7 ms·

Security and privacy are two big parts of the marketing for the iPhone. I'm curious how they can mitigate the reputational damage. Edit: It gets worse: http

by Jonnax 8y ago

Security and privacy are two big parts of the marketing for the iPhone. I'm curious how they can mitigate the reputational damage. Edit: It gets worse: https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug-iphone-eavesdrop-listen-in-remote-call-security-issue https://www.theverge.com/2019/1/28/18201383/apple-facetime-b... If the recipient rejects the call by pressing the power button, it starts sending video.

akerl_ 8y ago
Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person. Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung’s phones literally caught fire and they’re still selling phones just fine.
- giancarlostoro 8y ago
  > Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!
  - akerl_ 8y ago
    I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.
    - deleted 8y ago
      [deleted]
    - nkozyra 8y ago
      > Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm sure Apple "worries" about any bug and its potential impact on its reputation, particularly in the area of privacy, where it has a leg up on Android at least in perception. That said, what historical bug is up to this one for iOS? This is a big deal and I cannot recall anything similar. edit 1: this hasn't exactly been a banner couple of months for iPhone. You'd expect that mitigating any negative news about the device would be paramount edit 2: look to Facebook. I find it encouraging that people have reacted so negatively to a company acting so cavalier with their personal data and privacy. Yes, I think Apple cares, moreso than with other bugs.
      - akerl_ 8y ago
        https://www.zdnet.com/article/ios-mac-flaw-exposes-your-password-with-one-image-file/ https://www.zdnet.com/article/ios-mac-flaw-exposes-your-pass... Where sending somebody a .tiff file via iMessage, web page, or email would give the attacker RCE on the device.
        saagarjha 8y ago
        The article slug is misleading, and suggests a fundamental misunderstanding of the scope of the bug. A RCE in Messages does not allow attackers to steal your passwords.
        akerl_ 8y ago
        The ask from the comment I’m responding to was for comparable vulnerabilities to this one, since this comment thread is discussing reputational damage from high-sev vulnerabilities. This vuln gives RCE in iMessage, which is an app that has microphone/camera access, so I’d say it’s clearly comparable.
- manigandham 8y ago
  Surely you understand that different bugs create vastly different problems? Audio and video leaking without knowledge from such a personal device that people take with them everywhere is about as bad as it gets in terms of privacy breach.
  - danso 8y ago
    It’s also the kind of bug and impact that is very easy for the layperson to understand, even without sensationalist write ups.
- deleted 8y ago
  [deleted]
- paxys 8y ago
  Well this is the top Twitter trend right now, for starters. It's a very visible, very easy to reproduce bug in a very popular service, and it's definitely going to hurt their reputation with consumers more than if it was something more technical yet equally or more dangerous.
  - akerl_ 8y ago
    Again, are there examples that show it will “definitely” hurt their reputation at all? I’ll broaden my example set: are there any examples of consumer devices where the company suffered clear damage to their brand as a result of a security issue?
    - freehunter 8y ago
      As an information security professional I wish security breaches would permanently damage a company's reputation, and even put some companies out of business if the breach demonstrates they have no business handling sensitive personal information. But if that was the case, Target and Home Depot and Equifax wouldn't exist, and no one would dare touch an Android phone or a Windows computer. The sad fact is consumers don't care one bit. The only people who care are people who have some interest in disliking the company who was breached, in which case they're likely not paying customers anyway.
      - Chris_Chambers 8y ago
        Caring about an issue isn’t the same as having the power to do anything about it.
leephillips 8y ago
Apple has shipped versions of its Mail program that delete email without warning¹ and versions of the Finder or OS X that delete² files. And much more. Yet their reputation is intact: the masses still believe that they put out quality software. They are truly the Teflon corporation. ¹http://discussions.apple.com/thread.jspa?messageID=12758081&tstart=0 http://discussions.apple.com/thread.jspa?messageID=12758081&... ²http://tomkarpik.com/articles/massive-data-loss-bug-in-leopard http://tomkarpik.com/articles/massive-data-loss-bug-in-leopa...
- saagarjha 8y ago
  Neither of your links seem to work, and the second one in particular seemed to have been dead for what seems like half a decade. Have you just kept these links around to whip out in support of this argument, without checking once whether they actually go somewhere?
  - leephillips 8y ago
    Thank you for informing me of the dead links, for which I apologize. Apparently Apple is also a poor net citizen, allowing its URLs to rot. Yes, I keep notes about things, some of which contain links. Obviously, these links used to work.
- mulmen 8y ago
  Not to defend Apple but I'm not sure there are higher quality options really. I don't think Apple makes good software but it can be the best without being good.
_bxg1 8y ago
As someone who bought an iPhone specifically for privacy reasons, I'm not really upset about this. What I'm concerned about is passive, mass-scale corporate surveillance, not a one-off bug that allows an individual with mal-intent to listen through my microphone for a few seconds and also let me know about it.
- oil25 8y ago
  Are you able to root an iPhone or use one without signing in with an Apple account (that's tied to a credit card, etc)? If not, then I believe the devices are still very much part of a mass-scale corporate surveillance network.
  - deleted 8y ago
    [deleted]
  - hackmiester 8y ago
    Yes, you can use an iPhone without signing into any account.
    - neuronic 8y ago
      It's incredible to me that people to this day are trying to make Apple look as bad as Google when all it takes is a look at the business models...
    - oil25 8y ago
      Well, that's a plain and simple lie, since you can't download apps from the App Store without an Apple account, nor do I believe you can install software updates.
      - hackmiester 8y ago
        I haven't tried in a while, but last I checked, updates worked fine. It's not necessary to download apps from the App Store to use an iPhone. I'm not sure what was the need for you to call me a liar. If anything I've said is inaccurate, I guess it has changed in the last few months, and I would love to know that.
yalogin 8y ago
Come on this is an overreaction. It’s a bug plain and simple. A bad one for sure but still Apple disabled the feature (allegedly) while they push a fix out. Shit happens.
rootusrootus 8y ago
For me, reputational damage would be having a bug that allowed a phone to be compromised via text message and then not sending any kind of fix for months, or years. Oh wait. If Apple fixes this bug this week, I will consider it a significant bug with a good response, and move on. If I wanted more privacy, what would I switch to anyway? Android? Ha!

by Jonnax 8y ago

akerl_ 8y ago

Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person. Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung’s phones literally caught fire and they’re still selling phones just fine.

giancarlostoro 8y ago
> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior? Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!
- akerl_ 8y ago
  I feel like you're answering a different question that I asked. I don't think the bug is low-severity. I'm asking: Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.
  - deleted 8y ago
    [deleted]
  - nkozyra 8y ago
    > Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug? I'm sure Apple "worries" about any bug and its potential impact on its reputation, particularly in the area of privacy, where it has a leg up on Android at least in perception. That said, what historical bug is up to this one for iOS? This is a big deal and I cannot recall anything similar. edit 1: this hasn't exactly been a banner couple of months for iPhone. You'd expect that mitigating any negative news about the device would be paramount edit 2: look to Facebook. I find it encouraging that people have reacted so negatively to a company acting so cavalier with their personal data and privacy. Yes, I think Apple cares, moreso than with other bugs.
    - akerl_ 8y ago
      https://www.zdnet.com/article/ios-mac-flaw-exposes-your-password-with-one-image-file/ https://www.zdnet.com/article/ios-mac-flaw-exposes-your-pass... Where sending somebody a .tiff file via iMessage, web page, or email would give the attacker RCE on the device.
      - saagarjha 8y ago
        The article slug is misleading, and suggests a fundamental misunderstanding of the scope of the bug. A RCE in Messages does not allow attackers to steal your passwords.
        akerl_ 8y ago
        The ask from the comment I’m responding to was for comparable vulnerabilities to this one, since this comment thread is discussing reputational damage from high-sev vulnerabilities. This vuln gives RCE in iMessage, which is an app that has microphone/camera access, so I’d say it’s clearly comparable.
manigandham 8y ago
Surely you understand that different bugs create vastly different problems? Audio and video leaking without knowledge from such a personal device that people take with them everywhere is about as bad as it gets in terms of privacy breach.
- danso 8y ago
  It’s also the kind of bug and impact that is very easy for the layperson to understand, even without sensationalist write ups.
deleted 8y ago
[deleted]
paxys 8y ago
Well this is the top Twitter trend right now, for starters. It's a very visible, very easy to reproduce bug in a very popular service, and it's definitely going to hurt their reputation with consumers more than if it was something more technical yet equally or more dangerous.
- akerl_ 8y ago
  Again, are there examples that show it will “definitely” hurt their reputation at all? I’ll broaden my example set: are there any examples of consumer devices where the company suffered clear damage to their brand as a result of a security issue?
  - freehunter 8y ago
    As an information security professional I wish security breaches would permanently damage a company's reputation, and even put some companies out of business if the breach demonstrates they have no business handling sensitive personal information. But if that was the case, Target and Home Depot and Equifax wouldn't exist, and no one would dare touch an Android phone or a Windows computer. The sad fact is consumers don't care one bit. The only people who care are people who have some interest in disliking the company who was breached, in which case they're likely not paying customers anyway.
    - Chris_Chambers 8y ago
      Caring about an issue isn’t the same as having the power to do anything about it.

leephillips 8y ago

Apple has shipped versions of its Mail program that delete email without warning¹ and versions of the Finder or OS X that delete² files. And much more. Yet their reputation is intact: the masses still believe that they put out quality software. They are truly the Teflon corporation. ¹http://discussions.apple.com/thread.jspa?messageID=12758081&tstart=0 http://discussions.apple.com/thread.jspa?messageID=12758081&... ²http://tomkarpik.com/articles/massive-data-loss-bug-in-leopard http://tomkarpik.com/articles/massive-data-loss-bug-in-leopa...

saagarjha 8y ago
Neither of your links seem to work, and the second one in particular seemed to have been dead for what seems like half a decade. Have you just kept these links around to whip out in support of this argument, without checking once whether they actually go somewhere?
- leephillips 8y ago
  Thank you for informing me of the dead links, for which I apologize. Apparently Apple is also a poor net citizen, allowing its URLs to rot. Yes, I keep notes about things, some of which contain links. Obviously, these links used to work.
mulmen 8y ago
Not to defend Apple but I'm not sure there are higher quality options really. I don't think Apple makes good software but it can be the best without being good.

_bxg1 8y ago

As someone who bought an iPhone specifically for privacy reasons, I'm not really upset about this. What I'm concerned about is passive, mass-scale corporate surveillance, not a one-off bug that allows an individual with mal-intent to listen through my microphone for a few seconds and also let me know about it.

oil25 8y ago
Are you able to root an iPhone or use one without signing in with an Apple account (that's tied to a credit card, etc)? If not, then I believe the devices are still very much part of a mass-scale corporate surveillance network.
- deleted 8y ago
  [deleted]
- hackmiester 8y ago
  Yes, you can use an iPhone without signing into any account.
  - neuronic 8y ago
    It's incredible to me that people to this day are trying to make Apple look as bad as Google when all it takes is a look at the business models...
  - oil25 8y ago
    Well, that's a plain and simple lie, since you can't download apps from the App Store without an Apple account, nor do I believe you can install software updates.
    - hackmiester 8y ago
      I haven't tried in a while, but last I checked, updates worked fine. It's not necessary to download apps from the App Store to use an iPhone. I'm not sure what was the need for you to call me a liar. If anything I've said is inaccurate, I guess it has changed in the last few months, and I would love to know that.

yalogin 8y ago

Come on this is an overreaction. It’s a bug plain and simple. A bad one for sure but still Apple disabled the feature (allegedly) while they push a fix out. Shit happens.

rootusrootus 8y ago

For me, reputational damage would be having a bug that allowed a phone to be compromised via text message and then not sending any kind of fix for months, or years. Oh wait. If Apple fixes this bug this week, I will consider it a significant bug with a good response, and move on. If I wanted more privacy, what would I switch to anyway? Android? Ha!