[simondw]

> if Apple is providing raw eye tracking streams to app developers

Apple is not doing that. As the article describes, the issue is that your avatar (during a FaceTime call, for example) accurately reproduces your eye movements.

[makeitdouble]

Isn't it the a distinction without a difference ? Apple isn't providing your real eye movements, but an 1 to 1 reproduction of what it tracks as your eye movements.

The exploit requires analysing the avatar's eyes, but as they're not the natural movements but replicated ones, there should be a lot less noise. And of course as you need to intentionally focus on specific UI targets, these movements are even less natural and fuzzy than if you were looking at your keyboard while typing.

[dialup_sounds]

The difference is that you can't generalize the attack outside of using Personas, a feature which is specifically supposed to share your gaze with others. Apps on the device still have no access to what you're looking at, and even this attack can only make an educated guess.

[taneq]

This is a great example of why ‘user-spacey’ applications from the OS manufacturer shouldn’t be privileged beyond other applications: Because this bypasses the security layer while lulling devs into a false sense of security.

[simondw]

> ‘user-spacey’ applications from the OS manufacturer shouldn’t be privileged beyond other applications

I don't think that's an accurate description, either. The SharePlay "Persona" avatar is a system service just like the front-facing camera stream. Any app can opt into using either of them.

[KaiserPro]

That app gets a real time Gaze vector, which unless I've misunderstood something, non-core apps don't get.

[simondw]

Which app?

[KaiserPro]

I should have said avatar service.

[FrustratedMonky]

But the technology is there. That is the concern.

[simondw]

The technology to reproduce eye movements has been around since motion pictures were invented. I'm sure even a flat video stream of the user's face would leak similar information.

Apple should have been more careful about allowing any eye motion information (including simple video) to flow out of a system where eye movements themselves are used for data input.

[FrustratedMonky]

"technology to reproduce eye movements has been around since motion pictures were invented"

Sure, but like everything. It is when it is widespread that the impact changes. The technology was around, but now it could be on everyone's face, tracking everything you look at.

If this was added to TV's so every TV was tracking your eye-movements, and reporting that back to advertisers. There would be an outcry.

So this is just the slow nudging us in that direction.

[simondw]

To be clear, the issue this article is talking about is essentially "during a video call the other party can see your eyes moving."

I agree that we should be vigilant when big corps are adding more and more sensors into our lives, but Apple is absolutely not reporting tracked eye-movement data to advertisers, nor do they allow third-party apps to do that.

[dialup_sounds]

It's not a problem with the technology.

The problem is the edge case where it's used for two different things with different demands at the same time, and the fix is to...not do that.

> Apple fixed the flaw in a Vision Pro software update at the end of July, which stops the sharing of a Persona if someone is using the virtual keyboard.

[FrustratedMonky]

"fixed the flaw "

Or

"Ooopps, so sorry you caught us. Guess we'll have better luck keeping this hidden next time."

[dialup_sounds]

Keeping what hidden? Caught who? The eye-tracking technology is literally a core part of the platform. What is it you're trying to say?

[FrustratedMonky]

From articles first sentance:

" lot about someone from their eyes. They can indicate how tired you are, the type of mood you’re in, and potentially provide clues about health problems. But your eyes could also leak more secretive information: your passwords, PINs, and messages you type."

Do you want that shared with advertisers? With your health care provider?

The article isn't about the technology, it is about sharing the data.

[dialup_sounds]

Who are you saying shared what data with whom?

[dagmx]

How are they getting the data you claim is shared with them?