4 ms·

Am I silly for preferring the herd security provided by using vanilla iOS?

by peteretep 10y ago

homingbrain 10y ago
If your only worry is malware, vanilla iOS is probably OK. But malware is not the only problem they're trying to solve.
- peteretep 10y ago
  What are the other problems this will solve that vanilla iOS doesn't?
  - d8421l01vv4r 10y ago
    They are trying to achieve complete control over the code it runs. Which is in some ways the opposite of Apple's approach to security.
bahjoite 10y ago
What security do you think you get from being in the herd?
- peteretep 10y ago
  - No signalling effect - Quick and reliable disclosure of and turn around on vulnerabilities
  - laumars 10y ago
    > "No signalling effect" Can you explain this point please. I've not heard it used in this context before. > "Quick and reliable disclosure of and turn around on vulnerabilities" Sadly there's only a very loose correlation between the popularity of a product and the corporations ability or willingness to disclose vulnerabilities or release patches in good time, nor even patch them at all (in the worst cases). An apt example of this is how poor many OEMs are at pushing Android updates to popular tablets and smartphones. However I do appreciate you specified iOS and Apple are generally better at supporting older devices than many Android OEMs. But I'm replying to the "herd" point more generally.
    - peteretep 10y ago
      > Can you explain this point please. I've not heard it > used in this context before. What I was poorly trying to explain was my feeling that there's sufficiently little data flowing through Tor, and probably sufficiently interesting data in there, that my guess it's it's seen a lot of scrutiny for all sorts of attacks, and there's a real possibility nodes are storing traffic for future decryption when vulnerabilities are shown. I try and lock almost all of my data down to HTTPS over a VPN (F-Secure's Freedome), which my gut feeling is is probably a lot less exciting. In the same vein, a device that's meant purely for TOPSECKRITDATA?! and has a small install base feels like a much bigger target as I'm signalling I have something I am explicitly trying to hide. >> "Quick and reliable disclosure of and turn around on >> vulnerabilities" > I do appreciate you specified iOS Yeah, I probably didn't express this very well. But I do trust Apple to take it seriously, and I don't think I could take seriously the idea of running an Android device these days from a security and privacy perspective, which is sad.
      - laumars 10y ago
        Thank you for the explanation. Your signaling argument sounds an awful lot like security through obscurity[1], which I do read a lot and sympathise with to an extent, but unfortunately it can also be easily debunked. Pragmatically, security needs to match the circumstances in order to get a fair balance between usability and security. For most people, hiding inside the noise is "good enough". However the issue arises if any one person gets the limelight thrust upon them for whatever reason. And we've seen examples of this with the phone hacking scandals in the UK and how some journalists also search social media accounts of previously unknown individuals who might hit the headlines. In situations like this, you can no longer hide your signal amongst the noise of the internet as you're not being specifically targeted. So I guess the point I'm trying to make is the signaling argument only works because the odds are in your favour. But like with any game of chance, there's always the slim chance that you might be unlucky. At least with stronger levels of security, your comms might be more visible in some circumstances, but at least very little can be ascertained from those comms. Generally speaking of course. However going back to your VPN vs Tor argument specifically, I do agree with you that the security benefits of Tor are largely overstated, so it's not something I use personally myself either. [1] https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
lmm 10y ago
Depends what your threat model is, and what you're trying to do. I mean if you're an ordinary person with no particular enemies and no huge dark secrets then most of the time you don't need any security, honestly.
- peteretep 10y ago
  At least one of my huge dark secrets is my credit card details. I don't think the idea that most people don't need any security has any depth.
  - mSparks 10y ago
    thatz a much better way of hitting the home run on If you have nothing to lose you have nothing to hide If you have nothing to hide you have nothing to fear. my moto from the pre snowden/opm hack days. quite nice that it doesnt get me downvotes anymore.
    - arca_vorago 10y ago
      Could you clarify, did you understand the error of your statements once the Snowden leaks happened, or are you saying you still agree with this oft refuted (il)logic?
      - peteretep 10y ago
        His logic makes perfect sense to me, because almost everyone has something to lose, which means almost everyone has something to hide.
        arca_vorago 10y ago
        I just misunderstood then, thanks for the clarification.
    - puddintane 10y ago
      Granted USA is not a true Democracy but doesn't that defeat the purpose of a Democracy? Of course I know that you can't have freedom and security these days but should we just start re-labeling the states as a different type of government? I'm by no means an expert however if we are to have freedom to keep our secrets why is it shameful to do so - even if it is "something to hide" is fearful to divulge we should still have that right to make the choice. Correct me if I'm wrong, please, because I'm still very young with politics and as such am still learning a lot about it.

Am I silly for preferring the herd security provided by using vanilla iOS?

homingbrain 10y ago

If your only worry is malware, vanilla iOS is probably OK. But malware is not the only problem they're trying to solve.

peteretep 10y ago
What are the other problems this will solve that vanilla iOS doesn't?
- d8421l01vv4r 10y ago
  They are trying to achieve complete control over the code it runs. Which is in some ways the opposite of Apple's approach to security.

bahjoite 10y ago

What security do you think you get from being in the herd?

peteretep 10y ago
- No signalling effect - Quick and reliable disclosure of and turn around on vulnerabilities
- laumars 10y ago
  > "No signalling effect" Can you explain this point please. I've not heard it used in this context before. > "Quick and reliable disclosure of and turn around on vulnerabilities" Sadly there's only a very loose correlation between the popularity of a product and the corporations ability or willingness to disclose vulnerabilities or release patches in good time, nor even patch them at all (in the worst cases). An apt example of this is how poor many OEMs are at pushing Android updates to popular tablets and smartphones. However I do appreciate you specified iOS and Apple are generally better at supporting older devices than many Android OEMs. But I'm replying to the "herd" point more generally.
  - peteretep 10y ago
    > Can you explain this point please. I've not heard it > used in this context before. What I was poorly trying to explain was my feeling that there's sufficiently little data flowing through Tor, and probably sufficiently interesting data in there, that my guess it's it's seen a lot of scrutiny for all sorts of attacks, and there's a real possibility nodes are storing traffic for future decryption when vulnerabilities are shown. I try and lock almost all of my data down to HTTPS over a VPN (F-Secure's Freedome), which my gut feeling is is probably a lot less exciting. In the same vein, a device that's meant purely for TOPSECKRITDATA?! and has a small install base feels like a much bigger target as I'm signalling I have something I am explicitly trying to hide. >> "Quick and reliable disclosure of and turn around on >> vulnerabilities" > I do appreciate you specified iOS Yeah, I probably didn't express this very well. But I do trust Apple to take it seriously, and I don't think I could take seriously the idea of running an Android device these days from a security and privacy perspective, which is sad.
    - laumars 10y ago
      Thank you for the explanation. Your signaling argument sounds an awful lot like security through obscurity[1], which I do read a lot and sympathise with to an extent, but unfortunately it can also be easily debunked. Pragmatically, security needs to match the circumstances in order to get a fair balance between usability and security. For most people, hiding inside the noise is "good enough". However the issue arises if any one person gets the limelight thrust upon them for whatever reason. And we've seen examples of this with the phone hacking scandals in the UK and how some journalists also search social media accounts of previously unknown individuals who might hit the headlines. In situations like this, you can no longer hide your signal amongst the noise of the internet as you're not being specifically targeted. So I guess the point I'm trying to make is the signaling argument only works because the odds are in your favour. But like with any game of chance, there's always the slim chance that you might be unlucky. At least with stronger levels of security, your comms might be more visible in some circumstances, but at least very little can be ascertained from those comms. Generally speaking of course. However going back to your VPN vs Tor argument specifically, I do agree with you that the security benefits of Tor are largely overstated, so it's not something I use personally myself either. [1] https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity

lmm 10y ago

Depends what your threat model is, and what you're trying to do. I mean if you're an ordinary person with no particular enemies and no huge dark secrets then most of the time you don't need any security, honestly.

peteretep 10y ago
At least one of my huge dark secrets is my credit card details. I don't think the idea that most people don't need any security has any depth.
- mSparks 10y ago
  thatz a much better way of hitting the home run on If you have nothing to lose you have nothing to hide If you have nothing to hide you have nothing to fear. my moto from the pre snowden/opm hack days. quite nice that it doesnt get me downvotes anymore.
  - arca_vorago 10y ago
    Could you clarify, did you understand the error of your statements once the Snowden leaks happened, or are you saying you still agree with this oft refuted (il)logic?
    - peteretep 10y ago
      His logic makes perfect sense to me, because almost everyone has something to lose, which means almost everyone has something to hide.
      - arca_vorago 10y ago
        I just misunderstood then, thanks for the clarification.
  - puddintane 10y ago
    Granted USA is not a true Democracy but doesn't that defeat the purpose of a Democracy? Of course I know that you can't have freedom and security these days but should we just start re-labeling the states as a different type of government? I'm by no means an expert however if we are to have freedom to keep our secrets why is it shameful to do so - even if it is "something to hide" is fearful to divulge we should still have that right to make the choice. Correct me if I'm wrong, please, because I'm still very young with politics and as such am still learning a lot about it.