Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ

Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ

@mysk.bsky.social

We're two #iOS developers and occasional #security researchers on two continents. #CyberSecurity 🎬 https://youtube.com/@mysk πŸ“ https://mysk.blog

436 followers106 following252 posts

πŸ“ New Blog Post: Thoughts on Responsible Disclosure We recently disclosed issues in WebKit that affected Psylo and iCloud Private Relay. This has sparked some debate, so we want to explain our reasoning and share some thoughts on responsible disclosure mysk.blog/2026/08/25/r...

mysk.blogThoughts on Responsible DisclosureWe recently disclosed three WebKit issues that can leak a user’s DNS traffic or reveal their real IP address, even when the browser is configured to route traffic through a proxy. The issues affected ...

Many of you have asked for a way to support the Loupe project. We want to keep Loupe free of in-app purchases, so instead we’ve created a Buy Me a Coffee page for anyone who’d like to show their appreciation. β˜• buymeacoffee.com/mysk

buymeacoffee.comMyskWe are an independent cybersecurity and privacy research team focused on iOS and macOS.Our work explores security and privacy topics within the Apple ecosystem β€” including threat research, privacy inv

🚨 PSA: Uninstalling Google Chrome on macOS doesn't remove Chrome's background updater. It keeps running until you remove: ~/Library/Application Support/Google/GoogleUpdater ~/Library/LaunchAgents/com.google.GoogleUpdater.wake.plist Then, restart.

Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart. Due to a macOS bug, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy) youtu.be/lLJkxWR71B0

🚨 We're disclosing a macOS security bug that Apple says is not an issue. Using a simple archive-and-restore trick, an attacker can silently replace the main executable of virtually any application downloaded from the web, no password or warning is required. mysk.blog/2026/07/23/m...

mysk.blogSilent Replacement of Trusted macOS App ExecutablesA vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges. As a result, trusted applications ...

Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ reposted

oh how did i miss this? excited to jump into it, mysk gives us the best iOS toys.

Introducing Loupe, our latest privacy app for iOS. Discover what apps can learn about you just by reading data your iPhone already exposes, such as your languages, installed apps, device sensors, and much much more. Loupe is free, private, and open source. Try itπŸ‘‡ apps.apple.com/app/id676615...

Thanks a million for everyone who shared, downloaded, or rated Loupe. We have great plans for Loupe in the future. This huge reception is very encouraging. Privacy shall prevail. Thank you πŸ™

Introducing Loupe, our latest privacy app for iOS. Discover what apps can learn about you just by reading data your iPhone already exposes, such as your languages, installed apps, device sensors, and much much more. Loupe is free, private, and open source. Try itπŸ‘‡ apps.apple.com/app/id676615...

Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ reposted

Mysk has done the public a profound service by releasing this app for free. I was astonished at the accuracy of the profile it provided. Great way to get a sense of your iOS device's personal data exposure!

Introducing Loupe, our latest privacy app for iOS. Discover what apps can learn about you just by reading data your iPhone already exposes, such as your languages, installed apps, device sensors, and much much more. Loupe is free, private, and open source. Try itπŸ‘‡ apps.apple.com/app/id676615...

Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ reposted

Very well done and scarily eye opening!

Introducing Loupe, our latest privacy app for iOS. Discover what apps can learn about you just by reading data your iPhone already exposes, such as your languages, installed apps, device sensors, and much much more. Loupe is free, private, and open source. Try itπŸ‘‡ apps.apple.com/app/id676615...

Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ reposted

Even without you giving them any permissions, mobile apps can learn a whole lot about (and potentially identify) you. πŸ‘€πŸ“²

Introducing Loupe, our latest privacy app for iOS. Discover what apps can learn about you just by reading data your iPhone already exposes, such as your languages, installed apps, device sensors, and much much more. Loupe is free, private, and open source. Try itπŸ‘‡ apps.apple.com/app/id676615...

Oh, 1Password stores user profile pictures on their servers without authentication. Anyone who has the long URL, which also contains the account identifier, can access the picture. It's not a big deal, but a password manager should definitely be more careful. #privacy

Great news. Apple collects exhaustive analytics when you view apps in the App Store app. The detailed analytics is linked to your identity and there is no way to turn the massive data collection off. Now iPhone users can view apps anonymously in a browser www.macrumors.com/2025/11/03/a...

macrumors.comApple Launches App Store for the WebApple launched a new App Store on the web today, allowing users to browse through and search for apps across all of its platforms. The updated...

Holy smoke 🀯 This bug has led us to gain access to any app's Keychain entries on macOS. 🀯🀯🀯🀯🀯🀯 Still, no time to report it to Apple yet

🏜️🎁 We accidentally found a security flaw in macOS Tahoe and earlier An attacker can trick a user into performing a simple yet common action that breaks the sandbox protection of any file (e.g iMessage database and Safari browsing data) giving any application permanent access to the target file

🏜️🎁 We accidentally found a security flaw in macOS Tahoe and earlier An attacker can trick a user into performing a simple yet common action that breaks the sandbox protection of any file (e.g iMessage database and Safari browsing data) giving any application permanent access to the target file

Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ reposted

Ready for iOS 26 with Liquid Glass? Doing our best to be ready for next week September 15 Here’s a sneak peek at our current progress πŸ’¦πŸ”Ž #iOS26 #LiquidGlass

As Psylo is the only #iOS browser that opens App Store links anonymously in the web, the review link below will open in the web view. Copy the link and paste it in another browser. It should take you to the App Store to rate Psylo πŸ™

Love Psylo? We really appreciate sharing your experience in a review! Your feedback helps Psylo climb the App Store search results. We intentionally don’t prompt for ratings in the app to keep it user-friendly. Leave your review here: πŸ™ apps.apple.com/app/id674135...

Mysk πŸ‡¨πŸ‡¦πŸ‡©πŸ‡ͺ reposted

I asked Plex a bunch of questions about its data breach of user account information, but the company wouldn't say why it hasn't force-reset its users' passwords and is instead asking users to do it. The company also hasn't explained how (and to what extent) it scrambled those passwords.

techcrunch.comPlex urges users to change passwords after data breach | TechCrunchPlex said that it was aware of a security incident involving the theft of Plex customer account information, including user names, email addresses, scrambled passwords, and unspecified authentication ...