4 ms·

I think you will have a hard time proving beyond speculation that Apple or Microsoft has backdoors to their OS. Would be curious to see any sources though. I ac

I think you will have a hard time proving beyond speculation that Apple or Microsoft has backdoors to their OS. Would be curious to see any sources though. I actually think that is the difference here, Chinese phones and possibly other devices have backdoors, but Apple/Microsoft likely do not.

kelnos 5y ago
I think the parent is being more expansive in what they call a "backdoor", and I tend to agree. Does Apple have the ability to remove an app or some bit of content off your phone (ostensibly to remove malware)? I believe they do? That feels like a backdoor to me. And I assume Google (and/or the phone's manufacturer) has the same ability on Android. No idea about Microsoft on Windows.
- paxys 5y ago
  Backdoor implies something hidden and not advertised. Apple/Google/Microsoft and others are pretty clear about fully being in control of your device. They can push updates (both at the OS and app level), add new trusted root certificates, collect usage data, show ads, remotely track/lock/disable your device and lots more. Apple is even going to start scanning your phone for certain kinds of illegal content.
ohazi 5y ago
> I think you will have a hard time proving beyond speculation that Apple or Microsoft has backdoors to their OS. This statement is absurd -- they don't need to keep a backdoor around because they control the front door. You do realize that controlling how/whether/when core system software updates are pushed to a device is equivalent to having a backdoor, don't you? The operating system on my phone can be 100% backdoor-free today, but if Apple decides that their next update is going to include backdoor, then tomorrow my phone is going to have a backdoor. Basically all consumer phones (save for a few cobbled together exceptions) implicitly accept arbitrary software updates from their upstream vendor.
- rsync 5y ago
  "Basically all consumer phones (save for a few cobbled together exceptions) implicitly accept arbitrary software updates from their upstream vendor." Actually ... all phones of all kinds explicitly accept arbitrary updates from the carrier in the form of java code that they can upload, and run, on your SIM card. Your SIM card is a full fledged computer with CPU, RAM and storage and your carrier can upload and run arbitrary code on it.
  - ohazi 5y ago
    Yes, this is absolutely also true. However, there are some phones (including several iPhone generations) where the entire baseband/sim subsystem is isolated from the primary application processor and operating system, and essentially appears as something like a dumb USB modem that the OS can control / use / ignore as it pleases. In theory, this would make it difficult for a carrier to issue a baseband update that (for example) hoovers up photos from internal storage. This is the same reason you should prefer a cable modem that's physically separate from your router/wifi/etc. Your cable modem gets firmware updates via DOCSIS from your ISP, and if you have one of those combo boxes, you're essentially letting your ISP onto your internal network.
    - Dah00n 5y ago
      >However, there are some phones (including several iPhone generations) where the entire baseband/sim subsystem is isolated from the primary application processor and operating system Yes, that's what the developer says. Totally unverifiable though unless it is both open source and you built and installed the firmware yourself.. and still there could be hidden firmware running. This is no different than Intel saying we can trust them with the Intel Management Engine.
      - ohazi 5y ago
        I agree with this perspective as well. Assume your carrier is capable of doing anything on your phone until a thorough hardware and software audit has been performed on the device in question (this kind of audit has been performed on several popular phones), but even then, continue to be careful/skeptical. It's also a good idea to at least consider the possibility that the baseband <-> application processor link may be software defined, and that an update from the vendor might theoretically be able to turn a dumb-USB-peripheral link into a has-access-to-kernel-memory PCIe link, thus enabling future control by the carrier.
david_allison 5y ago
By the same definition, isn't Windows Update a backdoor: it can remotely enable/disable functionality?
Dah00n 5y ago
I don't think you understand what is going on here. What you are saying is that iPhones cannot download data containing a list of things to block (or do whatever with) or that Apple cannot push an update. Xiaomi phones are downloading a JSON file. That has nothing to do with backdoors or remote access. In fact that whole debacle about Apple scanning a device for child pornography works just like it: Download data from a server and do something. If that is a backdoor than 100% of devices that are online are basically backdoored. Functionally this is no different than iOS downloading a list of apps to block.

kelnos 5y ago

I think the parent is being more expansive in what they call a "backdoor", and I tend to agree. Does Apple have the ability to remove an app or some bit of content off your phone (ostensibly to remove malware)? I believe they do? That feels like a backdoor to me. And I assume Google (and/or the phone's manufacturer) has the same ability on Android. No idea about Microsoft on Windows.

paxys 5y ago
Backdoor implies something hidden and not advertised. Apple/Google/Microsoft and others are pretty clear about fully being in control of your device. They can push updates (both at the OS and app level), add new trusted root certificates, collect usage data, show ads, remotely track/lock/disable your device and lots more. Apple is even going to start scanning your phone for certain kinds of illegal content.

ohazi 5y ago

> I think you will have a hard time proving beyond speculation that Apple or Microsoft has backdoors to their OS. This statement is absurd -- they don't need to keep a backdoor around because they control the front door. You do realize that controlling how/whether/when core system software updates are pushed to a device is equivalent to having a backdoor, don't you? The operating system on my phone can be 100% backdoor-free today, but if Apple decides that their next update is going to include backdoor, then tomorrow my phone is going to have a backdoor. Basically all consumer phones (save for a few cobbled together exceptions) implicitly accept arbitrary software updates from their upstream vendor.

rsync 5y ago
"Basically all consumer phones (save for a few cobbled together exceptions) implicitly accept arbitrary software updates from their upstream vendor." Actually ... all phones of all kinds explicitly accept arbitrary updates from the carrier in the form of java code that they can upload, and run, on your SIM card. Your SIM card is a full fledged computer with CPU, RAM and storage and your carrier can upload and run arbitrary code on it.
- ohazi 5y ago
  Yes, this is absolutely also true. However, there are some phones (including several iPhone generations) where the entire baseband/sim subsystem is isolated from the primary application processor and operating system, and essentially appears as something like a dumb USB modem that the OS can control / use / ignore as it pleases. In theory, this would make it difficult for a carrier to issue a baseband update that (for example) hoovers up photos from internal storage. This is the same reason you should prefer a cable modem that's physically separate from your router/wifi/etc. Your cable modem gets firmware updates via DOCSIS from your ISP, and if you have one of those combo boxes, you're essentially letting your ISP onto your internal network.
  - Dah00n 5y ago
    >However, there are some phones (including several iPhone generations) where the entire baseband/sim subsystem is isolated from the primary application processor and operating system Yes, that's what the developer says. Totally unverifiable though unless it is both open source and you built and installed the firmware yourself.. and still there could be hidden firmware running. This is no different than Intel saying we can trust them with the Intel Management Engine.
    - ohazi 5y ago
      I agree with this perspective as well. Assume your carrier is capable of doing anything on your phone until a thorough hardware and software audit has been performed on the device in question (this kind of audit has been performed on several popular phones), but even then, continue to be careful/skeptical. It's also a good idea to at least consider the possibility that the baseband <-> application processor link may be software defined, and that an update from the vendor might theoretically be able to turn a dumb-USB-peripheral link into a has-access-to-kernel-memory PCIe link, thus enabling future control by the carrier.

david_allison 5y ago

By the same definition, isn't Windows Update a backdoor: it can remotely enable/disable functionality?

Dah00n 5y ago

I don't think you understand what is going on here. What you are saying is that iPhones cannot download data containing a list of things to block (or do whatever with) or that Apple cannot push an update. Xiaomi phones are downloading a JSON file. That has nothing to do with backdoors or remote access. In fact that whole debacle about Apple scanning a device for child pornography works just like it: Download data from a server and do something. If that is a backdoor than 100% of devices that are online are basically backdoored. Functionally this is no different than iOS downloading a list of apps to block.