4 ms·

So we have forgotten XcodeGhost already or the iCloud hacks?

by gozo 11y ago

jolux 11y ago
Neither of which would be aided by opening the walled garden? Which isn't to say I don't think there are advantages to Android's model and that of more open package repositories in general, especially for power users. However most of Apple's base is people who don't care about openness or extra repositories, they want their iPhone to work with a minimum of fuss and not have to worry about malware like you do on Android. The fact that we can only point to a single (XcodeGhost) cromulent exploitation of the Apple App Store stack is a testament to how good Apple is at maintaining the relative security of the iOS ecosystem.
- gozo 11y ago
  The point is that security is not an inherent or necessarily attainable feature of a walled garden. Some people seem to think that just because Apple approves apps there isn't going to be any security issues. The approval process does prevent some security problems, and has some other features, but mobile security overwhelmingly comes from things like sandboxing.
  - jolux 11y ago
    Perhaps that's the case, but if it is, then it seems clear that Apple's sandbox is far better than Android's as well. Also, approving apps does cull out a range of malware, because it is human- and computer-analyzed before entry. As I said previously, this has its downsides, but it does make it harder to get malware into the iOS App Store. Not impossible, but harder.
IBM 11y ago
XcodeGhost wouldn't have happened if developers weren't able to disable Gatekeeper and the iCloud hack was done with phishing for security question answers. http://gawker.com/feds-seized-chicago-mans-computers-in-celeb-nude-leak-i-1709153721 http://gawker.com/feds-seized-chicago-mans-computers-in-cele...
- gozo 11y ago
  The iCloud hack was enabled by the automatic backup feature that despite storing very sensitive information didn't provide adequate security for doing so. If there were actual precedent for Apple caring about their users privacy, there would be outrage over this rather than being trivially dismissed.
  - IBM 11y ago
    That's not relevant at all to the iCloud "hack". It's a cloud service, the whole point is to store data online. Those accounts were breached because celebs were phished and not because of bruteforcing, as some people were speculating at the time, or some other vulnerability.
    - muddi900 11y ago
      Everyone gets phished. Fraud happens. Secret Questions are especially susceptible to phishing attacks. This has been known for about a decade. Apple had not updated the security protocols for iTunes, and in turn App Store and iCloud, for that time. The hack was definitely Apple's fault. '"In total, the [500] unique iCloud accounts were accessed 3,263 times," the document states.' - http://www.businessinsider.com/fbi-investigation-into-the-fappening-reveals-mans-house-was-searched-2015-6?op=1 http://www.businessinsider.com/fbi-investigation-into-the-fa... This was a massive failure in Apple's part.
      - gozo 11y ago
        Yes, how can one trust a company's claims about privacy when the seemingly lose no trust over even such a high-profile incident? Celebrities phones has been targeted since at least the T-Mobile Sidekick.
bottled_poe 11y ago
Wasn't XcodeGhost a direct result of bypassing Apple's security model?
- gozo 11y ago
  As far as I know the users didn't. Which is to say that the App Store doesn't provide much more security than e.g. a black list. Androids problems are more than anything having a fragmented ecosystem.

So we have forgotten XcodeGhost already or the iCloud hacks?

by gozo 11y ago

So we have forgotten XcodeGhost already or the iCloud hacks?

jolux 11y ago

Neither of which would be aided by opening the walled garden? Which isn't to say I don't think there are advantages to Android's model and that of more open package repositories in general, especially for power users. However most of Apple's base is people who don't care about openness or extra repositories, they want their iPhone to work with a minimum of fuss and not have to worry about malware like you do on Android. The fact that we can only point to a single (XcodeGhost) cromulent exploitation of the Apple App Store stack is a testament to how good Apple is at maintaining the relative security of the iOS ecosystem.

gozo 11y ago
The point is that security is not an inherent or necessarily attainable feature of a walled garden. Some people seem to think that just because Apple approves apps there isn't going to be any security issues. The approval process does prevent some security problems, and has some other features, but mobile security overwhelmingly comes from things like sandboxing.
- jolux 11y ago
  Perhaps that's the case, but if it is, then it seems clear that Apple's sandbox is far better than Android's as well. Also, approving apps does cull out a range of malware, because it is human- and computer-analyzed before entry. As I said previously, this has its downsides, but it does make it harder to get malware into the iOS App Store. Not impossible, but harder.

IBM 11y ago

XcodeGhost wouldn't have happened if developers weren't able to disable Gatekeeper and the iCloud hack was done with phishing for security question answers. http://gawker.com/feds-seized-chicago-mans-computers-in-celeb-nude-leak-i-1709153721 http://gawker.com/feds-seized-chicago-mans-computers-in-cele...

gozo 11y ago
The iCloud hack was enabled by the automatic backup feature that despite storing very sensitive information didn't provide adequate security for doing so. If there were actual precedent for Apple caring about their users privacy, there would be outrage over this rather than being trivially dismissed.
- IBM 11y ago
  That's not relevant at all to the iCloud "hack". It's a cloud service, the whole point is to store data online. Those accounts were breached because celebs were phished and not because of bruteforcing, as some people were speculating at the time, or some other vulnerability.
  - muddi900 11y ago
    Everyone gets phished. Fraud happens. Secret Questions are especially susceptible to phishing attacks. This has been known for about a decade. Apple had not updated the security protocols for iTunes, and in turn App Store and iCloud, for that time. The hack was definitely Apple's fault. '"In total, the [500] unique iCloud accounts were accessed 3,263 times," the document states.' - http://www.businessinsider.com/fbi-investigation-into-the-fappening-reveals-mans-house-was-searched-2015-6?op=1 http://www.businessinsider.com/fbi-investigation-into-the-fa... This was a massive failure in Apple's part.
    - gozo 11y ago
      Yes, how can one trust a company's claims about privacy when the seemingly lose no trust over even such a high-profile incident? Celebrities phones has been targeted since at least the T-Mobile Sidekick.

bottled_poe 11y ago

Wasn't XcodeGhost a direct result of bypassing Apple's security model?

gozo 11y ago
As far as I know the users didn't. Which is to say that the App Store doesn't provide much more security than e.g. a black list. Androids problems are more than anything having a fragmented ecosystem.