for anything that’s prohibited." However, Tunick's legal team alleges he was targeted for his activism.

Tunick was involved with a group called Defend the Atlanta Forest, which opposed the construction of an enormous law enforcement training facility in the area often known as Cop City. What Tunick didn't know, according to his lawyers, was that he'd been placed on a watch list for his actions and that Customs and Border Protection had discussed over email plans to detain him upon his arrival back in the US for "suspected terrorism activities."

Read full article

Comments

© Ryan Whitwam

AP (Hacker News):

A federal judge has approved a $1.5 billion copyright settlement in which artificial intelligence company Anthropic will pay thousands of authors about $3,000 per book after using pirated copies of their works to train its Claude chatbot.

[…]

Bestselling thriller novelist Andrea Bartz first brought the suit with two other authors in 2024. It’s the first major settlement in dozens of AI copyright lawsuits that are still working their way through courts.

Dare Obasanjo:

Somewhat ironic given recent claims from Anthropic about others training their AI on its work.

Previously:

• Apple Intelligence Training
• The New York Times Sues OpenAI
• Hachette v. Internet Archive
• The Internet Archive’s National Emergency Library

Marcus Mendes:

Apple’s requests to overturn a $634 million patent verdict and secure a new trial in its long-running legal battle with Masimo were denied.

Wesley Hilliard:

There doesn’t appear to be any other path for appeal or recourse, as the judge rejected both requests for either a new judgement or trial.

[…]

In the end, Masimo didn’t succeed in getting the Apple Watch banned or fundamentally redesigned. It won an empty victory with the funds it will be paid, and the patents affecting the lawsuit will expire in 2028 and 2029 anyway.

Paul Terpstra:

Although the ruling confirms the financial penalty, it does not affect current Apple Watch users. The smartwatch’s blood oxygen monitoring feature remains available after Apple introduced a software update in January 2024 that allowed sales to continue despite earlier legal challenges.

Previously:

• Apple Sues OpenAI Over Trade Secrets
• John Ternus Replaces Tim Cook
• Danaher to Buy Masimo
• Apple Loses Blood Oxygen Patent Case
• The Return of Blood Oxygen for Apple Watch
• Apple Watch Sales Paused Over Masimo Patent
• Masimo v. Apple

Le café fait vivre environ 125 millions de personnes dans le monde. Pourtant, près d'un producteur sur deux vit encore sous le seuil de pauvreté, alors que jusqu'à la moitié des terres adaptées à la culture du café arabica pourrait disparaître d'ici 2050 sous l'effet du changement climatique.

Matt Burgess (MacRumors, ArsTechnica):

On Thursday, San Francisco city attorney David Chiu sent legal notices to Apple and Google demanding that they remove from their app stores 13 face-swapping apps, which allow users to create AI-generated nonconsensual nude images. The letters say the Silicon Valley giants should stop “aiding and abetting” the sale of explicit deepfake images and “sever” business relationships with the app developers.

[…]

Researchers have repeatedly found and reported apps in Apple’s App Store and Google’s Play Store that allow people to generate sexual images using AI—including some apps being rated as suitable for use by children. While new laws and bans aim to tackle the scourge of explicit deepfakes online, technology and social media companies consistently direct millions of people toward the harmful tech.

Both Apple and Google have developer policies that prohibit pornography, abuse, and harassment on their platforms.

Burgess gives the impression, which is my base assumption, that these 13 apps were clear about what they do, so App Review has no excuse for missing them. But I’m sure it’s keeping us all safe in other regards.

Meanwhile, in a preprint research paper published in May, researchers from Cornell University and Georgetown University identified 420 apps offering general face-swapping capabilities on Google’s and Apple’s app stores. They tested 155 to see if they could be used to create face swaps with nude images; in 70 percent of cases, it was possible, with the apps not including safety measures to prevent this.

Previously:

• Sirius Pomodoro
• Apps for YouTube℠™®•!
• Sanctioned Entities Slip Through App Store Controls

Update (2026-07-21): Danny Bradbury:

Chiu isn’t arguing that hosting an app automatically makes a platform liable for what it does. Platform operators already won that battle with Section 230 of the Communications Decency Act. That 30-year-old law says websites generally aren’t responsible for content posted by users, allowing platforms to host user-generated content without getting sued every time someone defames someone in a comment thread.

Courts have often extended those protections to cover app stores too. Apple and Google are treated as distributors of whatever a third-party developer uploads, rather than publishers.

Chiu is attempting to sidestep that argument by focusing on the companies’ payment systems, noting that Apple and Google collect a cut of every in-app purchase. According to the Tech Transparency Project (TTP), that means they profit from apps that generate revenue by creating non-consensual intimate imagery.

Hartley Charlton:

The European Commission yesterday adopted new exemptions to its Batteries Regulation that free the Apple Watch and AirPods from having to offer user-removable and replaceable batteries.

[…]

The reasoning largely mirrors why devices like electric toothbrushes were already exempt: Opening a compact, sealed enclosure and failing to reseal it properly could let water in and create a safety risk. Products can also qualify for exemption if their construction makes battery removal inherently dangerous, or if there is no realistic way to build in user access given current manufacturing methods.

[…]

The iPhone was already exempt from the removability rule under the original regulation, thanks to its battery cycle life and water resistance rating.

Marcus Mendes:

Although the Commission has adopted the exemption, it must still undergo scrutiny by the European Parliament and the Council of the EU.

[…]

To read the European Commission’s full delegated act, follow this link.

Previously:

• DMA Compliance: Watch and Headphone Interoperability
• European Union USB-C Mandate
• EU Wants All Phones to Work With Interoperable Chargers

Update (2026-07-20): See also: Hacker News.

Update (2026-07-30): Rui Carmo:

This is one of those exceedingly rare cases where EU legislation has produced an unambiguously good outcome: from February 2027, Logitech’s European wireless devices will ship with hard-pack, user-replaceable batteries, and Logitech will sell certified replacements.

Jason Koebler (tweet, Reddit):

The AI music generation tool Suno scraped millions of songs and lyrics from YouTube Music, Deezer, and Genius, as well as from the stock music libraries Pond5, Jamendo, Freesound, the International Music Score Library Project, and podcasts via RSS feeds, according to a hacker who breached the company and shared data about Suno’s training libraries with 404 Media. The hacker was also able to access user information for hundreds of thousands of Suno’s customers, as well as Stripe payment information, they said.

[…]

As part of these legal proceedings, Suno previously admitted that it was trained on “essentially all music files of reasonable quality that are accessible on the open internet,” which included a total of “tens of millions of recordings.” Suno has been making the argument that it is allowed to train on copyrighted works as fair use in those cases, one of which has been settled.

Corbin Bolies:

Suno has long acknowledged that its AI music generator relied on the scraping of millions of songs available across the internet, but a new hack reveals just how the company pulled from streaming services and websites[…] all while user information remained vulnerable.

[…]

“Our goal has always been to help people create original new music, not replicate someone else’s. That’s why we build our models around what we call ‘Original Creation, By Design,’” the spokesperson said in a statement. “For example, we intentionally do not use artist names as a category of training metadata because we want our models to help people create brand new songs, not music that replicates other artists’ existing work. It’s also why we built Suno with detection filters that block or prevent a user from using specific artist, song, or album names as prompts, and prevent users from uploading lyrics or sound recordings that match existing works.”

Previously:

• Apple Scraping YouTube for AI Training Data
• Disney vs. Google and OpenAI
• The New York Times Sues Perplexity
• Apple Intelligence Training Lawsuit
• Sora App
• Reuters Wins AI Copyright Case
• AI Companies Ignoring Robots.txt
• The New York Times Sues OpenAI

Sarah Perez (PDF, Hacker News, MacRumors):

The iPhone maker alleges that this misconduct, which it says reveals a pattern of theft from OpenAI employees who previously worked at Apple, was directed by OpenAI’s senior leadership, including Chief Hardware Officer Tang Tan.

The lawsuit, which was filed in the U.S. District Court for the Northern District of California, accuses Tan of using Apple’s confidential project code names during OpenAI’s recruiting process, asking job candidates to bring in Apple hardware components to their interviews, coaching departing Apple employees on how to evade the company’s security procedures, and asking for details about the company’s unannounced products.

Apple’s allegations are detailed and shocking, and it sounds like they have a lot of evidence.

Chance Miller:

The lawsuit names Chang Liu and Tang Tan as two of the defendants. Tang Tan served as VP of product design at Apple, leading iPhone and Apple Watch product design. He departed the company in February 2024 to work with Jony Ive. Chang Liu, meanwhile, worked at Apple for eight years and was a senior system electrical engineer before departing to join OpenAI in January 2026.

Apple’s lawsuit also names OpenAI and io Products as defendants.

OpenAI’s hardware efforts are being led by Jony Ive, Apple’s former chief design officer.

[…]

Ive, Hankey, and Cannon are not personally mentioned anywhere in Apple’s initial filing today.

Emma Roth:

Here are the most surprising claims in Apple’s 41-page filing.

Marcus Mendes (MacRumors):

OpenAI’s Director of Strategic Communications, Drew Pusateri, took to X to comment on the company’s behalf.

In his post, he claims OpenAI has “no interest in other companies’ trade secrets,” adding that OpenAI remains “focused on building innovative technology that empowers people everywhere.”

This seems like a weak response, given that Apple says it reported its findings to OpenAI in February and never heard back. Presumably, they’ve already investigated but see the situation as serious enough that they need to say as little as possible.

It’s not clear to me the extent to which Apple believes the behavior was limited to the named defendants. It’s hard to believe that the rest of OpenAI’s leadership—including Altman and Ive—were unaware, given the scale of their recruiting from Apple. It’s equally hard to believe that they were aware and thought they could get away with it. I guess little from Altman would surprise me at this point. I’d like to believe that Ive wasn’t part of it, but then are we to believe that his former coworkers all kept him in the dark?

Nick Heer:

What is immediately notable about this whole thing is the myriad conflicts of interest. Apple, of course, has a current partnership with OpenAI to power Apple Intelligence features, something repeatedly mentioned on the previous version of its marketing webpage, and conspicuously absent on the current one.

But the history runs far deeper. Among the defendants in the suit is io Products — do not blame me for that capitalization choice — founded by Jony Ive and acquired by OpenAI last May. Total mentions of “Ive” in the body of this lawsuit? Zero. Also, one of the investors in Ive’s company was Emerson Collective, founded by Laurene Powell Jobs, and which now has equity in OpenAI. Neither Emerson nor Powell Jobs are defendants.

M.G. Siegler:

It all reads a bit as if Apple has been building up evidence of these allegations for some time and recently got their smoking gun. It’s not just nebulous “trade secrets” either, there are specific mentions down to “metal finishing techniques” that Apple apparently invented and protected.

It also comes a little less than a month after OpenAI was rumored to be threatening Apple with a lawsuit over the perceived failure of their deal to bake ChatGPT into the iPhone. As I wrote at the time, even just that threat was clearly not going to go over well in Cupertino.

John Gruber (Mastodon):

Footnote 13 on p. 15 states:

Apple and OpenAI have a commercial relationship involving the integration of OpenAI’s ChatGPT into Apple Intelligence. The companies have entered into a written agreement governing that integration. That agreement is not at issue here. OpenAI’s acts of trade secret misappropriation alleged herein do not arise from and have no connection to that agreement.

Be that as it may legally speaking, in practical terms it seems untenable for that Apple Intelligence partnership to continue after this.

Jason Snell:

All that bubbling-under-the-surface tension between Apple and OpenAI is now out in the open!

M.G. Siegler:

Namely, while Apple frames OpenAI – or at least its fledgling hardware division – as “rotten to its core” (interesting terminology!), they really only have a case against two and maybe three individuals. But they also clearly believe that if this case goes to trial, they will have a case against a lot more.

[…]

The parallels to the Anthony Levandowski situation after he left Google for Uber have been drawn.

[…]

It is interesting that Apple is not suing Yu-Ting “Alyssa” Peng, who is named in the suit as a co-conspirator with Liu while she was still employed at Apple, before she also subsequently went to work at OpenAI. Is it possible she’s cooperating or has cooperated with Apple in this investigation?

[…]

Even if these allegations are found to be untrue or embellished, can he reasonably stay at OpenAI now? And perhaps that’s the real outcome Apple is looking for here, as they clearly frame him as the ringleader of the 400-plus people who have come over to OpenAI from Apple.

Hartley Charlton:

OpenAI’s ambitions to build a hardware rival to the iPhone are already running into trouble because of Apple’s trade secret lawsuit, according to Bloomberg’s Mark Gurman, who argues the damage is showing up well before any court ruling.

[…]

The scale of the talent drain is a major part of why this matters to Apple. More than 400 former Apple employees now work at OpenAI, including former Apple design chief Jony Ive, and Gurman says the company poached so heavily from Apple’s iPhone product design group specifically that Apple had to rebuild parts of the team. Apple has responded with bigger retention bonuses and executives personally working to keep engineers from leaving.

Jeff Johnson:

OpenAI stole stuff? I can’t believe it! I thought they were done with stealing after they stole literally everything on the internet.

Colin Cornaby:

I’m sure there’s no problem with sending this company all your source code they pinky swear not to train on.

Steve Troughton-Smith:

I can’t believe this awful company solicited confidential information and stolen trade secrets, hiring from this other company while pretending to partner with them. ‘Rotten to the core’ indeed

😛

He’s referencing Apple doing this to Masimo. And, of course, Steve Jobs himself directed Apple to engage in illegal hiring practices.

Previously:

• OpenAI Acquires Jony Ive’s io
• Apple v. Optis Cellular Technology
• OpenAI to Become For-Profit Company
• OpenAI and Ive
• Masimo v. Apple
• OpenAI Is Today Unrecognizable
• Inside Apple’s Design Team
• BlueMail Antitrust Case Against Apple Dismissed
• Apple Suing Former A-series Chip Lead
• Apple/Google Hiring Lawsuit, Settled

Update (2026-07-17): See also: Dithering.

Tim Hardwick (FT, Hacker News):

Apple has reportedly sent legal letters to dozens of former Apple employees now working at OpenAI, telling them to preserve potentially relevant documents and communications as it continues to pursue its trade secret lawsuit against the AI company.

Update (2026-08-06): Hartley Charlton (PDF):

OpenAI has asked a federal judge to dismiss Apple’s lawsuit accusing the AI company of stealing trade secrets, calling the allegations “meritless.”

Previously:

• OpenAI Open Letter Responds to Apple Lawsuit

Tim Hardwick:

Apple’s challenge against the EU’s designation of its App Stores and iOS platform as “gatekeepers” was dismissed by Europe’s top court on Wednesday, reports Reuters.

[…]

The company also disputed the classification of iMessage as a number-independent interpersonal communications service, or NIICS, which would subject the app to EU telecoms rules. But the General Court said Apple’s actions regarding the iMessage service are inadmissible.

William Gallagher:

Back in 2023, Apple acknowledged that it qualified under the then-new definition of being what the EU called a gatekeeper service. But key to that is the size of the operation, and since 2024, Apple has been claiming it runs five smaller App Stores rather than one large one.

[…]

“Irrespective of the devices in question,” ruled the judges, “those stores have the same purpose, namely to connect app developers with end users in order to facilitate the distribution of software applications.”

Steve Dent:

Apple disagreed with the decision but didn’t say yet if it would appeal. “We firmly believe the DMA’s mandate goes beyond what is lawful and proportionate, threatening to erode decades of privacy and security protections we’ve built and leaving our users vulnerable to new risks,” an Apple spokesperson said in a statement to multiple outlets. “We will continue advocating for the innovation and privacy our European customers deserve.”

Apple still has two cases pending with EU courts. The first is a challenge to the EU Commission’s decision last year forcing Apple to open iOS to third-party developers, and the second is an appeal against the €500 million fine imposed in April last year for anti-steering violations.

Previously:

• EU Fines Apple and Meta Over DMA Violations
• DMA Compliance: Watch and Headphone Interoperability
• iPadOS Also a Digital Gatekeeper in EU
• DMA Gatekeepers Designated

Ben Lovejoy:

The EU required Apple to permit third-party app stores, while a US court ruled that developers have the right to direct iPhone users to third-party payment platforms for app purchases and subscriptions. Britain’s Competition and Markets Authority (CMA) is now proposing to apply this latter rule in the UK.

Tim Hardwick (John Gruber):

The U.K.’s competition regulator has proposed letting app developers direct users to payment options outside Apple’s App Store and Google’s Play Store, in a move aimed at increasing competition and reducing the fees charged by the two companies.

[…]

The regulator said any fees Apple and Google charge developers for enabling such “steering” must be fair and reasonable, remain below existing App Store and Play Store commissions, and allow developers to either pass savings on to consumers or reinvest them in innovation.

John Gruber (Mastodon):

Requiring Apple to allow apps to steer users to the web to make payments is, I’ve long argued, sensible regulation. I’ve also long argued that Apple has been obstinate in disallowing it. If in-app payments — through Apple’s system — can’t compete with out-of-app payments on the web, something is wrong with IAP. But it’s wrong to assume that payments outside IAP will result in lower prices and better policies for users.

Nick Heer:

They may increase prices when costs grow but that does not mean they do the opposite. But who cares? Lower costs permit more flexibility on pricing and, even if that money ends up in the pockets of developers instead of Apple, is that supposed to be a bad thing? Is there a reason why someone should be upset that they might pay the same amount but an indie developer gets to keep more of it?

The proposed policies are pretty straightforward from what I can see. Among other obligations, Apple is not allowed to use or require scare tactics when users are routed to an external payment mechanism and, while it is allowed to charge a steering fee, it is not allowed to count services not used by developers offering third-payments nor double-count for services already accounted for by other developer fees. Also, the CMA calls bullshit on Apple’s claim that third-party payments are particularly risky[…]

Previously:

• Apple Asks Supreme Court to Review Epic Ruling
• UK CMA Secures App Store Committments
• Brazil Recommends Sanctions for Apple Over App Store and NFC Rules
• UK CMA vs. Apple’s Browser Rules
• iPhone NFC Access Outside EU

Update (2026-07-30): Juli Clover:

Apple said new UK App Store rules would give regulators a “highly intrusive” role dictating how it runs its business, reports Reuters. Apple submitted feedback to the UK’s Competition and Markets Authority as it considers forcing Apple to change its App Store rules around steering.

[…]

UK regulators said Apple can charge developers a fee, but it must be fair and reasonable, and below existing App Store commissions, so developers can pass savings to customers or reinvest them in innovation.

According to Apple, the CMA’s proposed rules would undermine innovation and investment, and would amount to price regulation because of the restriction on fees.

Joseph Cox (MacRumors, Hacker News):

A vulnerability in Apple’s “Hide My Email” tool lets almost anyone discover a person’s real email address that is supposed to be hidden by the feature, and Apple has failed to fix it for more than a year, according to a security researcher and 404 Media’s own tests.

[…]

“Apple Hide My Email is leaking email addresses that are supposed to be hidden. We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” Tyler Murphy, the co-founder of EasyOptOuts, which discovered and reported the issue to Apple, told 404 Media.

“Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk,” Murphy added.

[…]

To test the issue I generated a new Hide My Email address and provided it to Murphy. Around five minutes later, he replied with my real email address linked to my Apple account which was supposed to be hidden.

Ben Lovejoy:

Murphy said that he reported the issue to Apple in June of last year, and the company told him it was looking into it. Apple said it had been fixed in March of this year, but Murphy found that wasn’t the case. He again contacted Apple, with the company saying that it would appreciate him not revealing the existence of the flaw until it had been resolved.

Apple then said it planned to address the issue in June, but since it still hasn’t been fixed[…]

Tyler Murphy:

March 19, 2026: Using the reproduction instructions from our initial report, we determined that the vulnerabilities hadn’t been fixed.

May 22, 2026: We realized that the vulnerabilities may have greater severity and scope than we thought initially and reported this to Apple. Apple never acknowledged the report of increased severity.

June 30, 2026: Apple again reported that the vulnerabilities were fixed and asked us to verify. We determined that the vulnerabilities hadn’t been fixed.

Jeff Johnson:

This is every fucking Feedback I file.

John Gruber:

Not good. Especially the “We reported the issue and replication instructions to Apple over a year ago” part.

This is becoming a pattern. At least Apple still allows third-party e-mail providers.

Nick Heer:

Very few details are available right now. I have seen speculation that the original email address is revealed when someone replies using their hidden email address, but the impression I get from Cox’s reporting is that no user interaction is necessary[…]

[…]

I am also unclear about how, as of May, the EasyOptOuts guys found the “vulnerability may have greater severity and scope” than initially reported. Ominous, though.

Previously:

• Hide My Email Moving to private.icloud.com Domain
• No Bounty for Mysk
• AirTrafficDevice: Ignored, Reluctantly Fixed, No CVE, No Bounty
• Evolution of Apple Security Bounty Program
• The Time to Fix Web Security Bugs

Update (2026-07-13): Jeff Johnson:

I don’t know whether I’ve accidentally stumbled upon that vulnerability, or perhaps in this case the Hide My Email user just messed up in some way, but I’ve definitely discovered a bizarre and troubling Hide My Email bug in Mail app (on macOS Sequoia 15.7.7).

[…]

Bizarrely, however, Mail app displayed an alert that I’ve never seen before, “This message was forwarded to you by Hide My Email,” despite the fact that I have previously received many emails from people using Hide My Email.

[…]

• Why I am seeing two different @icloud.com email addresses, one of which appears to be the sender’s unhidden address?
• Why are the To: and From: fields in my reply disabled?
• Why is my reply not from my @underpassapp.com email address but rather displayed falsely as from the sender’s @icloud.com address and really from my unrelated Apple Account address?

Update (2026-07-16): Joe Rossignol:

Apple this week was sued over a reported “Hide My Email” flaw that could expose a user’s real email address. The proposed class action lawsuit alleges that Apple violated California’s false advertising law and other consumer protection statutes by knowingly offering a feature that does not work as advertised.

This is interesting in that the June 2025 bug report is the evidence that Apple “knew” the feature didn’t work, while “Apple continued to represent to consumers that Hide My Email would actually hide users’ email.” How long are they supposed to get to fix a bug?

Update (2026-07-20): Jeff Johnson:

The misleading user interface elements in Mail app are a bug, but by themselves they’re not a vulnerability. The vulnerability is that when I send a reply to my maliciously crafted email, my Apple account email address is disclosed in the “From” field of the sent reply! In other words, the Mail app interface lies, fails to show the true sent value of the “From” field.

There are a couple of crazy aspects to this information disclosure vulnerability:

1. It does not require that the victim actually use Hide My Email! I never use it. As I mentioned in my previous blog post, I don’t even have an icloud.com email account.
2. It does not matter which of the victim’s email accounts receives the email from the attacker. If your Apple account email address is a@foo.com, but you receive a maliciously crafted email addressed to b@bar.com, Mail app will still send your reply from a@foo.com, thereby disclosing your Apple account address.

Update (2026-07-21): Juli Clover:

Apple addressed a vulnerability in Hide My Email that exposed a user's real email address, reports 404 Media. Apple told the site the issue was fully fixed in a patch released on July 3.

[…]

While the bug has now been addressed, email logs that pre-date the fix could still expose user email addresses.

Update (2026-07-22): See also: Hacker News.

Jeff Johnson:

It appears that the vulnerability I discovered, and which still occurs, is different from the vulnerability reported by others[…]

Cecilia Kang, Ryan Mac, and Eli Tan (March, Hacker News):

The social media company Meta and the video streaming service YouTube harmed a young user with design features that were addictive and led to her mental health distress, a jury found on Wednesday, a landmark decision that could open social media companies to more lawsuits over users’ well-being.

[…]

Citing features like infinite scroll and algorithmic recommendations, K.G.M. sued Meta, which owns Instagram and Facebook, and Google’s YouTube, claiming they led to anxiety and depression.

Nick Heer:

For its part, the Wall Street Journal editorial board is standing up for beleaguered social media companies in an editorial today criticizing everything about these verdicts, including this specific means of liability, which it calls a “dodge” around Section 230.

[…]

Product design, though, is a different question. It would be a mistake, I think, to read Section 230 as a blanket allowance for any way platforms wish to use or display users’ posts. (Update: In part, that is because it is a free speech question.) From my entirely layman perspective, it has never struck me as entirely reasonable that the recommendations systems of these platforms should have no duty or expectation of care.

Nick Heer, on an April Massachusetts lawsuit:

To me, a non-lawyer, much of the actual text of the ruling (PDF) explaining why this lawsuit was not immediately turfed on Section 230 grounds seems pretty reasonable. For example, the judge says “[u]nder the default settings, Meta enables approximately forty types of notifications” for the Instagram app, which the government alleges “is designed to overwhelm young users and compel them repeatedly to reopen Instagram”. We can argue whether this is a meaningful thing for a government to police or if it is just another example of Meta resorting to tacky growth-hacking techniques instead of trusting their product is sufficiently compelling on its own. (Most days when I open Instagram in my browser, it puts a red badge over the notifications tab and suggests I have one new follower. I do not; I never have. It lies to me every time, presumably because it knows most people, including me, will usually click on that, thereby increasing a number on a dashboard somewhere.)

Mike Masnick:

couple weeks back, Jonathan Haidt published another entry in his ongoing campaign to convince the world that social media is inherently ruining kids’ lives. This one was a victory lap titled “Seven Lines of Evidence Against Social Media,” treating recent developments — including the social media addiction verdicts against Meta that most people are misunderstanding — as vindication of his thesis.

[…]

But then something inconvenient happened for Haidt’s thesis: Pew went and did a brand new study exploring teens’ experiences on TikTok, Instagram, and Snapchat. This one asked the kids themselves.

[…]

Indeed, the research repeatedly suggests that for the very small number of kids who are facing mental health problems and overrelying on social media in response, the answer is a targeted intervention to help those individuals — not a broad “ban kids from social media” program.

Previously:

• UK Social Media Ban
• Kids Online Safety Act
• Australia’s Social Media Ban
• France’s Social Media Ban
• The Age Verification Trap
• EU Council Approves New “Chat Control” Mandate

Amy Howe:

The Supreme Court on Monday ruled that when law enforcement officials used a “geofence warrant” – a warrant that instructed Google to provide location data for cellphone users who were near a particular place during a specific time period – to obtain evidence used to convict a Virginia man of a 2019 bank robbery, they conducted a “search” for purposes of the Fourth Amendment. By a vote of 6-3, the justices sent Okello Chatrie’s case back to the lower court for it to consider whether, as the Fourth Amendment requires, the search was “reasonable.”

Writing for the majority, Justice Elena Kagan emphasized that “[a]n individual has a reasonable expectation of privacy in records about his cell phone’s location, and police intrude on that constitutionally protected interest when they demand the information—even though for only a limited time, and from a third-party tech company.”

[…]

For purposes of whether the government conducted a search, Kagan said, it does not matter that law enforcement officials “access[ed] only a short amount of cell-phone location information.” […] Nor does it matter, Kagan continued, that Chatrie gave Google permission to collect and use the location data.

Previously:

• Google Maps Is Killing Timeline for Web

Hartley Charlton:

A group of 48 China-based iOS developers have filed an antitrust complaint against Apple with the country’s market regulator over the App Store’s commission rates, the South China Morning Post reports.

The developers sent an open letter to China’s State Administration for Market Regulation (SAMR), alleging that Apple failed to deliver on a promise to offer the lowest commission rate to the Chinese market. The group asked the SAMR to investigate and penalize Apple for allegedly abusing its market dominance to impose “unfair and excessively high” costs on local developers.

Apple lowered the fees in March but not as much as it did in Brazil and Japan.

Previously:

• Lower App Store Fees in China
• Brazil: App Marketplaces and External Payments
• Japan: App Marketplaces, External Payments, New Fee Structure
• Regulatory Complaint About App Store in China
• Chinese App Store Antitrust Probe

Amanda Silberling (May 2025):

The Kids Online Safety Act (KOSA) has been reintroduced into Congress. If passed into law, this bill could impose some of the most significant legislative changes that the internet has seen in the U.S. since the Children’s Online Privacy Protection Act (COPPA) of 1998.

As it currently stands, KOSA would be able to hold social media platforms legally accountable if it’s proven that these companies aren’t doing enough to protect minors from harm. The bill includes a long list of possible harms, such as eating disorders, sexual exploitation, substance abuse, and suicide. Though it overwhelmingly passed through the Senate last year, the bill was stifled in the House.

[…]

“Apple is pleased to offer our support for the Kids Online Safety Act (KOSA). Everyone has a part to play in keeping kids safe online, and we believe [this] legislation will have a meaningful impact on children’s online safety,” Timothy Powderly, Apple’s senior director of Government Affairs, said in a statement.

Nick Heer:

The App Store Accountability Act is based on model legislation written by the Digital Childhood Alliance. The lobbying group also publishes marketing pieces, including one (PDF) that calls Apple’s age verification frameworks “ineffective”. Specifically, it points to the lack of parental consent required “for kids to enter into complex contracts”, with “no way to verify that parental consent has been obtained”.

Maya Posch (via ednl):

Since the arrival of so-called ‘social media’ the central tenet of never giving out your personal information which was front and center during the 1990s and 2000s got quite literally flipped around. Suddenly we had massive corporations practically begging you to give every last scrap of your personal information, every intimate detail of your daily life and with it every last second of your attention span.

[…]

The upshot of this reversal is that instead of a mostly comfortable anonymous experience, suddenly every second that you’re awake has been turned into the equivalent of a schoolyard during recess, the watercooler banter at the office and similar social interactions.

[…]

This raises many questions, such as whether ‘social media’ and the FOMO it introduces is a legitimate addiction, and whether we shouldn’t make being online more anonymous rather than enforce a rather dystopian ‘real name’ policy onto the populace.

Joe Mullin (Hacker News):

Within the next week, Congress is preparing to vote on the KIDS Act, a sprawling package of legislation that seeks to control Americans’ web browsing and private messaging. The package includes a revised version of the Kids Online Safety Act, or KOSA, combined with a collection of other internet bills, study bills, reporting requirements, and new regulations. Instead of debating any of these proposals on their merits, lawmakers are attempting to move them all at once under an ultra-expedited process.

[…]

Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its requirements come at the expense of privacy, free expression, and the ability of people of all ages to use the internet without revealing sensitive data.

[…]

Several provisions of the bill create new rules around direct messages, disappearing or “ephemeral” messages, and AI chat services.

The bill includes language stating that certain KOSA requirements should not be construed to override strong encryption. But the protection is incomplete. The carve-out applies to certain features and messaging controls, but doesn’t apply to KOSA’s separate requirement that platforms “address” a list of harms to minors.

Previously:

• UK Social Media Ban
• Child Safety Features in appleOS 27
• Arizona Age Verification Bill
• Texas Age Verification Suspended
• Bluesky Blocking Access to Mississippi
• Tim Cook Opposes App Store Age Verification Bill

Tim Hardwick:

The British government will introduce a ban on social media access for all users under 16 years of age, set to take effect in 2027.

[…]

The plan goes further than a similar ban introduced in Australia. It will cover major platforms Snapchat, TikTok, YouTube, Instagram, Facebook, and X. An exhaustive list has not yet been released, but Starmer said the rules will apply to services “whose purpose is to enable social interaction and which allow users to post material.”

Messaging apps like WhatsApp and Signal are not covered by the ban, and most social media platforms already require children to be over 13 to create an account and use their services.

Max Goldbart (Hacker News):

So-called AI ‘romantic companion’ chatbots – designed to simulate sexual relationships or roleplay with users – will have to enforce a minimum age of 18 and the government will also be looking in more detail at overnight curfews and breaks in infinite scrolling for under-18s, with more detail coming in July.

[…]

The government said it will “learn the lessons” from Australia’s experience by introducing more highly effective age assurance measures to support compliance, making it far harder for children to bypass safeguards.

Ax Sharma (Hacker News):

In practice that means anyone opening a new account will likely have to prove they’re over 16 by uploading an ID or passing a facial age scan, the same checks that adult sites serving UK visitors have implemented since July 2025 under the Online Safety Act.

Long-standing accounts are largely exempt, but signing up fresh now triggers verification, effectively ending anonymous account creation in the UK.

James Rodger (Hacker News):

New VPN rules are set to be issued by the Labour Party government as part of the under-16 social media ban. The government has not revealed any plans to regulate them, but ministers have said details about action alongside the social media ban, including regarding VPN use, will come in July.

Paige Collings and Jillian C. York (Hacker News):

There remains no reliable, privacy-preserving method of verifying the age of every internet user and methods vary from one platform to the next.

Young people will not simply be protected from being contacted by adults or endlessly scrolling—they’ll also lose access to educational videos on YouTube, local events on Facebook, and potentially cut off from distant friends and family.

[…]

The provision also requires internet service providers to limit the time kids spend online, and has rules about who can contact them online. These extreme rules will take decisions about using technology away from families and put them in the hands of government regulators.

Cory Doctorow (Hacker News):

The problem is, there’s no such thing as “age verification” for the internet. What we call “age verification” is actually mass surveillance, so invasive and pervasive that it makes the ad-tech industry’s commercial surveillance look like some kind of cypherpunk darknet pirate utopia[…]

[…]

Any attempt to save kids from online harms should start with saving kids from online surveillance, but that’s the opposite of what we’re doing today. After decades of failing to pass and enforce privacy controls for the internet, those same governments are breaking all land-speed records to pass “age verification” laws that make privacy illegal[…]

Anonymous (Hacker News):

Lots of US states, European countries, and Australia have introduced “age verification” regulations. They present it as the classic “save the children” talking point, but it’s really just a precursor to attribution of speech, particularly attributing your words to your real identity.

Sean Hollister (via John Gruber):

Azdoufal is the security researcher who used Claude Code to help discover that every DJI Romo robot vacuum cleaner and a million baby monitors and security cameras were embarrassingly easy to hack. This time, he says he discovered over 985,000 photo IDs sitting on the public internet for any half-decent hacker to steal.

[…]

Traditionally, you’d need to provide a photo ID every time you wanted to get into a club. But with the verification system, the receptionist can pull up your stored identity documents and check if your face matches. There’s also an optional app called PuffPal that lets clubs scan a QR code for faster entry.

But when Azdoufal decompiled that PuffPal app, he explains in his report, he discovered that Nefos had no meaningful level of security.

Previously:

• Kids Online Safety Act
• The Age Verification Trap
• Arizona Age Verification Bill
• France’s Social Media Ban
• UK Age Verification for VPNs
• UK Child Protections and Messaging Backdoor
• Australia’s Social Media Ban
• EU Council Approves New “Chat Control” Mandate
• Imgur Blocks UK Users Over Age Verification
• UK Online Safety Act

Update (2026-07-01): Craig Grannell:

I find it incredible that the UK government is about to create a cliff edge where teens will simultaneously be able to access social media and vote, having had no experience of the latter and with scant understanding of how algorithms work.

Update (2026-07-08): James Ball (via Nick Heer):

There are almost no truly public spaces on the internet. Everywhere we congregate is privately owned, even if it operates as a public space. But we seem somehow content to accept them as fiefdoms in their own right, beyond the reach of government. Instead of demanding that they function as safe and pleasant public spaces for all of us, we are asking our governments just to ban teenagers from them.

[…]

It is one thing to ban our children from one park when there are others nearby. It is quite another to ban them from every public space when there are no others on offer.

[…]

I am skeptical as to whether social media is as dangerous as some of its critics say. I am even more skeptical as to whether it is particularly dangerous to teens and young people. […] The central facet of my argument in this post is that wherever you land on the matters of the harms of social media, a ban for teenagers is the wrong response. If the harms are overstated, the policy is unnecessary. If they are not, it is an abdication.