4 ms·

> But if it's not as secure as an iPhone, it's unethical to claim otherwise. This seems silly, you can easily flip this on its head and say "Well the iPhone is

by drb91 8y ago

> But if it's not as secure as an iPhone, it's unethical to claim otherwise. This seems silly, you can easily flip this on its head and say "Well the iPhone is closed, so there's no way to verify it has any security". You can't separate the ethics of security advertising from the ethics of everything else about how the device works.

deleted 8y ago
[deleted]
JoshCole 8y ago
You shouldn't flip things around, because there is observable evidence beyond source code. Not knowing everything about the world doesn't mean we know nothing.
- deleted 8y ago
  [deleted]
- mmirate 8y ago
  Not knowing everything means there could easily be some unknown element that renders our knowledge moot.
  - deleted 8y ago
    [deleted]
tptacek 8y ago
Closed source and unverifiable are more orthogonal than not.
- skullum 8y ago
  How can they be orthogonal when eventually you need open software of some kind to make a verification? If the software I use to verify the closed source software is closed, then I will need another piece of software to verify that the verify-ing software is what it says it is and so on until we reach a piece of software that I can verify with my own eyes (or a friend has verified with their eyes). We all eventually have to place our trust somewhere but we shouldn't have to agree with where you decided to trust.
  - tptacek 8y ago
    You don't need open software of any kind to verify it.
    - adiusmus 8y ago
      It sure helps though. And being able to compare source code to binary is good for checking blobs. No one knows what nasties are hidden in these blobs that run on EVERY phone out there. I’d actually go as far as saying cell phone processing modules are completely insecure. Unlikely to receive updates. Poorly documented. Security standards are likely to be weakly implemented with gaping holes. As for proof, I’d point at the lack of source code as a starting point. Open source doesn’t guarantee security but it at least lets interested parties try to the degree they want or need to.
      - pvg 8y ago
        As for proof, I’d point at the lack of source code as a starting point. Much better proof would be frequent exploits through the vectors you consider examples glaring insecurity.
        adiusmus 8y ago
        Sure. Go and have a look at GSM and friends. I’d say the cellular network in general is routinely being manipulated. The protocols and standards for over-the-air are demonstrably insecure and assuming the actual hardware is also insecure is reasonable as well.
        pvg 8y ago
        Part of the point of this thread is that 'modern flagship phones' are designed with problems like that in mind. You're the one claiming to have 'proof' they are trivially insecure.
        adiusmus 8y ago
- drb91 8y ago
  I agree--after all, security is generally unverifiable anyway, even with perfect visibility. However, in the context of ethical security conversations, the two are anything but orthogonal. The security expectations of someone buying an open phone, and the security expectations of someone buying "private" access into a proprietary platform, will be different. Sure, my baseband could be compromised, but if I'm more worried about leaking information to ad networks, what I really need is a firewall and hosts file, not an isolated baseband unit. If we're talking about an ethical security conversation, maybe we should mention the fact that this is the security Apple has to control what code runs on your phone, not the security a user has to control the flow of their data. Though, presumably you can have both goals, Apple shows interest only in the former. My point being the two phones are extremely different products, especially regarding ethics, so the straightforward comparison and verdict struck me as extremely narrow-minded about how people use their phones.
  - tptacek 8y ago
    I don't understand the hand-waving here. Does the phone have a comparably secure design to that of an iPhone or not? What other question is there to ask about the security of the phone? I bring it up because the project makes a very big deal out of how much security their ethical approach adds. From what I can tell, their approach nets them materially less security than either flagship phone.
    - kodablah 8y ago
      > I don't understand the hand-waving here. Does the phone have a comparably secure design to that of an iPhone or not? To understand means to see beyond security design to see security principles. If one company magically decides to move your data to a government controlled cloud without any public discussion around why or if they even agree with it, the design is not going to matter. When the next internal decision occurs negatively affecting security in some undiscussed opaque way, you won't be able to point to security audits to explain the folly of human traits.
    - drb91 8y ago
      Sure, it can be compared, but it’s not a one-dimensional comparison to my eyes—you’d have to pick a dimension of security to compare to get a proper ordering. For instance in this case it seems like the iPhone has (considerably) more hardened hardware for many scenarios where you lose control of your phone. That’s not the only sense of security people care about. From the perspective of securing the phone from doing unwanted things without your permission, you have to trust Apple entirely to make the right decision. If you don’t trust Apple to make these decisions, the phone does not reflect a secure interaction.
namedlambda 8y ago
You can observe it though, iphone's jailbreak community is most of the time 2 and at best 1 patch behind iOS.
- dingaling 8y ago
  The fact that there is still the potential for jailbreaks in iOS surprises me and doesn't seem to help the secure-by-default argument. Why is a trillion-dollar company which designs their own silicon only two steps ahead of some hackers? Instead of $200 billion in the bank, unspent, shouldn't those devices be reviewed and redesigned until impregnable? Computing devices are usually insecure due to limits on experience, time and cost. None of those applies to Apple in any meaningful manner. Personally I'll just stick with cheap Android phones running custom ROMs and treat them as insecure, disposable terminals.
  - pcwalton 8y ago
    > Instead of $200 billion in the bank, unspent, shouldn't those devices be reviewed and redesigned until impregnable? The problem is the Mythical Man-Month. Apple's devices are built on a mountain of ancient C code. XNU is a bizarre Mach/BSD hybrid, built for the sake of expedience. (This is not to bash Apple; most other devices aren't much better.) Apple has been working to improve the situation, but there's a limit as to how rapidly all those millions of lines of code can be changed.
  - namedlambda 8y ago
    So long there is a hardware input source (usb) it's impossible to guarantee security, this is the reality. There is not a single device with an input source such as USB that is secure. Physical access guarantees lack of security. Also, it's not some hackers. There's quite a big community out there looking for bugs and every time, such 'hacking' requires unlocked phone.

by drb91 8y ago

deleted 8y ago

[deleted]

JoshCole 8y ago

You shouldn't flip things around, because there is observable evidence beyond source code. Not knowing everything about the world doesn't mean we know nothing.

deleted 8y ago
[deleted]
mmirate 8y ago
Not knowing everything means there could easily be some unknown element that renders our knowledge moot.
- deleted 8y ago
  [deleted]

tptacek 8y ago

Closed source and unverifiable are more orthogonal than not.

skullum 8y ago
How can they be orthogonal when eventually you need open software of some kind to make a verification? If the software I use to verify the closed source software is closed, then I will need another piece of software to verify that the verify-ing software is what it says it is and so on until we reach a piece of software that I can verify with my own eyes (or a friend has verified with their eyes). We all eventually have to place our trust somewhere but we shouldn't have to agree with where you decided to trust.
- tptacek 8y ago
  You don't need open software of any kind to verify it.
  - adiusmus 8y ago
    It sure helps though. And being able to compare source code to binary is good for checking blobs. No one knows what nasties are hidden in these blobs that run on EVERY phone out there. I’d actually go as far as saying cell phone processing modules are completely insecure. Unlikely to receive updates. Poorly documented. Security standards are likely to be weakly implemented with gaping holes. As for proof, I’d point at the lack of source code as a starting point. Open source doesn’t guarantee security but it at least lets interested parties try to the degree they want or need to.
    - pvg 8y ago
      As for proof, I’d point at the lack of source code as a starting point. Much better proof would be frequent exploits through the vectors you consider examples glaring insecurity.
      - adiusmus 8y ago
        Sure. Go and have a look at GSM and friends. I’d say the cellular network in general is routinely being manipulated. The protocols and standards for over-the-air are demonstrably insecure and assuming the actual hardware is also insecure is reasonable as well.
        pvg 8y ago
        Part of the point of this thread is that 'modern flagship phones' are designed with problems like that in mind. You're the one claiming to have 'proof' they are trivially insecure.
        adiusmus 8y ago
drb91 8y ago
I agree--after all, security is generally unverifiable anyway, even with perfect visibility. However, in the context of ethical security conversations, the two are anything but orthogonal. The security expectations of someone buying an open phone, and the security expectations of someone buying "private" access into a proprietary platform, will be different. Sure, my baseband could be compromised, but if I'm more worried about leaking information to ad networks, what I really need is a firewall and hosts file, not an isolated baseband unit. If we're talking about an ethical security conversation, maybe we should mention the fact that this is the security Apple has to control what code runs on your phone, not the security a user has to control the flow of their data. Though, presumably you can have both goals, Apple shows interest only in the former. My point being the two phones are extremely different products, especially regarding ethics, so the straightforward comparison and verdict struck me as extremely narrow-minded about how people use their phones.
- tptacek 8y ago
  I don't understand the hand-waving here. Does the phone have a comparably secure design to that of an iPhone or not? What other question is there to ask about the security of the phone? I bring it up because the project makes a very big deal out of how much security their ethical approach adds. From what I can tell, their approach nets them materially less security than either flagship phone.
  - kodablah 8y ago
    > I don't understand the hand-waving here. Does the phone have a comparably secure design to that of an iPhone or not? To understand means to see beyond security design to see security principles. If one company magically decides to move your data to a government controlled cloud without any public discussion around why or if they even agree with it, the design is not going to matter. When the next internal decision occurs negatively affecting security in some undiscussed opaque way, you won't be able to point to security audits to explain the folly of human traits.
  - drb91 8y ago
    Sure, it can be compared, but it’s not a one-dimensional comparison to my eyes—you’d have to pick a dimension of security to compare to get a proper ordering. For instance in this case it seems like the iPhone has (considerably) more hardened hardware for many scenarios where you lose control of your phone. That’s not the only sense of security people care about. From the perspective of securing the phone from doing unwanted things without your permission, you have to trust Apple entirely to make the right decision. If you don’t trust Apple to make these decisions, the phone does not reflect a secure interaction.

namedlambda 8y ago

You can observe it though, iphone's jailbreak community is most of the time 2 and at best 1 patch behind iOS.

dingaling 8y ago
The fact that there is still the potential for jailbreaks in iOS surprises me and doesn't seem to help the secure-by-default argument. Why is a trillion-dollar company which designs their own silicon only two steps ahead of some hackers? Instead of $200 billion in the bank, unspent, shouldn't those devices be reviewed and redesigned until impregnable? Computing devices are usually insecure due to limits on experience, time and cost. None of those applies to Apple in any meaningful manner. Personally I'll just stick with cheap Android phones running custom ROMs and treat them as insecure, disposable terminals.
- pcwalton 8y ago
  > Instead of $200 billion in the bank, unspent, shouldn't those devices be reviewed and redesigned until impregnable? The problem is the Mythical Man-Month. Apple's devices are built on a mountain of ancient C code. XNU is a bizarre Mach/BSD hybrid, built for the sake of expedience. (This is not to bash Apple; most other devices aren't much better.) Apple has been working to improve the situation, but there's a limit as to how rapidly all those millions of lines of code can be changed.
- namedlambda 8y ago
  So long there is a hardware input source (usb) it's impossible to guarantee security, this is the reality. There is not a single device with an input source such as USB that is secure. Physical access guarantees lack of security. Also, it's not some hackers. There's quite a big community out there looking for bugs and every time, such 'hacking' requires unlocked phone.