4 ms·
It's really unfortunate that there are no commercial incentives to provide strict sandboxing for outdated versions of applications, rather than only allowing th
by KMag 5y ago
It's really unfortunate that there are no commercial incentives to provide strict sandboxing for outdated versions of applications, rather than only allowing the latest version to be installed. There's a strong public good in preventing versions of applications with known vulnerabilities from accessing the network (or perhapse restricted to an (possibly empty) allowlist of domains). However, the inability to save old installers and run old applications in some cases leads to lost functionality, which is sometimes effectively lost data.
I got my wife to start using a password manager, but I really should have given her some guidance. She picked one that was popular in her native language. I also encouraged her to upgrade iOS on her phone. We backed up her phone and upgraded, but the new iOS version would drain her fully charged phone in an hour or so. So, we restored iOS from backup. Unfortunately, her password manager had been discontinued, and iOS backups just contain effectively remote symlinks to installed apps rather than containing the actual binaries. The discontinued password manager then showed up as something like a stub displaying an error message that the app could not be installed. Luckily, I was able to get into the backup and determine the password manager used an unencrypted sqlite DB with English column names and I was able to give my wife her passwords back.
I would have much preferred a warning that the backed-up version was no longer supported, and be given 3 options: (1) install the last released version in a locked-down sandbox (2) install the backed-up version in a locked-down sandox or (3) uninstall the app.
- quench 5y ago> I was able to get into the backup and determine the password manager used an unencrypted sqlite DB with English column names and I was able to give my wife her passwords back. WTF? No wonder it got pulled! I am curious as to why you don’t just use the native password manager?
- KMag 5y agoI don't use iOS Keychain because I've been an Android user since Google gave all employees a free HTC G1 for the holidays. I had an original iPhone, but I don't recall that having Keychain. As for why my wife doesn't use the iOS Keychain, I'm not sure. I try to avoid pressuring her to use one solution or another. If I pressure her to use some solution and there's a bug, then that's on me.
- duckfang 5y agoAnd this is a post as a reminder that SQLite has hooks for encrypting. Although SQLite is in public domain, the encryption is not. They charge $$$$ for it. https://www.sqlite.org/see/doc/trunk/www/readme.wiki https://www.sqlite.org/see/doc/trunk/www/readme.wiki