5 ms·

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that la

by ikeboy 7y ago

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

deleted 7y ago
[deleted]
jijji 7y ago
maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.
- deleted 7y ago
  [deleted]
- maxdamantus 7y ago
  I find this hard to believe given that security isn't about "having security", but about "not having buggy software". Unless you're a power user, you're probably mostly just using web applications at this point, so your main target points are the OS and the web browser. Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm install" instills a lot of trust on the NPM repository and any packages involved). All of these things increase the attack surface.
  - thenewnewguy 7y ago
    > Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm install" instills a lot of trust on the NPM repository and any packages involved). All of these things increase the attack surface. This is a fallacy. Rather than assessing the security of the linux kernel or linux distributions you're making taking an assumption about linux users and transferring the blame for their insecure practices onto linux itself. Think of it this way: If a random Windows user that didn't engage in such behavior was to switch to linux it's unlikely that would suddenly change. If the linux kernel and system programs are more secure than windows that make linux a good choice if that person cares about security. Note: I'm not making a statement about the security of linux/windows, just pointing out a flaw in the above argument.
    - maxdamantus 7y ago
      > Rather than assessing the security of the linux kernel or linux distributions you're making taking an assumption about linux users I was responding to that assumption made by the parent: > people who run laptops using linux probably have more security in the laptop than on their phone
  - jijji 7y ago
    The argument from the parent about using a laptop is "orders of magnitude" less safe than using a iOS or android device is just not true. It depends what you're running on each device.
    - maxdamantus 7y ago
      When you run any given application on your laptop, it's normally run in such a way that it has all of your user's priveleges on the system; that is, it can access all files that you can access, it can look at the screen that you're looking at, it can produce any input that you can produce, it can manipulate the memory of any process that you can manipulate. When you run an application on iOS or Android, it doesn't have those capabilities. It can only get them through security exploits. In theory it should be similar to looking at a web page. If a web page is able to read arbitrary files, that's obviously a bug in the system. If an application on your laptop is able to read arbitrary files, that's standard functionality.
      - bscphil 7y ago
        You're right that from a defense standpoint, sandboxed OSes like Android and iOS are "better" than your average laptop. Granted. The point I (and probably your parent comment) were originally trying to make is that the amount of data stored on a phone makes it a very good target for vulnerabilities like these. None of my banking, chat, email, etc information is stored on my laptop because I access these things through the browser. That's not to say that this provides perfect security, of course, but it means someone can't come in with a zero-day that gets root on my system and just one-off uploads all my databases. Apps that keep all this data locally, as is common on phones, are dangerous. Add the fact that most people have a phone as their two factor and you have a really bad situation when a phone is compromised. This, alone, makes phones an attractive target.
        pjmlp 7y ago
        Regular people keep copies of banking, chat, emails printouts on their "My Documents", even if they use Web applications instead of native ones for those services. Speaking of native applications, usually many regular users still use native native applications for email, chat, text processing, spreadsheets, etc. So while you specifically might take care of having a very clean $HOME, most people don't.
- pjmlp 7y ago
  Depends pretty much on what they are actually running. https://www.cvedetails.com/vendor/33/Linux.html https://www.cvedetails.com/vendor/33/Linux.html
bscphil 7y ago
I disagree. 2FA makes it profoundly more difficult to compromise an account. Most people are using a phone as a second factor, so even if the apps don't store files and credentials directly on the device (always in doubt, as seen here), if you have root on a phone you can compromise an account without any user interaction. What's more, every time you download a banking app on your phone, you have to place a little bit of trust in the competence of whoever the bank outsourced the programming job to. At least with a laptop, a poorly designed website site is not (by itself) a threat to everything on your computer or other sites you visit. Even when it comes to "more 0-days", I think you're probably missing the point. There's a lot more software written for computers that can be compromised than just the handful of programs that comprise iOS, so the raw count is not very meaningful. More practically, I'm willing to bet the odds my (Linux) laptop is compromised are far lower than my phone. I don't install apps I don't trust on my computer, but I have little choice but to on my phone.
- mlyle 7y ago
  > 2FA makes it profoundly more difficult to compromise an account. Just because the attacks are dumb. If your computer is pwned, it should wait for you to 2FA, and then when you "log out"-- don't, do malicious stuff instead.
  - lxgr 7y ago
    That's why 2FA should be performed at transaction confirmation time for sensitive operations, not just at login or periodically.
    - deleted 7y ago
      [deleted]
    - mlyle 7y ago
      Even then; substitute the transaction they want for another transaction. If the device you are using is compromised, you're in for a bad time. You could send some simple transaction summary to the other device to acknowledge, which is getting better. Even so that doesn't completely eliminate the opportunity for tomfoolery.

by ikeboy 7y ago

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

deleted 7y ago

[deleted]

jijji 7y ago

maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.

deleted 7y ago
[deleted]
maxdamantus 7y ago
I find this hard to believe given that security isn't about "having security", but about "not having buggy software". Unless you're a power user, you're probably mostly just using web applications at this point, so your main target points are the OS and the web browser. Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm install" instills a lot of trust on the NPM repository and any packages involved). All of these things increase the attack surface.
- thenewnewguy 7y ago
  > Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm install" instills a lot of trust on the NPM repository and any packages involved). All of these things increase the attack surface. This is a fallacy. Rather than assessing the security of the linux kernel or linux distributions you're making taking an assumption about linux users and transferring the blame for their insecure practices onto linux itself. Think of it this way: If a random Windows user that didn't engage in such behavior was to switch to linux it's unlikely that would suddenly change. If the linux kernel and system programs are more secure than windows that make linux a good choice if that person cares about security. Note: I'm not making a statement about the security of linux/windows, just pointing out a flaw in the above argument.
  - maxdamantus 7y ago
    > Rather than assessing the security of the linux kernel or linux distributions you're making taking an assumption about linux users I was responding to that assumption made by the parent: > people who run laptops using linux probably have more security in the laptop than on their phone
- jijji 7y ago
  The argument from the parent about using a laptop is "orders of magnitude" less safe than using a iOS or android device is just not true. It depends what you're running on each device.
  - maxdamantus 7y ago
    When you run any given application on your laptop, it's normally run in such a way that it has all of your user's priveleges on the system; that is, it can access all files that you can access, it can look at the screen that you're looking at, it can produce any input that you can produce, it can manipulate the memory of any process that you can manipulate. When you run an application on iOS or Android, it doesn't have those capabilities. It can only get them through security exploits. In theory it should be similar to looking at a web page. If a web page is able to read arbitrary files, that's obviously a bug in the system. If an application on your laptop is able to read arbitrary files, that's standard functionality.
    - bscphil 7y ago
      You're right that from a defense standpoint, sandboxed OSes like Android and iOS are "better" than your average laptop. Granted. The point I (and probably your parent comment) were originally trying to make is that the amount of data stored on a phone makes it a very good target for vulnerabilities like these. None of my banking, chat, email, etc information is stored on my laptop because I access these things through the browser. That's not to say that this provides perfect security, of course, but it means someone can't come in with a zero-day that gets root on my system and just one-off uploads all my databases. Apps that keep all this data locally, as is common on phones, are dangerous. Add the fact that most people have a phone as their two factor and you have a really bad situation when a phone is compromised. This, alone, makes phones an attractive target.
      - pjmlp 7y ago
        Regular people keep copies of banking, chat, emails printouts on their "My Documents", even if they use Web applications instead of native ones for those services. Speaking of native applications, usually many regular users still use native native applications for email, chat, text processing, spreadsheets, etc. So while you specifically might take care of having a very clean $HOME, most people don't.
pjmlp 7y ago
Depends pretty much on what they are actually running. https://www.cvedetails.com/vendor/33/Linux.html https://www.cvedetails.com/vendor/33/Linux.html

bscphil 7y ago

I disagree. 2FA makes it profoundly more difficult to compromise an account. Most people are using a phone as a second factor, so even if the apps don't store files and credentials directly on the device (always in doubt, as seen here), if you have root on a phone you can compromise an account without any user interaction. What's more, every time you download a banking app on your phone, you have to place a little bit of trust in the competence of whoever the bank outsourced the programming job to. At least with a laptop, a poorly designed website site is not (by itself) a threat to everything on your computer or other sites you visit. Even when it comes to "more 0-days", I think you're probably missing the point. There's a lot more software written for computers that can be compromised than just the handful of programs that comprise iOS, so the raw count is not very meaningful. More practically, I'm willing to bet the odds my (Linux) laptop is compromised are far lower than my phone. I don't install apps I don't trust on my computer, but I have little choice but to on my phone.

mlyle 7y ago
> 2FA makes it profoundly more difficult to compromise an account. Just because the attacks are dumb. If your computer is pwned, it should wait for you to 2FA, and then when you "log out"-- don't, do malicious stuff instead.
- lxgr 7y ago
  That's why 2FA should be performed at transaction confirmation time for sensitive operations, not just at login or periodically.
  - deleted 7y ago
    [deleted]
  - mlyle 7y ago
    Even then; substitute the transaction they want for another transaction. If the device you are using is compromised, you're in for a bad time. You could send some simple transaction summary to the other device to acknowledge, which is getting better. Even so that doesn't completely eliminate the opportunity for tomfoolery.