3 ms·

You can do that on PC by hibernating instead of locking the screen (assuming it works on the OS and hardware being used) and then rebooting instead of shutting

by devit 11y ago

You can do that on PC by hibernating instead of locking the screen (assuming it works on the OS and hardware being used) and then rebooting instead of shutting down after hibernation.

mehrdada 11y ago
If you do that, you'll lose 100% of your PC's functionality, whereas iOS is quite useful in locked mode. With some neat tricks, it even fetches new mail for you, for instance: basically it encrypts new messages by encrypting them with a public key whose private key is encrypted and the key is not available while the device is locked[+]. A hibernated PC cannot do this and lots more. [+]: technically, it generates a new AES key, encrypts the message under it, encrypts that key under a key derived from ECDH over Curve25519 with the system public key (whose private key is encrypted and inaccessible while locked) and saves the encrypted file and the wrapped key somewhere to be decrypted when it gets unlocked and gets rid of the AES key.
- devit 11y ago
  That's not as secure as hibernation, because someone who can break into the running device can at least read all your new mail and if they aren't using an ad-hoc e-mail protocol or implemented it carelessly also read all mail and probably get the e-mail username and password too. This also only really works for software specifically designed for this mode. EDIT: it can actually be mostly secure if the client public key is sent before locking and then the encryption is done by the server: the attacker would only learn the number and timing of new messages and their size (assuming an ad-hoc protocol and very carefully implemented software). It's also sort of possible to do it with generic software by simply dumping HTTPS TCP traffic to disk and decoding it once the system is unlocked (although it allows a MITM to fill up your disk unless the ciphersuite allows authentication with a key that doesn't allow decryption).

by devit 11y ago

You can do that on PC by hibernating instead of locking the screen (assuming it works on the OS and hardware being used) and then rebooting instead of shutting down after hibernation.

mehrdada 11y ago

If you do that, you'll lose 100% of your PC's functionality, whereas iOS is quite useful in locked mode. With some neat tricks, it even fetches new mail for you, for instance: basically it encrypts new messages by encrypting them with a public key whose private key is encrypted and the key is not available while the device is locked[+]. A hibernated PC cannot do this and lots more. [+]: technically, it generates a new AES key, encrypts the message under it, encrypts that key under a key derived from ECDH over Curve25519 with the system public key (whose private key is encrypted and inaccessible while locked) and saves the encrypted file and the wrapped key somewhere to be decrypted when it gets unlocked and gets rid of the AES key.

devit 11y ago
That's not as secure as hibernation, because someone who can break into the running device can at least read all your new mail and if they aren't using an ad-hoc e-mail protocol or implemented it carelessly also read all mail and probably get the e-mail username and password too. This also only really works for software specifically designed for this mode. EDIT: it can actually be mostly secure if the client public key is sent before locking and then the encryption is done by the server: the attacker would only learn the number and timing of new messages and their size (assuming an ad-hoc protocol and very carefully implemented software). It's also sort of possible to do it with generic software by simply dumping HTTPS TCP traffic to disk and decoding it once the system is unlocked (although it allows a MITM to fill up your disk unless the ciphersuite allows authentication with a key that doesn't allow decryption).