4 ms·

There is a myth in the infosec community that phones, because of their tendency to be 'always on' devices; that phones are more secure/private than a standard W

There is a myth in the infosec community that phones, because of their tendency to be 'always on' devices; that phones are more secure/private than a standard Windows desktop machine or even a macbook machine running OSX. This is a BS concept - Phones leak data all over the place and have a higher data exhaust than a desktop computer. Unless the phone is flashed with LineageOS[0], it will phone home data to Google nonstop and beacon out its presence to hackers 24/7. To make matters worse, there is a huge fragmentation problem with Android and some phones are disallowed from updating to the latest Android version. The same goes for iOS; a user can often be locked into using the same iOS version and cant upgrade to the latest version (a huge security hole) [0] https://www.lineageos.org/ https://www.lineageos.org/

bsamuels 7y ago
Apple still provides security fixes for phones as old as the iphone 5s, which was released almost 6 years ago. I don't think that's even remotely comparable to the fragmentation problems Android has where you're lucky to get even 2 years of security updates with some providers
- mrunseen 7y ago
  iPhone 5S and iPhone 6 will stuck on iOS 12 btw.
  - vxNsr 7y ago
    6 years is still twice as long as the original 3 year commitment apple made when the 5S came out and it's 6x as long as most android phones that were manufactured at that time.
jstarfish 7y ago
> There is a myth in the infosec community ... that phones are more secure/private than a standard Windows desktop machine This doesn't make sense on any level. What subset of the infosec community actually believes this? Teenagers hiding porn from their parents?
- crankylinuxuser 7y ago
  Windows spews to 30+ microsoft domains with pinned certs, so we can't MITM to see what's going on. Android spews to X Google domains with pinned certs, so we can't MITM to see what's going on. Apple is perceived to value security and privacy, due to prior postures and public statements that Apple doesnt work with terrori... FBI. But we only have their word. The only thing that doesn't spit and spew is a hardened install of Linux. All are terrible, except Linux. We know what it's doing.
- wmf 7y ago
  https://news.ycombinator.com/item?id=14241752 https://news.ycombinator.com/item?id=14241752 for example.
tinus_hn 7y ago
Phones can be more secure than a desktop because the user isn’t allowed to make decisions that are bad, such as installing untrusted software or allowing that software out of the sandbox. Using a specific Android like distribution is not a magic bullet and will not solve all your security problems.

bsamuels 7y ago

Apple still provides security fixes for phones as old as the iphone 5s, which was released almost 6 years ago. I don't think that's even remotely comparable to the fragmentation problems Android has where you're lucky to get even 2 years of security updates with some providers

mrunseen 7y ago
iPhone 5S and iPhone 6 will stuck on iOS 12 btw.
- vxNsr 7y ago
  6 years is still twice as long as the original 3 year commitment apple made when the 5S came out and it's 6x as long as most android phones that were manufactured at that time.

jstarfish 7y ago

> There is a myth in the infosec community ... that phones are more secure/private than a standard Windows desktop machine This doesn't make sense on any level. What subset of the infosec community actually believes this? Teenagers hiding porn from their parents?

crankylinuxuser 7y ago
Windows spews to 30+ microsoft domains with pinned certs, so we can't MITM to see what's going on. Android spews to X Google domains with pinned certs, so we can't MITM to see what's going on. Apple is perceived to value security and privacy, due to prior postures and public statements that Apple doesnt work with terrori... FBI. But we only have their word. The only thing that doesn't spit and spew is a hardened install of Linux. All are terrible, except Linux. We know what it's doing.
wmf 7y ago
https://news.ycombinator.com/item?id=14241752 https://news.ycombinator.com/item?id=14241752 for example.

tinus_hn 7y ago

Phones can be more secure than a desktop because the user isn’t allowed to make decisions that are bad, such as installing untrusted software or allowing that software out of the sandbox. Using a specific Android like distribution is not a magic bullet and will not solve all your security problems.