14 ms·

Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?

by petra 6y ago

tempfs 6y ago
Apple's entire business model is based on appearances. To be fair so is Microsoft's and many others. Security is usually the last priority for nearly every for profit entity because it doesn't drive revenue.
- etaioinshrdlu 6y ago
  Apple puts rather extreme security effort into preventing iOS jailbreaks. They are pretty serious about trying to prevent data exfiltration from locked iOS devices as well. They aren’t perfect but I don’t think it’s fair to say they don’t try.
  - viraptor 6y ago
    I wouldn't call it extreme when there was a known public website allowing one-click jailbreak for good few months (not sure if it was actually ever patched or just the iOS version got eol)
    - ghughes 6y ago
      10 years ago, yeah. https://en.m.wikipedia.org/wiki/JailbreakMe https://en.m.wikipedia.org/wiki/JailbreakMe
      - Wowfunhappy 6y ago
        Actually, Safari has been used for exploits much more recently than that! https://totally-not.spyware.lol/ https://totally-not.spyware.lol/ (iOS 10, 2018)
    - _underfl0w_ 6y ago
      They then hired the guy creating those exploit chains.
    - nemothekid 6y ago
      It's unsurprising that the main vector for iOS jailbreaks would be through the web engine. The FreeBSD-based PlayStation 4 was also jailbroken via it's browser. If you have written a hardened, safe browser engine then you are free to share it to the world, otherwise I wouldn't downplay their efforts.
      - ndqc 6y ago
        Chrome/Chromium has a better track record and it is shared with the world. The number of Safari-based iOS exploits found in the wild is embarrassing. Not OP, but I'll stop complaining when Apple lets me use other browser engines.
    - Hnrobert42 6y ago
      What would be an acceptable response from Apple?
  - boogies 6y ago
    > Apple puts rather extreme security effort into preventing iOS jailbreaks. Yes, IMO their business model is more accurately described as “gilded cages/jails” than just general “gilded/good-appearing stuff”. They deeply care about the strength of their DRM — including at the expense of end-user security, eg. you can’t access the internet through the Tor browser installed the normal macOS way without macOS broadcasting that you used Tor Project products to Apple’s DRM servers.¹ > They are pretty serious about trying to prevent data exfiltration from locked iOS devices as well. They definitely care about the appearance of trying to prevent that exfiltrating (they don’t publicly appear to help the FBI do it), but they don’t try hard enough to actually prevent it (including in situations were preventing exfiltration seems to have been proven possible, see nearby comment https://news.ycombinator.com/item?id=26667141 https://news.ycombinator.com/item?id=26667141). ¹Edit: ocsp.apple.com, enabling targeting of the people who need or want security the most. To the people downvoting: I’m trying to make an evidence based refutation of the less supported speculation/assertions in the parent post. If you have counter-evidence or any reason to downvote other than fanboyism, please explain it so we or I can learn.
    - Hnrobert42 6y ago
      You don’t provide much evidence. Your second point is just opinion, “they don’t try hard enough.” Your first point is intended to refute the effort put into stopping jailbreaking in iOS. The example you give is about privacy on Mac OS. Last, accusing folks of being fanboys is a particularly weak argument. It says, if you don’t agree with me then your blind allegiance to a corporation renders you incapable of critical thought. Basically, if you don’t agree with me, you’re dumb. There is no practical engagement with that thesis.
  - deleted 6y ago
    [deleted]
- willio58 6y ago
  Security drives profit if it is marketed well. Apple does this. Think about even their branding for certain things, e.g. “Secure Enclave”.
rogerbinns 6y ago
A big difference is that the software running on Apple devices is less complex. For example there is significantly less hardware support. iMessage only talks to other iMessage instances (eg no browser support). There is only one web browser engine. Third party apps can't do JIT code generation. Older APIs are actively removed, breaking existing apps (vs providing backwards compatibility). In general less complexity is better, but it also constrains things. For example it took until recently for third party iOS to be able to do NFC. Android had it since ~2012.
- wunderflix 6y ago
  > Android had it since ~2012. I seriously wonder: what difference did it make? Was there any groundbreaking thing iOS users missed for 8 years? Apple is just great in omitting things and keeping focus to deliver a great product and then expand on that basis. Most famous example: First iPhones didn’t have MMS
  - musicale 6y ago
    > First iPhones didn’t have MMS Or cut and paste. ;-)
  - toxik 6y ago
    MMS is whack though
    - cromka 6y ago
      I am guessing they already knew GPRS/UMTS and data plans were the future, hence they invested in iMessage. MMS already had an expiration date. Quite sure they only added it because of the PR disaster it had become.
      - tuwtuwtuwtuw 6y ago
        I often use MMS. Whats the expiration date?
      - 6y ago
viraptor 6y ago
I like the way (I think) the grugq described it: out of the box iPhones are great with security, but Android allows you to build / get better yourself. See the copperhead project for example https://copperhead.co/android/ https://copperhead.co/android/
als0 6y ago
As far as what is feasible, Apple does a very good job with their iPhone/iPad security. With both hardware and software. You can read about it how it all works in their platform security guide. On the Android side, Google makes good software changes to Android, but ultimately the security is dependent on the handset maker (e.g. Samsung) and SoC maker (e.g. Qualcomm). Security will vary between Android phones. The bigger Android phone makers are more able to make security investments than the cheaper phone makers.
- deleted 6y ago
  [deleted]
2OEH8eoCRo0 6y ago
>While the police managed to crack into Wong’s iPhone, which was locked with a four-digit passcode, they did not manage to access the contents of Chow’s Google Pixel phone using the force’s existing digital forensics tools, according to the court filing. Chow says her phone is still in police possession. https://qz.com/1844937/hong-kongs-mass-arrests-give-police-access-to-phones/ https://qz.com/1844937/hong-kongs-mass-arrests-give-police-a...
- deleted 6y ago
  [deleted]
- pilsetnieks 6y ago
  There is literally no other detail than the phone model name. For all we know it could be an ancient iPhone with a severely outdated OS and a brand new Pixel phone. 4-digit passcode hasn't been the default passcode option in iOS for a long time.
  - 2OEH8eoCRo0 6y ago
    https://www.tomsguide.com/news/police-say-android-phones-are-harder-to-crack-than-iphones https://www.tomsguide.com/news/police-say-android-phones-are... >This is supported by a look at smartphone cracking company Cellebrite’s effectiveness at breaking into different phones. Cellebrite can easily open up any iPhone X or earlier iPhone, but the same software used on a Google Pixel 2 or Galaxy S9 extracts very little information, and nothing at all in the case of the Huawei P20 Pro. >That’s not to say that these Android devices are unbreakable. It's just that it requires a different, more labor-intensive process to get the data requested. >The sheer variety of Android hardware and customized software builds makes it hard for phone-crackers to build a universal tool to break into Android phones. Meanwhile, a "jailbreak" released late last year permanently bypasses the security functions of every iPhone model from the iPhone 4s to the iPhone X. This perfectly squares with what I personally know from law enforcement friends but I'm just an internet stranger.
    - pilsetnieks 6y ago
codemac 6y ago
If you turn on iCloud, it's theater. Android with syncing enabled does much better in real world tests. Notably in hong kong, they were able to crack the iPhones, but not the Pixels[0] I'm pretty sure without iCloud and a long enough password (or fast enough self destruct mode) iPhones could be as secure, but I don't know anyone that uses an iPhone and does not use iCloud in any way. [0]: https://qz.com/1844937/hong-kongs-mass-arrests-give-police-access-to-phones/ https://qz.com/1844937/hong-kongs-mass-arrests-give-police-a...
- rnikander 6y ago
  What part of iCloud is the problem?
  - codemac 6y ago
    The part where it backs up all your messages without using a device specific key. The only things end to end encrypted are listed on this page: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 If you turn on iCloud syncing, basically you're falling back to simple "in transit" and "at rest" encryption. A lot of iPhone cracks involve just attacking your iCloud account, and then reading all of your messages from backups. This is not possible on Pixel which encrypt your device backups with on-device hardware encryption.
    - gumby 6y ago
      > Pixel which encrypt your device backups with on-device hardware encryption. Can you set up a new android phone from an old phone’s backup? If so, how could this work? This is a standard way to set up a new iPhone: “restore” from a backup of your previous phone. Especially handy when your old phone is no longer available (lost/broken)
      - glennpratt 6y ago
        Yes, decryption requires the original device's unlock PIN/pattern/password: https://security.googleblog.com/2018/10/google-and-android-have-your-back-by.html?m=1 https://security.googleblog.com/2018/10/google-and-android-h... Not that I fully understand how hard it is to circumvent.
Veserv 6y ago
The difficulty is so low that it does not really matter. If you go by their bug bounties [1][2], then it is only $1M to full remote zero-click persistent compromise in both systems. If you go by Zerodium, which is a 3rd party purchaser and thus establishes a third party commercial market price, [3] then it is only $2M for iOS and $2.5M for Android. If we were to divide that price for an iPhone exploit by the number of iPhones sold in a year [4], then that is a mere 1 cent per iPhone. As you can see, the price is so low it hardly even matters if there is a difference. There are literally millions of people in the US alone who personally have the liquid net worth to purchase a remote wormable persistent compromise that you can use to mass infect any Android or iPhone. Essentially every business with more than maybe 10 employees has enough assets to purchase such a weapon on the market. Just today I read on HN that the US government inked a deal for $22B over 10 years for 120k AR headsets from Microsoft [5] which comes out to ~$183k/headset. So, a weapon you can use to fully compromise any phone you want is equal in cost to a mere 15(!) headsets. That contract alone would be enough to purchase 10,000(!) vulnerabilities at existing clearing prices and $22B is only ~1/200th of the yearly US government budget. Frankly, the entire thing is like two people jumping and comparing who is closer to landing on the moon. [1] https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/ [2] https://developer.apple.com/security-bounty/ https://developer.apple.com/security-bounty/ [3] https://zerodium.com/program.html https://zerodium.com/program.html See Mobiles payout. [4] https://www.statista.com/statistics/276306/global-apple-iphone-sales-since-fiscal-year-2007/#:~:text=In%20their%202018%20fiscal%20year,stayed%20relatively%20stable%20since%20then https://www.statista.com/statistics/276306/global-apple-ipho.... [5] https://techcrunch.com/2021/03/31/microsoft-wins-contract-worth-up-to-22-billion-to-outfit-u-s-army-with-120000-ar-headsets/ https://techcrunch.com/2021/03/31/microsoft-wins-contract-wo...
smoldesu 6y ago
From what I've seen, the majority of it is theater. Does that mean it's more secure than Android devices? Not necessarily. In any case, the biggest vulnerability in any system is the end user. No amount of idiot-proofing will stop people from being scammed on an iPhone, nor will it stop someone on Android. When these companies market their "Secure Enclave" or "Titan Security", they're really just dressing up otherwise expected or boring features. The T2 chip was basically a dedicated PRNG chip with basic encoding capabilities, yet Apple paraded it as a boon for device security and game-changer for the end user. In reality, it doesn't solve any practical issues with computer security. I've tried about every OS on the planet, and I've used them on a decent handful of different devices. I won't tell you what to think or do, but Apple's devices are difficult to appraise and hurt my head when I try to consider their impact on my overall "security". I'd much rather just use a Linux system that's transparent about it's vulnerabilities. Much of that same reasoning is why I still use Android these days.
- villgax 6y ago
  And your point being that Android gets more updates/fixes than Apple? Lol, only Apple has a proven track record of providing 5 year old devices with updates/fixes unlike anything from Android, unless you are comfortable flashing your own builds.
  - smoldesu 6y ago
    No, I specifically said in my original post, "Does that mean it's more secure than Android devices? Not necessarily." My ultimate point is that the biggest liability is the user, and those "security updates" don't really matter when the biggest attack vectors don't even consider these exploits in the first place.
- saagarjha 6y ago
  > The T2 chip was basically a dedicated PRNG chip with basic encoding capabilities This is an extremely misleading description of the scope of T2’s duties.

Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?

by petra 6y ago

Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?

tempfs 6y ago

Apple's entire business model is based on appearances. To be fair so is Microsoft's and many others. Security is usually the last priority for nearly every for profit entity because it doesn't drive revenue.

etaioinshrdlu 6y ago
Apple puts rather extreme security effort into preventing iOS jailbreaks. They are pretty serious about trying to prevent data exfiltration from locked iOS devices as well. They aren’t perfect but I don’t think it’s fair to say they don’t try.
- viraptor 6y ago
  I wouldn't call it extreme when there was a known public website allowing one-click jailbreak for good few months (not sure if it was actually ever patched or just the iOS version got eol)
  - ghughes 6y ago
    10 years ago, yeah. https://en.m.wikipedia.org/wiki/JailbreakMe https://en.m.wikipedia.org/wiki/JailbreakMe
    - Wowfunhappy 6y ago
      Actually, Safari has been used for exploits much more recently than that! https://totally-not.spyware.lol/ https://totally-not.spyware.lol/ (iOS 10, 2018)
  - _underfl0w_ 6y ago
    They then hired the guy creating those exploit chains.
  - nemothekid 6y ago
    It's unsurprising that the main vector for iOS jailbreaks would be through the web engine. The FreeBSD-based PlayStation 4 was also jailbroken via it's browser. If you have written a hardened, safe browser engine then you are free to share it to the world, otherwise I wouldn't downplay their efforts.
    - ndqc 6y ago
      Chrome/Chromium has a better track record and it is shared with the world. The number of Safari-based iOS exploits found in the wild is embarrassing. Not OP, but I'll stop complaining when Apple lets me use other browser engines.
  - Hnrobert42 6y ago
    What would be an acceptable response from Apple?
- boogies 6y ago
  > Apple puts rather extreme security effort into preventing iOS jailbreaks. Yes, IMO their business model is more accurately described as “gilded cages/jails” than just general “gilded/good-appearing stuff”. They deeply care about the strength of their DRM — including at the expense of end-user security, eg. you can’t access the internet through the Tor browser installed the normal macOS way without macOS broadcasting that you used Tor Project products to Apple’s DRM servers.¹ > They are pretty serious about trying to prevent data exfiltration from locked iOS devices as well. They definitely care about the appearance of trying to prevent that exfiltrating (they don’t publicly appear to help the FBI do it), but they don’t try hard enough to actually prevent it (including in situations were preventing exfiltration seems to have been proven possible, see nearby comment https://news.ycombinator.com/item?id=26667141 https://news.ycombinator.com/item?id=26667141). ¹Edit: ocsp.apple.com, enabling targeting of the people who need or want security the most. To the people downvoting: I’m trying to make an evidence based refutation of the less supported speculation/assertions in the parent post. If you have counter-evidence or any reason to downvote other than fanboyism, please explain it so we or I can learn.
  - Hnrobert42 6y ago
    You don’t provide much evidence. Your second point is just opinion, “they don’t try hard enough.” Your first point is intended to refute the effort put into stopping jailbreaking in iOS. The example you give is about privacy on Mac OS. Last, accusing folks of being fanboys is a particularly weak argument. It says, if you don’t agree with me then your blind allegiance to a corporation renders you incapable of critical thought. Basically, if you don’t agree with me, you’re dumb. There is no practical engagement with that thesis.
- deleted 6y ago
  [deleted]
willio58 6y ago
Security drives profit if it is marketed well. Apple does this. Think about even their branding for certain things, e.g. “Secure Enclave”.

rogerbinns 6y ago

A big difference is that the software running on Apple devices is less complex. For example there is significantly less hardware support. iMessage only talks to other iMessage instances (eg no browser support). There is only one web browser engine. Third party apps can't do JIT code generation. Older APIs are actively removed, breaking existing apps (vs providing backwards compatibility). In general less complexity is better, but it also constrains things. For example it took until recently for third party iOS to be able to do NFC. Android had it since ~2012.

wunderflix 6y ago
> Android had it since ~2012. I seriously wonder: what difference did it make? Was there any groundbreaking thing iOS users missed for 8 years? Apple is just great in omitting things and keeping focus to deliver a great product and then expand on that basis. Most famous example: First iPhones didn’t have MMS
- musicale 6y ago
  > First iPhones didn’t have MMS Or cut and paste. ;-)
- toxik 6y ago
  MMS is whack though
  - cromka 6y ago
    I am guessing they already knew GPRS/UMTS and data plans were the future, hence they invested in iMessage. MMS already had an expiration date. Quite sure they only added it because of the PR disaster it had become.
    - tuwtuwtuwtuw 6y ago
      I often use MMS. Whats the expiration date?
    - 6y ago

viraptor 6y ago

I like the way (I think) the grugq described it: out of the box iPhones are great with security, but Android allows you to build / get better yourself. See the copperhead project for example https://copperhead.co/android/ https://copperhead.co/android/

als0 6y ago

As far as what is feasible, Apple does a very good job with their iPhone/iPad security. With both hardware and software. You can read about it how it all works in their platform security guide. On the Android side, Google makes good software changes to Android, but ultimately the security is dependent on the handset maker (e.g. Samsung) and SoC maker (e.g. Qualcomm). Security will vary between Android phones. The bigger Android phone makers are more able to make security investments than the cheaper phone makers.

deleted 6y ago
[deleted]

2OEH8eoCRo0 6y ago

>While the police managed to crack into Wong’s iPhone, which was locked with a four-digit passcode, they did not manage to access the contents of Chow’s Google Pixel phone using the force’s existing digital forensics tools, according to the court filing. Chow says her phone is still in police possession. https://qz.com/1844937/hong-kongs-mass-arrests-give-police-access-to-phones/ https://qz.com/1844937/hong-kongs-mass-arrests-give-police-a...

deleted 6y ago
[deleted]
pilsetnieks 6y ago
There is literally no other detail than the phone model name. For all we know it could be an ancient iPhone with a severely outdated OS and a brand new Pixel phone. 4-digit passcode hasn't been the default passcode option in iOS for a long time.
- 2OEH8eoCRo0 6y ago
  https://www.tomsguide.com/news/police-say-android-phones-are-harder-to-crack-than-iphones https://www.tomsguide.com/news/police-say-android-phones-are... >This is supported by a look at smartphone cracking company Cellebrite’s effectiveness at breaking into different phones. Cellebrite can easily open up any iPhone X or earlier iPhone, but the same software used on a Google Pixel 2 or Galaxy S9 extracts very little information, and nothing at all in the case of the Huawei P20 Pro. >That’s not to say that these Android devices are unbreakable. It's just that it requires a different, more labor-intensive process to get the data requested. >The sheer variety of Android hardware and customized software builds makes it hard for phone-crackers to build a universal tool to break into Android phones. Meanwhile, a "jailbreak" released late last year permanently bypasses the security functions of every iPhone model from the iPhone 4s to the iPhone X. This perfectly squares with what I personally know from law enforcement friends but I'm just an internet stranger.
  - pilsetnieks 6y ago

codemac 6y ago

If you turn on iCloud, it's theater. Android with syncing enabled does much better in real world tests. Notably in hong kong, they were able to crack the iPhones, but not the Pixels[0] I'm pretty sure without iCloud and a long enough password (or fast enough self destruct mode) iPhones could be as secure, but I don't know anyone that uses an iPhone and does not use iCloud in any way. [0]: https://qz.com/1844937/hong-kongs-mass-arrests-give-police-access-to-phones/ https://qz.com/1844937/hong-kongs-mass-arrests-give-police-a...

rnikander 6y ago
What part of iCloud is the problem?
- codemac 6y ago
  The part where it backs up all your messages without using a device specific key. The only things end to end encrypted are listed on this page: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 If you turn on iCloud syncing, basically you're falling back to simple "in transit" and "at rest" encryption. A lot of iPhone cracks involve just attacking your iCloud account, and then reading all of your messages from backups. This is not possible on Pixel which encrypt your device backups with on-device hardware encryption.
  - gumby 6y ago
    > Pixel which encrypt your device backups with on-device hardware encryption. Can you set up a new android phone from an old phone’s backup? If so, how could this work? This is a standard way to set up a new iPhone: “restore” from a backup of your previous phone. Especially handy when your old phone is no longer available (lost/broken)
    - glennpratt 6y ago
      Yes, decryption requires the original device's unlock PIN/pattern/password: https://security.googleblog.com/2018/10/google-and-android-have-your-back-by.html?m=1 https://security.googleblog.com/2018/10/google-and-android-h... Not that I fully understand how hard it is to circumvent.

Veserv 6y ago

The difficulty is so low that it does not really matter. If you go by their bug bounties [1][2], then it is only $1M to full remote zero-click persistent compromise in both systems. If you go by Zerodium, which is a 3rd party purchaser and thus establishes a third party commercial market price, [3] then it is only $2M for iOS and $2.5M for Android. If we were to divide that price for an iPhone exploit by the number of iPhones sold in a year [4], then that is a mere 1 cent per iPhone. As you can see, the price is so low it hardly even matters if there is a difference. There are literally millions of people in the US alone who personally have the liquid net worth to purchase a remote wormable persistent compromise that you can use to mass infect any Android or iPhone. Essentially every business with more than maybe 10 employees has enough assets to purchase such a weapon on the market. Just today I read on HN that the US government inked a deal for $22B over 10 years for 120k AR headsets from Microsoft [5] which comes out to ~$183k/headset. So, a weapon you can use to fully compromise any phone you want is equal in cost to a mere 15(!) headsets. That contract alone would be enough to purchase 10,000(!) vulnerabilities at existing clearing prices and $22B is only ~1/200th of the yearly US government budget. Frankly, the entire thing is like two people jumping and comparing who is closer to landing on the moon. [1] https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/ [2] https://developer.apple.com/security-bounty/ https://developer.apple.com/security-bounty/ [3] https://zerodium.com/program.html https://zerodium.com/program.html See Mobiles payout. [4] https://www.statista.com/statistics/276306/global-apple-iphone-sales-since-fiscal-year-2007/#:~:text=In%20their%202018%20fiscal%20year,stayed%20relatively%20stable%20since%20then https://www.statista.com/statistics/276306/global-apple-ipho.... [5] https://techcrunch.com/2021/03/31/microsoft-wins-contract-worth-up-to-22-billion-to-outfit-u-s-army-with-120000-ar-headsets/ https://techcrunch.com/2021/03/31/microsoft-wins-contract-wo...

smoldesu 6y ago

From what I've seen, the majority of it is theater. Does that mean it's more secure than Android devices? Not necessarily. In any case, the biggest vulnerability in any system is the end user. No amount of idiot-proofing will stop people from being scammed on an iPhone, nor will it stop someone on Android. When these companies market their "Secure Enclave" or "Titan Security", they're really just dressing up otherwise expected or boring features. The T2 chip was basically a dedicated PRNG chip with basic encoding capabilities, yet Apple paraded it as a boon for device security and game-changer for the end user. In reality, it doesn't solve any practical issues with computer security. I've tried about every OS on the planet, and I've used them on a decent handful of different devices. I won't tell you what to think or do, but Apple's devices are difficult to appraise and hurt my head when I try to consider their impact on my overall "security". I'd much rather just use a Linux system that's transparent about it's vulnerabilities. Much of that same reasoning is why I still use Android these days.

villgax 6y ago
And your point being that Android gets more updates/fixes than Apple? Lol, only Apple has a proven track record of providing 5 year old devices with updates/fixes unlike anything from Android, unless you are comfortable flashing your own builds.
- smoldesu 6y ago
  No, I specifically said in my original post, "Does that mean it's more secure than Android devices? Not necessarily." My ultimate point is that the biggest liability is the user, and those "security updates" don't really matter when the biggest attack vectors don't even consider these exploits in the first place.
saagarjha 6y ago
> The T2 chip was basically a dedicated PRNG chip with basic encoding capabilities This is an extremely misleading description of the scope of T2’s duties.