6 ms·

see also the really excellent kyptonite, which i found linked here a few months ago and i've been positively delighted with: https://krypt.co/ https://krypt.co

see also the really excellent kyptonite, which i found linked here a few months ago and i've been positively delighted with: https://krypt.co/ https://krypt.co/ i'm not a security expert, and i have a lot more trust in my iphone for managing secrets than my personally configured linux pc's.

srcmap 9y ago
I have a slightly different point of view: In Linux, I can easily monitor how much data, what kind of data are transferred to the remote IP and disable them on per apps base anytime I want. In IOS, I can't do any of that. At most, I can only disable an app from using cell data. If anyone else know how to do monitor/block network connection on per APP base in IOS, I would love to hear about it. For me, it is a different between "trust" and "trust and verify". I use IOS and have some level of trust on Apple/IOS. But I don't trust majorities of the IOS APPs for security/privacy.
- samat 9y ago
  FYI, IOS is operating system for routers by Cisco. iOS is operating system for mobile devices by Apple.
  - _hyn3 9y ago
    The funny part is the parent's comment applies perfectly well to either.
- staplers 9y ago
  If anyone else know how to do monitor/block network connection on per APP base in IOS, I would love to hear about it. I've been seeking a Little Snitch type connection monitor/firewall for iOS for some time. I believe Apple purposely makes this difficult/impossible on iPhones due to the constant metrics/analytics sent to Apple servers. Look at what they have done with turning off bluetooth and wifi from the Control Center.. It's really eye-opening to see how often Apple products ping home.
  - matthewmacleod 9y ago
    I believe Apple purposely makes this difficult/impossible on iPhones due to the constant metrics/analytics sent to Apple servers. I don't think that follows. Allowing applications to intercept and mess with other application's network traffic would be an obvious security issue; that's far more likely to be the reason than some kind of vague "we want to track your data" thing. It's certainly possible that Apple could construct an appropriate API for allowing users to configure apps in such a fashion that they could monitor network traffic, much the same way as similar APIs exist for accessing e.g. photos. But since it's a niche application at best, I'm hardly surprised they haven't done so.
    - comex 9y ago
      Such an API already exists: the NetworkExtension APIs, specifically NEPacketTunnelProvider and NEAppProxyProvider. They're meant for VPNs, but it should be possible to use the same APIs to monitor traffic and send it on, rather than tunneling it through a VPN. (There is also NEFilterProvider, but that API is designed to run the filter in a tight sandbox that doesn't allow it any outbound communication, so that it can filter packets but not exfiltrate them.) …though if you're concerned about privacy, perhaps you should be using a real VPN anyway, in which case you could handle traffic monitoring and filtering on the server side. Edit: I guess the server-side approach wouldn't allow identifying on which app is making the connection. The NetworkExtension APIs, however, should allow that: you get a flow of NEPackets, each of which has a 'metadata' property containing a 'sourceAppUniqueIdentifier' and 'sourceAppSigningIdentifier'. I don't have personal experience using these APIs though.
    - staplers 9y ago
      Allowing applications to intercept and mess with other application's network traffic Look at your cellular data usage in "system services" .. Apple is already intercepting and sending home a lot of your information without your ability to stop it.
  - djrogers 9y ago
    > Look at what they have done with turning off bluetooth and wifi from the Control Center.. It's really eye-opening to see how often Apple products ping home. Are you trying to imply that iOS devices ‘ping home’ when you disconnect from WiFi or Bluetooth? Or are you just complaining about the previous behavior (updated in 11.2 to be more obvious) that disconnected WiFi I stead of disabling it?
- pvg 9y ago
  Random iOS apps can't just pull all your secrets out of SE and send them off somewhere. That's what makes recent iOS devices a better place to put a secret than your typical Linux box. 'Not being able to get a hold of your secrets' is a much better line of defense than 'I think I can make it hard for something to exfiltrate my secrets that they've pilfered'. Especially since the latter is probably not really true.
  - srcmap 9y ago
    Virtual Keyboard Developer Leaked 31M Client Records (mackeepersecurity.com) Apple is sharing your facial wireframe with apps (washingtonpost.com)
    - pvg 9y ago
      None of these are secrets stored in SE, which is what this entire thread is about
  - nyolfen 9y ago
    >'Not being able to get a hold of your secrets' is a much better line of defense than 'I think I can make it hard for something to exfiltrate my secrets that they've pilfered'. Especially since the latter is probably not really true. reminds me of this: > Air-gapped networks are isolated, separated both logically and physically from public networks. Although the feasibility of invading such systems has been demonstrated in recent years, exfiltration of data from air-gapped networks is still a challenging task. In this paper we present GSMem, a malware that can exfiltrate data through an air-gap over cellular frequencies. Rogue software on an infected target computer modulates and transmits electromagnetic signals at cellular frequencies by invoking specific memory-related instructions and utilizing the multi-channel memory architecture to amplify the transmission. Furthermore, we show that the transmitted signals can be received and demodulated by a rootkit placed in the baseband firmware of a nearby cellular phone. We present crucial design issues such as signal generation and reception, data modulation, and transmission detection. We implement a prototype of GSMem consisting of a transmitter and a receiver and evaluate its performance and limitations. Our current results demonstrate its efficacy and feasibility, achieving an effective transmission distance of 1 - 5.5 meters with a standard mobile phone. When using a dedicated, yet affordable hardware receiver, the effective distance reached over 30 meters. https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-guri-update.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
- comex 9y ago
  Linking to my comment downthread in case you're using email notifications: https://news.ycombinator.com/item?id=15857589 https://news.ycombinator.com/item?id=15857589 It should be possible to write an app that does what you want; I'm not sure whether or not such apps already exist.
gdamjan1 9y ago
a yubikey can hold your private ssh key, and it can't be taken out of it

srcmap 9y ago

I have a slightly different point of view: In Linux, I can easily monitor how much data, what kind of data are transferred to the remote IP and disable them on per apps base anytime I want. In IOS, I can't do any of that. At most, I can only disable an app from using cell data. If anyone else know how to do monitor/block network connection on per APP base in IOS, I would love to hear about it. For me, it is a different between "trust" and "trust and verify". I use IOS and have some level of trust on Apple/IOS. But I don't trust majorities of the IOS APPs for security/privacy.

samat 9y ago
FYI, IOS is operating system for routers by Cisco. iOS is operating system for mobile devices by Apple.
- _hyn3 9y ago
  The funny part is the parent's comment applies perfectly well to either.
staplers 9y ago
If anyone else know how to do monitor/block network connection on per APP base in IOS, I would love to hear about it. I've been seeking a Little Snitch type connection monitor/firewall for iOS for some time. I believe Apple purposely makes this difficult/impossible on iPhones due to the constant metrics/analytics sent to Apple servers. Look at what they have done with turning off bluetooth and wifi from the Control Center.. It's really eye-opening to see how often Apple products ping home.
- matthewmacleod 9y ago
  I believe Apple purposely makes this difficult/impossible on iPhones due to the constant metrics/analytics sent to Apple servers. I don't think that follows. Allowing applications to intercept and mess with other application's network traffic would be an obvious security issue; that's far more likely to be the reason than some kind of vague "we want to track your data" thing. It's certainly possible that Apple could construct an appropriate API for allowing users to configure apps in such a fashion that they could monitor network traffic, much the same way as similar APIs exist for accessing e.g. photos. But since it's a niche application at best, I'm hardly surprised they haven't done so.
  - comex 9y ago
    Such an API already exists: the NetworkExtension APIs, specifically NEPacketTunnelProvider and NEAppProxyProvider. They're meant for VPNs, but it should be possible to use the same APIs to monitor traffic and send it on, rather than tunneling it through a VPN. (There is also NEFilterProvider, but that API is designed to run the filter in a tight sandbox that doesn't allow it any outbound communication, so that it can filter packets but not exfiltrate them.) …though if you're concerned about privacy, perhaps you should be using a real VPN anyway, in which case you could handle traffic monitoring and filtering on the server side. Edit: I guess the server-side approach wouldn't allow identifying on which app is making the connection. The NetworkExtension APIs, however, should allow that: you get a flow of NEPackets, each of which has a 'metadata' property containing a 'sourceAppUniqueIdentifier' and 'sourceAppSigningIdentifier'. I don't have personal experience using these APIs though.
  - staplers 9y ago
    Allowing applications to intercept and mess with other application's network traffic Look at your cellular data usage in "system services" .. Apple is already intercepting and sending home a lot of your information without your ability to stop it.
- djrogers 9y ago
  > Look at what they have done with turning off bluetooth and wifi from the Control Center.. It's really eye-opening to see how often Apple products ping home. Are you trying to imply that iOS devices ‘ping home’ when you disconnect from WiFi or Bluetooth? Or are you just complaining about the previous behavior (updated in 11.2 to be more obvious) that disconnected WiFi I stead of disabling it?
pvg 9y ago
Random iOS apps can't just pull all your secrets out of SE and send them off somewhere. That's what makes recent iOS devices a better place to put a secret than your typical Linux box. 'Not being able to get a hold of your secrets' is a much better line of defense than 'I think I can make it hard for something to exfiltrate my secrets that they've pilfered'. Especially since the latter is probably not really true.
- srcmap 9y ago
  Virtual Keyboard Developer Leaked 31M Client Records (mackeepersecurity.com) Apple is sharing your facial wireframe with apps (washingtonpost.com)
  - pvg 9y ago
    None of these are secrets stored in SE, which is what this entire thread is about
- nyolfen 9y ago
  >'Not being able to get a hold of your secrets' is a much better line of defense than 'I think I can make it hard for something to exfiltrate my secrets that they've pilfered'. Especially since the latter is probably not really true. reminds me of this: > Air-gapped networks are isolated, separated both logically and physically from public networks. Although the feasibility of invading such systems has been demonstrated in recent years, exfiltration of data from air-gapped networks is still a challenging task. In this paper we present GSMem, a malware that can exfiltrate data through an air-gap over cellular frequencies. Rogue software on an infected target computer modulates and transmits electromagnetic signals at cellular frequencies by invoking specific memory-related instructions and utilizing the multi-channel memory architecture to amplify the transmission. Furthermore, we show that the transmitted signals can be received and demodulated by a rootkit placed in the baseband firmware of a nearby cellular phone. We present crucial design issues such as signal generation and reception, data modulation, and transmission detection. We implement a prototype of GSMem consisting of a transmitter and a receiver and evaluate its performance and limitations. Our current results demonstrate its efficacy and feasibility, achieving an effective transmission distance of 1 - 5.5 meters with a standard mobile phone. When using a dedicated, yet affordable hardware receiver, the effective distance reached over 30 meters. https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-guri-update.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
comex 9y ago
Linking to my comment downthread in case you're using email notifications: https://news.ycombinator.com/item?id=15857589 https://news.ycombinator.com/item?id=15857589 It should be possible to write an app that does what you want; I'm not sure whether or not such apps already exist.

gdamjan1 9y ago

a yubikey can hold your private ssh key, and it can't be taken out of it