4 ms·

Last year (or maybe 2018?) my employer hired an external consultant to give engineers security trainings (all are optional, they provide a few sessions on diffe

Last year (or maybe 2018?) my employer hired an external consultant to give engineers security trainings (all are optional, they provide a few sessions on different topics, and engineers can sign up for interested ones). In one of the sessions I signed up, during the pre-session chat (while waiting for everyone signed up show up in the conference room), the external trainer "casually" chatted about "if you have an Android phone, you should throw it out of the window right now and buy an iPhone instead". That's the point I lost all my respect to them. (The session itself was ok-ish. It was some trainings about xsrf, nothing special either) (That incident also triggered me to purchase a sheet of [citation needed] stickers from xkcd to put on my laptop, so the next time this kind of thing happens I can just point to the sticker on my laptop. But I didn't got a chance to do that yet since received the stickers)

kohtatsu 6y ago
This was pretty true not long ago. It's still a notoriously short window for OEM software patches on Android, whereas Apple's first 64-bit phone, the 5s from Fall 2013 is still getting patches (May 20th was the last one, iOS 12.4.7) Apple pioneered usable security with TouchID and the secure enclave; a lot of Android fingerprint readers were gimmicks for years, same with the face unlocks. https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app... They also invest piles of money into privacy https://apple.com/privacy https://apple.com/privacy (1 minute overview), https://apple.com/privacy/features https://apple.com/privacy/features (in-depth with links to whitepapers). I imagine that's where your teacher was coming from.
- enitihas 6y ago
  Fortunately, it seems google has separated security updates from the OEM updates on some newer phones it seems. The phone I bought In November 2018, right now is receiving monthly security updates via Play Services updates, and is right now on the May version for some time.
  - saagarjha 6y ago
    > The phone I bought In November 2018 I think it’s too early to claim anything for that one.
- fishywang 6y ago
  Yes I'm not gonna defend Google's privacy issues, but privacy is totally different from security. People tend to confuse them. I understand it if it's average Joe got confused. But if you are a "security consultant" and you still have no idea what's the difference between them, then that's a big problem. Regarding security, see examples like https://qz.com/1844937/hong-kongs-mass-arrests-give-police-access-to-phones/ https://qz.com/1844937/hong-kongs-mass-arrests-give-police-a...
  - fishywang 6y ago
    For privacy, I guess you can have full confident that Apple has the intention to keep your data private. But do you have full confident that Apple has the competence to fulfill that intention? Google doesn't have the intention to keep all your data private, sure. They are an ads company after all. But for things they want to protect, in most cases they are competent enough to protect them. (Disclaimer: I also worked for Google, but the "employer" I mentioned in my original comment was not Google)
SV_BubbleTime 6y ago
It’s none of my concern what camp people fall into... but... I hired a very high level pen test company, they mandated iPhones for their company work. They were the best infosec company we’ve ever hired. Sample of one. I wouldn’t suggest iPhones are more safe than Android, but i also wouldn’t suggest in any way they are less safe overall.

kohtatsu 6y ago

This was pretty true not long ago. It's still a notoriously short window for OEM software patches on Android, whereas Apple's first 64-bit phone, the 5s from Fall 2013 is still getting patches (May 20th was the last one, iOS 12.4.7) Apple pioneered usable security with TouchID and the secure enclave; a lot of Android fingerprint readers were gimmicks for years, same with the face unlocks. https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app... They also invest piles of money into privacy https://apple.com/privacy https://apple.com/privacy (1 minute overview), https://apple.com/privacy/features https://apple.com/privacy/features (in-depth with links to whitepapers). I imagine that's where your teacher was coming from.

enitihas 6y ago
Fortunately, it seems google has separated security updates from the OEM updates on some newer phones it seems. The phone I bought In November 2018, right now is receiving monthly security updates via Play Services updates, and is right now on the May version for some time.
- saagarjha 6y ago
  > The phone I bought In November 2018 I think it’s too early to claim anything for that one.
fishywang 6y ago
Yes I'm not gonna defend Google's privacy issues, but privacy is totally different from security. People tend to confuse them. I understand it if it's average Joe got confused. But if you are a "security consultant" and you still have no idea what's the difference between them, then that's a big problem. Regarding security, see examples like https://qz.com/1844937/hong-kongs-mass-arrests-give-police-access-to-phones/ https://qz.com/1844937/hong-kongs-mass-arrests-give-police-a...
- fishywang 6y ago
  For privacy, I guess you can have full confident that Apple has the intention to keep your data private. But do you have full confident that Apple has the competence to fulfill that intention? Google doesn't have the intention to keep all your data private, sure. They are an ads company after all. But for things they want to protect, in most cases they are competent enough to protect them. (Disclaimer: I also worked for Google, but the "employer" I mentioned in my original comment was not Google)

SV_BubbleTime 6y ago

It’s none of my concern what camp people fall into... but... I hired a very high level pen test company, they mandated iPhones for their company work. They were the best infosec company we’ve ever hired. Sample of one. I wouldn’t suggest iPhones are more safe than Android, but i also wouldn’t suggest in any way they are less safe overall.