6 ms·

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

by swiley 5y ago

cunthorpe 5y ago
To be fair it's probably the most secure environment for the average Joe, you're just saying that it's not perfectly secure, which would be impossible in this world.
- swiley 5y ago
  You could do far better than iOS. Worse though is that it encourages very poor infosec because when it's profitable for Apple and often makes doing things correctly difficult or impossible.
  - LucidLynx 5y ago
    I suppose you have examples to propose?
    - swiley 5y ago
      It makes checking the hygiene of apps you use impossible, building them from source artificially difficult and expensive and pushes users towards services with serious flaws like icloud backup.
      - jonfw 5y ago
        > average joe > building them from source An average joe doesn't even know what 'build from source' means
        ajari 5y ago
        We could have taught people such things, but there’s no profit in that. We want to maximize the number of people using our devices and our software, so that we get richer, even if it means putting some fraction of these users in grave danger. That’s simply negligence. That it’s distributed across an entire industry doesn’t change the ethics. Selling people tools that put them at risk is much different than sharing foss.
        cunthorpe 5y ago
        Some things you say make sense, but suggesting that “people” can/should learn how to build from source is simply nonsense. Heck if I had to build my OS I’d stick to a feature phone instead.
        swiley 5y ago
        There's a strong affect when the options are easily available that chills out some of this stupidity
  - dr-detroit 5y ago
    Well, I mean there's always systemd. What are we talkin here, Gentoo?
j45 5y ago
iOS is currently the least worst mobile solution as a daily driver for the majority of people who are users before techies. It doesn’t mean it’s good enough but I’d be curious to hear your ideas for what could work as easily for the masses.
- dr-detroit 5y ago
  I would air gap the masses if were really trying to address the root cause of problems
nemothekid 5y ago
>the marketing (lying) that iOS is secure is pretty intense. I don't see how it's lying. If you are going to consider that iOS is not secure because they got owned by a couple 0 days, then by that definition there isn't a secure piece of software on the planet.
- slivanes 5y ago
  iOS exploits are paying less than Android - http://zerodium.com/program.html http://zerodium.com/program.html. Based on supply and demand it would appear that iOS is less secure right?
  - LucidLynx 5y ago
    True, and many many good researchers boast the Android security compared to iOS, thanks to Google and Samsung (mostly) since many years now (https://onezero.medium.com/is-android-getting-safer-than-ios-4a2ca6f359d3 https://onezero.medium.com/is-android-getting-safer-than-ios...). But as a *platform* I am intimately convinced that iOS is far more secure than Android... I agree that a few apps have been authorised by Apple to be published on the App Store, but when it happens to the Play Store it is not only one or two apps... it is mostly 5 to 10 apps developed by the same developer and which contain *the same* flaws. Also, as demonstrated AdGuard a few years now (https://adguard.com/en/blog/popular-android-apps-are-stealing-users-emails.html https://adguard.com/en/blog/popular-android-apps-are-stealin...), it is way easier to extract user informations from random apps on Android than iOS. However the Android API has been improved since two years now (and Android 12 is better than ever to secure user informations).
andrewzah 5y ago
Perfectly secure computers are an oxymoron. They don’t exist. iOS is the least worst mobile option and it’s ridiculous to say Apple is lying about security if any exploits are found, ever. If you look at e.g. how messaging works in iOS 14 [0] you’ll see that they do in fact work on making secure systems. But parsing and memory safety are hard. Like, really hard. The fact that NSO found exploits doesn’t mean Apple is doing anything, but Apple is clearly making it more and more difficult to find and abuse such exploits. For the average person that isn’t being specifically targeted by sophisticated malware from companies funded by -governments-, iOS is pretty damn secure. Dealing with being attacked is a different threat model. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
- swiley 5y ago
  >Perfectly secure computers are an oxymoron. They don’t exist. Absolutely, but creating a platform the encourages or forces users to do the wrong thing is a regression from where we were ten years ago. >iOS is the least worst mobile option No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient. The rest of the options are so bad that you're probably better off without a mobile phone at all. RE: iMessage You have everyone using exactly the same messaging client, so you have one piece of software to exploit and now you can attack everyone. The extreme lack of diversity makes these sorts of complex exploits much more profitable. >iOS is pretty damn secure Sure, if you don't do anything with it. But it encourages users to download unaditable closed apps and reassures them that doing so is totally safe despite the fact that most of them are using 3rd party telemetry services run by data brokers.
  - nemothekid 5y ago
    >No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient Just because it's FOSS doesn't mean it's secure. If your problem is privacy then sure, the PinePhone is the least worst mobile option. If your problem is security I don't see how a phone that doesn't have hardware embedded key manager is a step up. It's not like the Linux Kernel, and whatever messenger you do decide to use is free from zero-days either. >But it encourages users to download unaditable closed apps and reassures them that doing so is totally safe despite the fact that most of them are using 3rd party telemetry services run by data brokers. And for the very same reason your bicycle is safer than a car because it doesn't encourage you to drive 75mph. I agree the world might be a lot better if we "return to monkey" but I don't think anarcho-primitivism is a solution.

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

by swiley 5y ago

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

To be fair it's probably the most secure environment for the average Joe, you're just saying that it's not perfectly secure, which would be impossible in this world.

swiley 5y ago
You could do far better than iOS. Worse though is that it encourages very poor infosec because when it's profitable for Apple and often makes doing things correctly difficult or impossible.
- LucidLynx 5y ago
  I suppose you have examples to propose?
  - swiley 5y ago
    It makes checking the hygiene of apps you use impossible, building them from source artificially difficult and expensive and pushes users towards services with serious flaws like icloud backup.
    - jonfw 5y ago
      > average joe > building them from source An average joe doesn't even know what 'build from source' means
      - ajari 5y ago
        We could have taught people such things, but there’s no profit in that. We want to maximize the number of people using our devices and our software, so that we get richer, even if it means putting some fraction of these users in grave danger. That’s simply negligence. That it’s distributed across an entire industry doesn’t change the ethics. Selling people tools that put them at risk is much different than sharing foss.
        cunthorpe 5y ago
        Some things you say make sense, but suggesting that “people” can/should learn how to build from source is simply nonsense. Heck if I had to build my OS I’d stick to a feature phone instead.
      - swiley 5y ago
        There's a strong affect when the options are easily available that chills out some of this stupidity
- dr-detroit 5y ago
  Well, I mean there's always systemd. What are we talkin here, Gentoo?

j45 5y ago

iOS is currently the least worst mobile solution as a daily driver for the majority of people who are users before techies. It doesn’t mean it’s good enough but I’d be curious to hear your ideas for what could work as easily for the masses.

dr-detroit 5y ago
I would air gap the masses if were really trying to address the root cause of problems

nemothekid 5y ago

>the marketing (lying) that iOS is secure is pretty intense. I don't see how it's lying. If you are going to consider that iOS is not secure because they got owned by a couple 0 days, then by that definition there isn't a secure piece of software on the planet.

slivanes 5y ago
iOS exploits are paying less than Android - http://zerodium.com/program.html http://zerodium.com/program.html. Based on supply and demand it would appear that iOS is less secure right?
- LucidLynx 5y ago
  True, and many many good researchers boast the Android security compared to iOS, thanks to Google and Samsung (mostly) since many years now (https://onezero.medium.com/is-android-getting-safer-than-ios-4a2ca6f359d3 https://onezero.medium.com/is-android-getting-safer-than-ios...). But as a *platform* I am intimately convinced that iOS is far more secure than Android... I agree that a few apps have been authorised by Apple to be published on the App Store, but when it happens to the Play Store it is not only one or two apps... it is mostly 5 to 10 apps developed by the same developer and which contain *the same* flaws. Also, as demonstrated AdGuard a few years now (https://adguard.com/en/blog/popular-android-apps-are-stealing-users-emails.html https://adguard.com/en/blog/popular-android-apps-are-stealin...), it is way easier to extract user informations from random apps on Android than iOS. However the Android API has been improved since two years now (and Android 12 is better than ever to secure user informations).

andrewzah 5y ago

Perfectly secure computers are an oxymoron. They don’t exist. iOS is the least worst mobile option and it’s ridiculous to say Apple is lying about security if any exploits are found, ever. If you look at e.g. how messaging works in iOS 14 [0] you’ll see that they do in fact work on making secure systems. But parsing and memory safety are hard. Like, really hard. The fact that NSO found exploits doesn’t mean Apple is doing anything, but Apple is clearly making it more and more difficult to find and abuse such exploits. For the average person that isn’t being specifically targeted by sophisticated malware from companies funded by -governments-, iOS is pretty damn secure. Dealing with being attacked is a different threat model. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

swiley 5y ago
>Perfectly secure computers are an oxymoron. They don’t exist. Absolutely, but creating a platform the encourages or forces users to do the wrong thing is a regression from where we were ten years ago. >iOS is the least worst mobile option No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient. The rest of the options are so bad that you're probably better off without a mobile phone at all. RE: iMessage You have everyone using exactly the same messaging client, so you have one piece of software to exploit and now you can attack everyone. The extreme lack of diversity makes these sorts of complex exploits much more profitable. >iOS is pretty damn secure Sure, if you don't do anything with it. But it encourages users to download unaditable closed apps and reassures them that doing so is totally safe despite the fact that most of them are using 3rd party telemetry services run by data brokers.
- nemothekid 5y ago
  >No. Devices running a FOSS operating system like the Pinephone are the least worst mobile option, people don't like it because it's not sexy and it's currently very inconvenient Just because it's FOSS doesn't mean it's secure. If your problem is privacy then sure, the PinePhone is the least worst mobile option. If your problem is security I don't see how a phone that doesn't have hardware embedded key manager is a step up. It's not like the Linux Kernel, and whatever messenger you do decide to use is free from zero-days either. >But it encourages users to download unaditable closed apps and reassures them that doing so is totally safe despite the fact that most of them are using 3rd party telemetry services run by data brokers. And for the very same reason your bicycle is safer than a car because it doesn't encourage you to drive 75mph. I agree the world might be a lot better if we "return to monkey" but I don't think anarcho-primitivism is a solution.