6 ms·

My solution is to buy an iPhone. I don't mean that as a snarky response, as I'd very much like to use an Android phone (And if it's just to be able to use Taske

by emsy 10y ago

My solution is to buy an iPhone. I don't mean that as a snarky response, as I'd very much like to use an Android phone (And if it's just to be able to use Tasker). But I simply don't have time to bother with this stuff anymore, so I pay ~200$ more in exchange for my time (and privacy). Secondly, I don't want to give anyone money that gives a crap about my device's security and privacy. There was a similar article on HN a while ago that came to the same conclusion: https://news.ycombinator.com/item?id=13056288 https://news.ycombinator.com/item?id=13056288

madshiva 10y ago
Your solution for what? for privacy? Apple privacy? just nope. Antivirus software are all bloatware, they don't do money anymore then they focus on other things "to secure". Ok. your clipboard can be read by other software (like in Windows ...) then what? just don't copy password. "Yes downvote my comment but don't argue. The solution buy an iPhone is still not valid solution."
- simonh 10y ago
  You're getting downvotes for your "LA, LA, LA I'm not listening" attitude. Android and iOS have many very different advantages and disadvantages over each other, but security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers. Trying to pretend that's not true or pick and choose 'whataboutist' issues and pretend that's all that matters to make false equivalences is really going to wind people up. The expected level of discourse here is quite a bit beyond that.
  - yellowapple 10y ago
    "security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers" The vast majority of this "superiority" only applies because the iOS ecosystem is a walled garden. Android devices typically allow sideloading, which obviously introduces an additional attack vector; reproducing this on iOS (i.e. by jailbreaking) brings you back to the same attack surface. The other notable difference between iOS and Android security-wise has historically been the ability to selectively accept certain privileges, but recent Android versions have introduced this as well, and even the old permissions model was (and still is) much more up-front and fine-grained about which permissions an app requires. iOS also had (and probably still has) an edge for awhile when it came to OpenBSD-style exploit mitigations IIRC, but Android is getting these too by way of projects like CopperheadOS. Other than those aspects, there are actually very few major differences (last I checked, at least; I haven't really been following the iOS world, so maybe Apple's done some crazy stuff while I wasn't looking) between their security models. Both implement some form of per-app sandboxing, both default to disallowing root access (in most cases, at least; third-party Android distros have a tendency to ship with root access, usually behind some toggle and/or some management app like SuperSU or whatever the latest hotness is), both default to a locked-down boot environment (in order to defend against rootkits), etc. Both have had their share of security-affecting bugs, too. There's no "clearly vastly superior" about it in either direction, at least on a platform level. On an ecosystem level, sure; Google doesn't do quite as good a job as Apple when it comes to screening malware (there have been quite a few notorious examples of this), and the ability to sideload apps (as well as the much easier jailbreaking/rooting situation) means that more malware is actually viable. This isn't a security problem in the sense of the platform itself, but rather in the sense of allowing users to shoot themselves in the foot by installing trojans. Like I said above, these exact same problems happen on jailbroken iOS devices, too (I reckon with a very similar frequency, too, but I don't have statistical evidence to back it up, so take that with a grain of salt).
    - jerf 10y ago
      "Android devices typically allow sideloading," In the context of this discussion, sideloading is irrelevant. We're talking about the default happen-to-everybody case. "Other than those aspects, there are actually very few major differences... between their security models" It's not just about the security model, though. We have some reason to believe that Apple phones may actually be at least partially resistant to law enforcement. I say that not as an encouragement to use them that way, but to point out that's about the highest security bar possible and we at least have some reason to think the latest iPhones get there. (And I am carefully phrasing this as "some reason to believe" and "resistant" because we do not know for sure whether this is the case, and I wouldn't bet that even if the phone can stymie a local police investigation that it would block a full-powered Federal investigation.) We have no reason to believe any Android phone meets this standard of security, nor would the fact that a particular one rose to that standard meant any other ones would. And if I'm pro-anything, I'm pro-Android in general. But that doesn't change the facts.
      - yellowapple 10y ago
        "We have some reason to believe that Apple phones may actually be at least partially resistant to law enforcement." Clarification: we have some reason to believe that Apple itself may be resistant to law enforcement agencies trying to compel Apple into doing said LEAs' jobs. It's a good sign that Apple hasn't (to public knowledge, at least) disclosed any sort of backdoor in iOS' at-rest encryption, but the same thing can be said of Android devices, too (at least the ones that do indeed support encrypted storage, which should be all of them released within the last couple years per what I recall from Google's standards, plus a significant quantity of prior devices). If we're going for the default happen-to-everybody case, iOS and Android are on equal footing here. If we're going for the security-conscious case, then Android has a huge leg up (due to the existence of completely-FOSS - and therefore completely-publicly-auditable - ROMs) relative to iOS (which lacks such a capability). Transparency is a dependency of trust. Neither iOS nor Android are transparent in a typical deployment, but at least an Android device can be transparent, and thus can be trustworthy. iOS cannot, and therefore cannot be trusted to be secure. Given that, I feel like - in this case - talking about "facts" when the publicly-available information on the lack of iOS backdoors (both at-rest and in-transit) is speculative at best does not seem to be logically consistent.
  - deleted 10y ago
    [deleted]
ocdtrekkie 10y ago
I intensely dislike Apple as a company, and I dislike their products, but the honest truth is there is no such thing as a reasonably secure Android device, and I can't fathom recommending one to anyone ever again. After seven years on Android, my recommendation is "literally anything else".
- emsy 10y ago
  I've stopped liking or disliking companies altogether. I try to look if a company isn't crossing my personal moral boundaries (child workers etc.) and whether it satisfies my needs. Then I buy their product. As for the moral part, Apple is the only company I've heard of that at least acknowledges there's a problem (http://www.apple.com/supplier-responsibility/ http://www.apple.com/supplier-responsibility/).
jmtd 10y ago
I'm trying to determine whether iOS apps could sniff my clipboard, and i haven't proven that they can't; it doesn't seem to be a specific permission that needs to be assigned or can be denied. And thus using 1Password on my iPhone to copy and paste passwords seems to have a bit of a risk to it.
- emsy 10y ago
  iOS Apps can read your clipboard (But only if the app is open i.e. not in the background, which was possible in earlier iOS versions). I would welcome it if they introduced a permission for clipboard handling. Personally, I use Workflow to clear my clipboard after pasting a password.
- deleted 10y ago
  [deleted]
- supergreg 10y ago
  But can apps sniff in what website or app you are using the password? Either for iOS or Android, if the password are just random strings unique for each site and they can't determine that then the attack vector diminishes.
  - bad_user 10y ago
    A while back you could query the apps currently active on iOS and there was a big scandal that Twitter was doing it, being reported by the media as a secret vulnerability, which was bullshit since that "vulnerability" was fairly well known already and in use by ad platforms. And at a previous company we used it for more than a year I think, before being in the news. I don't know what happened after that, Apple must have closed that loophole and Android requires a specific permission. But there are always vulnerabilities that developers can exploit and you can't trust the OS on this one. Plus it really doesn't matter, because when it comes to security, there's also the issue of the mono-culture and user technical stupidity. We know that many people use Gmail, Facebook, Twitter, etc, most of them reusing passwords across services. And logging the user's copy/pasted texts gives you such a specific dictionary that the probability of getting hacked approaches 1 fast.
bad_user 10y ago
I currently use an iPhone and it too isn't a good privacy solution either. For example my pet peeve is that apps like Waze or Uber are allowed to only request full location tracking, even while running in the background. As a user you cannot restrict location tracking to happen only when the app is running. This is an either-or proposition. Either the user allows location tracking while in the background, or you cannot use the app. And surely you can manually enable and disable location tracking per app, but that's way too cumbersome. Just imagine trying to start navigation while at a red light. Whereas with Android I used to be able to enable/disable location tracking globally, since you get a global shortcut that you can access in a swipe and tap. I also use 1Password as a password manager. Well, iOS has the same problem as Android where apps can read the contents of your clipboard, including copied passwords. And compared with Android it's not common to see password managers use third-party keyboards or accessibility features to side-step copy/pasting passwords. And sure, apps have an API to integrate managers like 1Password or Lastpass, which is nice when it's there and it's surely nice when it works in Safari, but too few apps use it. In other words, even though the privacy/security story is currently better for iOS, IMO it's not that good either and I hope that Apple and Google will work on improving this situation because I'm seriously thinking of going back to a dumb phone.
- cgb_ 10y ago
  To be fair, those are app choices to require 'Always' for location tracking. You can most definitely restrict an app to use location only while using - you can't fault Apple or IOS for apps that (unnecessarily [1]) demand more. One thing I really like about IOS is the reminder that an app has been using your location in the background for a while [2] [1] http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app-privacy-ios-android http://www.theverge.com/2016/11/30/13763714/uber-location-da... [2] https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/iphone6-ios9-weather-app-using-location.jpg https://support.apple.com/library/content/dam/edam/applecare...
  - zymhan 10y ago
    But Apple makes (seemingly) no effort to encourage developers to allow limited location access. Why can't iOS be in charge of when an app uses my location when the app is backgrounded? The reminder only appears once per app, as far as I've noticed. I restored my phone recently for the first time in over a year, and had totally forgotten about the reminder feature.

by emsy 10y ago

madshiva 10y ago

Your solution for what? for privacy? Apple privacy? just nope. Antivirus software are all bloatware, they don't do money anymore then they focus on other things "to secure". Ok. your clipboard can be read by other software (like in Windows ...) then what? just don't copy password. "Yes downvote my comment but don't argue. The solution buy an iPhone is still not valid solution."

simonh 10y ago
You're getting downvotes for your "LA, LA, LA I'm not listening" attitude. Android and iOS have many very different advantages and disadvantages over each other, but security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers. Trying to pretend that's not true or pick and choose 'whataboutist' issues and pretend that's all that matters to make false equivalences is really going to wind people up. The expected level of discourse here is quite a bit beyond that.
- yellowapple 10y ago
  "security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers" The vast majority of this "superiority" only applies because the iOS ecosystem is a walled garden. Android devices typically allow sideloading, which obviously introduces an additional attack vector; reproducing this on iOS (i.e. by jailbreaking) brings you back to the same attack surface. The other notable difference between iOS and Android security-wise has historically been the ability to selectively accept certain privileges, but recent Android versions have introduced this as well, and even the old permissions model was (and still is) much more up-front and fine-grained about which permissions an app requires. iOS also had (and probably still has) an edge for awhile when it came to OpenBSD-style exploit mitigations IIRC, but Android is getting these too by way of projects like CopperheadOS. Other than those aspects, there are actually very few major differences (last I checked, at least; I haven't really been following the iOS world, so maybe Apple's done some crazy stuff while I wasn't looking) between their security models. Both implement some form of per-app sandboxing, both default to disallowing root access (in most cases, at least; third-party Android distros have a tendency to ship with root access, usually behind some toggle and/or some management app like SuperSU or whatever the latest hotness is), both default to a locked-down boot environment (in order to defend against rootkits), etc. Both have had their share of security-affecting bugs, too. There's no "clearly vastly superior" about it in either direction, at least on a platform level. On an ecosystem level, sure; Google doesn't do quite as good a job as Apple when it comes to screening malware (there have been quite a few notorious examples of this), and the ability to sideload apps (as well as the much easier jailbreaking/rooting situation) means that more malware is actually viable. This isn't a security problem in the sense of the platform itself, but rather in the sense of allowing users to shoot themselves in the foot by installing trojans. Like I said above, these exact same problems happen on jailbroken iOS devices, too (I reckon with a very similar frequency, too, but I don't have statistical evidence to back it up, so take that with a grain of salt).
  - jerf 10y ago
    "Android devices typically allow sideloading," In the context of this discussion, sideloading is irrelevant. We're talking about the default happen-to-everybody case. "Other than those aspects, there are actually very few major differences... between their security models" It's not just about the security model, though. We have some reason to believe that Apple phones may actually be at least partially resistant to law enforcement. I say that not as an encouragement to use them that way, but to point out that's about the highest security bar possible and we at least have some reason to think the latest iPhones get there. (And I am carefully phrasing this as "some reason to believe" and "resistant" because we do not know for sure whether this is the case, and I wouldn't bet that even if the phone can stymie a local police investigation that it would block a full-powered Federal investigation.) We have no reason to believe any Android phone meets this standard of security, nor would the fact that a particular one rose to that standard meant any other ones would. And if I'm pro-anything, I'm pro-Android in general. But that doesn't change the facts.
    - yellowapple 10y ago
      "We have some reason to believe that Apple phones may actually be at least partially resistant to law enforcement." Clarification: we have some reason to believe that Apple itself may be resistant to law enforcement agencies trying to compel Apple into doing said LEAs' jobs. It's a good sign that Apple hasn't (to public knowledge, at least) disclosed any sort of backdoor in iOS' at-rest encryption, but the same thing can be said of Android devices, too (at least the ones that do indeed support encrypted storage, which should be all of them released within the last couple years per what I recall from Google's standards, plus a significant quantity of prior devices). If we're going for the default happen-to-everybody case, iOS and Android are on equal footing here. If we're going for the security-conscious case, then Android has a huge leg up (due to the existence of completely-FOSS - and therefore completely-publicly-auditable - ROMs) relative to iOS (which lacks such a capability). Transparency is a dependency of trust. Neither iOS nor Android are transparent in a typical deployment, but at least an Android device can be transparent, and thus can be trustworthy. iOS cannot, and therefore cannot be trusted to be secure. Given that, I feel like - in this case - talking about "facts" when the publicly-available information on the lack of iOS backdoors (both at-rest and in-transit) is speculative at best does not seem to be logically consistent.
- deleted 10y ago
  [deleted]

ocdtrekkie 10y ago

I intensely dislike Apple as a company, and I dislike their products, but the honest truth is there is no such thing as a reasonably secure Android device, and I can't fathom recommending one to anyone ever again. After seven years on Android, my recommendation is "literally anything else".

emsy 10y ago
I've stopped liking or disliking companies altogether. I try to look if a company isn't crossing my personal moral boundaries (child workers etc.) and whether it satisfies my needs. Then I buy their product. As for the moral part, Apple is the only company I've heard of that at least acknowledges there's a problem (http://www.apple.com/supplier-responsibility/ http://www.apple.com/supplier-responsibility/).

jmtd 10y ago

I'm trying to determine whether iOS apps could sniff my clipboard, and i haven't proven that they can't; it doesn't seem to be a specific permission that needs to be assigned or can be denied. And thus using 1Password on my iPhone to copy and paste passwords seems to have a bit of a risk to it.

emsy 10y ago
iOS Apps can read your clipboard (But only if the app is open i.e. not in the background, which was possible in earlier iOS versions). I would welcome it if they introduced a permission for clipboard handling. Personally, I use Workflow to clear my clipboard after pasting a password.
deleted 10y ago
[deleted]
supergreg 10y ago
But can apps sniff in what website or app you are using the password? Either for iOS or Android, if the password are just random strings unique for each site and they can't determine that then the attack vector diminishes.
- bad_user 10y ago
  A while back you could query the apps currently active on iOS and there was a big scandal that Twitter was doing it, being reported by the media as a secret vulnerability, which was bullshit since that "vulnerability" was fairly well known already and in use by ad platforms. And at a previous company we used it for more than a year I think, before being in the news. I don't know what happened after that, Apple must have closed that loophole and Android requires a specific permission. But there are always vulnerabilities that developers can exploit and you can't trust the OS on this one. Plus it really doesn't matter, because when it comes to security, there's also the issue of the mono-culture and user technical stupidity. We know that many people use Gmail, Facebook, Twitter, etc, most of them reusing passwords across services. And logging the user's copy/pasted texts gives you such a specific dictionary that the probability of getting hacked approaches 1 fast.

bad_user 10y ago

I currently use an iPhone and it too isn't a good privacy solution either. For example my pet peeve is that apps like Waze or Uber are allowed to only request full location tracking, even while running in the background. As a user you cannot restrict location tracking to happen only when the app is running. This is an either-or proposition. Either the user allows location tracking while in the background, or you cannot use the app. And surely you can manually enable and disable location tracking per app, but that's way too cumbersome. Just imagine trying to start navigation while at a red light. Whereas with Android I used to be able to enable/disable location tracking globally, since you get a global shortcut that you can access in a swipe and tap. I also use 1Password as a password manager. Well, iOS has the same problem as Android where apps can read the contents of your clipboard, including copied passwords. And compared with Android it's not common to see password managers use third-party keyboards or accessibility features to side-step copy/pasting passwords. And sure, apps have an API to integrate managers like 1Password or Lastpass, which is nice when it's there and it's surely nice when it works in Safari, but too few apps use it. In other words, even though the privacy/security story is currently better for iOS, IMO it's not that good either and I hope that Apple and Google will work on improving this situation because I'm seriously thinking of going back to a dumb phone.

cgb_ 10y ago
To be fair, those are app choices to require 'Always' for location tracking. You can most definitely restrict an app to use location only while using - you can't fault Apple or IOS for apps that (unnecessarily [1]) demand more. One thing I really like about IOS is the reminder that an app has been using your location in the background for a while [2] [1] http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app-privacy-ios-android http://www.theverge.com/2016/11/30/13763714/uber-location-da... [2] https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/iphone6-ios9-weather-app-using-location.jpg https://support.apple.com/library/content/dam/edam/applecare...
- zymhan 10y ago
  But Apple makes (seemingly) no effort to encourage developers to allow limited location access. Why can't iOS be in charge of when an app uses my location when the app is backgrounded? The reminder only appears once per app, as far as I've noticed. I restored my phone recently for the first time in over a year, and had totally forgotten about the reminder feature.