MacOS – Does trustd leak information about users’ software usage to Apple and/or third parties

daemonsmacosnotarizationprivacy

When discussing a recent outage of Apple's OCSP server, people on various Twitter accounts (in the threads following this tweet) and "fefe's blog" claimed that the way trustd works on macOS would leak information about which software was used when to Apple and potentially to third parties as well. I always thought that trustd only sent hashes upstream and used OCSP stapling to prevent disclosing that sort of information.

Is there any reliable information out there about the privacy implications of trustd on macOS?

Best Answer

Is there any reliable information out there about the privacy implications of trustd on macOS?

I don't think we need a deep dive into the privacy concers of what trustd does and how it does it. If we just look at four points in Jeffery Paul's blog (referenced in the first link - Jacopo Jannone - supplied by bmike's answer) we can see where the privacy issues stem from:

  1. The OCSP requests contain date, time, location, ISP, and application hash
  2. The OCSP requests are transmitted unencrypted.
  3. It's hosted by a 3rd party company (Akamai)
  4. Apple is a partner in PRISM that grants federal police agencies warrant-less, unfettered access to this data.

What does this tell us?

  • There is a log of what application you used, when you used it and where hosted by a company that has their own privacy policy and procedures.

  • This information can be be easily obtained through a simple man-in-the-middle attack, or by the ISP (of the coffee shop you're hanging out in) simply sniffing the traffic as it passes through their network. Even the coffee shop itself could potentially sniff this traffic!

  • PRISM access is essentially based on the "honor system" that the government "cannot" access info on Americans without first obtaining a warrant. However, recent history tells us otherwise.

A knee-jerk reaction to these points would point you down a path leading to "conspiracy theory." It's not that. It's that this information paints a picture of you and your activities and this information is not protected nor is it held on Apple's own servers - a company that loves to promote their stance on "privacy."

Using trustd to validate certificates of apps is one thing, but the fact that a log is created and maintained of not only a users activity on their computer they supposedly own, using software they supposedly and allegedly have full rights to use but also where and when they use it is concerning. IMO, this information shouldn't even exist in the first place. The fact that it exists on the servers of a company users didn't directly and explicitly contract with to share this data with is beyond troubling.

To whom does this computer belong to anyway? Apple, or the user?