3 ms·

I think security architecture evolved a bit, so a simple rewrite is probably not worth it. Question is if more modern approaches are indeed better. Mobile devic

I think security architecture evolved a bit, so a simple rewrite is probably not worth it. Question is if more modern approaches are indeed better. Mobile devices convince me otherwise.

kaba0 5y ago
> Mobile devices convince me otherwise. Why do you think so? We’ve never had such an easily accessible device used by so many people that routinely run untrusted code and is basically full of overly personal information and data. Yet we seldom hear security implications. I’m no security researcher but recently taken a dive into the topic and the state of the art security research is with mobile OSs and iPhones and to a degree android (GrapheneOS itself) does a great job at it.
- raxxorrax 5y ago
  I measure the result. Mobile devices leak much more data compared to desktop, although that is also due to simple misbehavior of apps and some compromises that we talk about phones.
  - seoaeu 5y ago
    Mobile devices are packed with sensors in a way that desktops aren't. And of course it doesn't help that users generally want those sensor measurements to be accessible to the apps they use.
    - ClumsyPilot 5y ago
      Well inacessible sensors are rather useless weight
  - kaba0 5y ago
    Privacy != security
    - raxxorrax 5y ago
      I disagree. Especially if these privacy violation happen without the explicit knowledge of the user.
- Veserv 5y ago
  In 2020 there were 304 publicly disclosed security defects in iOS of which 94 were severe [1] which means an average of 2 severe defects per week and 859 in Android of which 214 were severe which is an average of 4 severe defects per week. These constitute fairly average years (within a factor of 2) so you can reasonably expect that a similar number of defects will be discovered in their currently shipping versions by the end of the year. [1] https://www.cvedetails.com/vulnerability-list.php?vendor_id=49&product_id=15556&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=2020&month=0&cweid=0&order=3&trc=304&sha=f1112228334f285213ba6575bc7a484d29a781f8 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... [2] https://www.cvedetails.com/vulnerability-list.php?vendor_id=1224&product_id=19997&version_id=&page=5&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=2020&month=0&cweid=0&order=3&trc=859&sha=8749d8ef5b1dffe9567294e61690771c67a6e7cd https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
  - kaba0 5y ago
    We would need a reference to compare it against so the data can be meaningful. Also, a patched before disclosure vulnerability is not the same as an actually exploited one. I would really be curious on what do you consider secure that has a similar complexity/attack surface and usage to phone OSs? Apple on the desktop comes close, and Windows does an okayish job, unfortunately Linux (userspace) is terrible security-wise.

I think security architecture evolved a bit, so a simple rewrite is probably not worth it. Question is if more modern approaches are indeed better. Mobile devices convince me otherwise.

kaba0 5y ago

> Mobile devices convince me otherwise. Why do you think so? We’ve never had such an easily accessible device used by so many people that routinely run untrusted code and is basically full of overly personal information and data. Yet we seldom hear security implications. I’m no security researcher but recently taken a dive into the topic and the state of the art security research is with mobile OSs and iPhones and to a degree android (GrapheneOS itself) does a great job at it.

raxxorrax 5y ago
I measure the result. Mobile devices leak much more data compared to desktop, although that is also due to simple misbehavior of apps and some compromises that we talk about phones.
- seoaeu 5y ago
  Mobile devices are packed with sensors in a way that desktops aren't. And of course it doesn't help that users generally want those sensor measurements to be accessible to the apps they use.
  - ClumsyPilot 5y ago
    Well inacessible sensors are rather useless weight
- kaba0 5y ago
  Privacy != security
  - raxxorrax 5y ago
    I disagree. Especially if these privacy violation happen without the explicit knowledge of the user.
Veserv 5y ago
In 2020 there were 304 publicly disclosed security defects in iOS of which 94 were severe [1] which means an average of 2 severe defects per week and 859 in Android of which 214 were severe which is an average of 4 severe defects per week. These constitute fairly average years (within a factor of 2) so you can reasonably expect that a similar number of defects will be discovered in their currently shipping versions by the end of the year. [1] https://www.cvedetails.com/vulnerability-list.php?vendor_id=49&product_id=15556&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=2020&month=0&cweid=0&order=3&trc=304&sha=f1112228334f285213ba6575bc7a484d29a781f8 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... [2] https://www.cvedetails.com/vulnerability-list.php?vendor_id=1224&product_id=19997&version_id=&page=5&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=2020&month=0&cweid=0&order=3&trc=859&sha=8749d8ef5b1dffe9567294e61690771c67a6e7cd https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- kaba0 5y ago
  We would need a reference to compare it against so the data can be meaningful. Also, a patched before disclosure vulnerability is not the same as an actually exploited one. I would really be curious on what do you consider secure that has a similar complexity/attack surface and usage to phone OSs? Apple on the desktop comes close, and Windows does an okayish job, unfortunately Linux (userspace) is terrible security-wise.