7 ms·

> Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by

> Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. > And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me. Obviously not, but the linked post demonstrates attackers are more than capable of getting one.

joshstrange 4y ago
But surely you see the difference between "revokable enterprise cert that requires a verification process to obtain" and "anyone can sideload"? I don't see this as Apple making incompatible statements.
- josephcsible 4y ago
  But the verification is obviously ineffective at stopping malware. If it were effective, then this wouldn't be a story.
  - mwint 4y ago
    Something can be simultaneously effective, and also fail at least once.
    - smoldesu 4y ago
      Sure, but as soon as you have that single failure, your system isn't flawless anymore. Apple's claims of comprehensive security are repeatedly proved wrong, and social engineering attacks like this indicate that their attack surface is larger than one might have initially realized.
      - reaperducer 4y ago
        Sure, but as soon as you have that single failure, your system isn't flawless anymore. I've never seen Apple claim that its system is flawless. Do you have a link?
  - mh8h 4y ago
    The thing is that when the system is effective at stoping the malware, you don't get a signal about it. You only see the ones that somehow made it. So it's not easy to have an idea of the effectiveness.
- cmeacham98 4y ago
  Of course, I'll admit it will stop small-time attackers that aren't willing to pay $299, register a fake company, and whatever else is needed to trick Apple into letting you into the enterprise dev program. But I'd like to propose these attackers wouldn't have been able to bypass the sandbox anyways. I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction.
  - acdha 4y ago
    > I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. Does a normal enterprise charge its users to install internal apps? If not, this seems like an odd complaint. > My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction. That last part is effectively what they're doing: you have to do the same level of scary prompt and authentication to install an enterprise certificate as you do to enroll for MDM. Yes, users can still be socially engineered to compromise their device but that's an order of magnitude harder than just convincing someone to run some random binary.
    - Apocryphon 4y ago
      Apple can easily create a guarded sideloading experience replete with scary warnings. They can shape the sideloading UX to screen out users who aren't ready for it. Critics of iOS sideloading fail to see that Apple can add as many guards and guided experiences into sideloading as it does with its other features, such as installing enterprise certs. Even on Android with its openness and notoriety for security issues, to sideload APKs means having to navigate multiple settings menus to get to it, which screens out the majority of non-technical users. Though that is more playing to the "strength" of that platform (clunky design and unwieldiness), which Apple would not be doing.
- zamalek 4y ago
  To a layman? No difference at all. Remember that Apple claim to be the saviors of the ignorant.
gumby 4y ago
> The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. Indeed. I'm (maybe) willing to sideload an app from my employer but not from some other company. Perhaps only managed devices should have this capability, and only for apps signed by the managing authority. I won't allow my employer to manage my personal phone; they have to issue me a phone if they want that kind of control. And in that case it's their device; they are welcome to manage it as they see fit. Also: this is different from TestFlight.
tshaddox 4y ago
> "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. I'm missing how these are incompatible statements. You might as well say "if Apple thought certain apps could be dangerous they wouldn't have an App Store or even allow their own first-party apps on iPhones." Of course the position of Apple is that they should be able to approve every app/vendor before it's allowed to be installed on iPhones. The fact that they do approve some apps and vendors isn't incompatible with their position.

joshstrange 4y ago

But surely you see the difference between "revokable enterprise cert that requires a verification process to obtain" and "anyone can sideload"? I don't see this as Apple making incompatible statements.

josephcsible 4y ago
But the verification is obviously ineffective at stopping malware. If it were effective, then this wouldn't be a story.
- mwint 4y ago
  Something can be simultaneously effective, and also fail at least once.
  - smoldesu 4y ago
    Sure, but as soon as you have that single failure, your system isn't flawless anymore. Apple's claims of comprehensive security are repeatedly proved wrong, and social engineering attacks like this indicate that their attack surface is larger than one might have initially realized.
    - reaperducer 4y ago
      Sure, but as soon as you have that single failure, your system isn't flawless anymore. I've never seen Apple claim that its system is flawless. Do you have a link?
- mh8h 4y ago
  The thing is that when the system is effective at stoping the malware, you don't get a signal about it. You only see the ones that somehow made it. So it's not easy to have an idea of the effectiveness.
cmeacham98 4y ago
Of course, I'll admit it will stop small-time attackers that aren't willing to pay $299, register a fake company, and whatever else is needed to trick Apple into letting you into the enterprise dev program. But I'd like to propose these attackers wouldn't have been able to bypass the sandbox anyways. I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction.
- acdha 4y ago
  > I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. Does a normal enterprise charge its users to install internal apps? If not, this seems like an odd complaint. > My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction. That last part is effectively what they're doing: you have to do the same level of scary prompt and authentication to install an enterprise certificate as you do to enroll for MDM. Yes, users can still be socially engineered to compromise their device but that's an order of magnitude harder than just convincing someone to run some random binary.
  - Apocryphon 4y ago
    Apple can easily create a guarded sideloading experience replete with scary warnings. They can shape the sideloading UX to screen out users who aren't ready for it. Critics of iOS sideloading fail to see that Apple can add as many guards and guided experiences into sideloading as it does with its other features, such as installing enterprise certs. Even on Android with its openness and notoriety for security issues, to sideload APKs means having to navigate multiple settings menus to get to it, which screens out the majority of non-technical users. Though that is more playing to the "strength" of that platform (clunky design and unwieldiness), which Apple would not be doing.
zamalek 4y ago
To a layman? No difference at all. Remember that Apple claim to be the saviors of the ignorant.

gumby 4y ago

> The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. Indeed. I'm (maybe) willing to sideload an app from my employer but not from some other company. Perhaps only managed devices should have this capability, and only for apps signed by the managing authority. I won't allow my employer to manage my personal phone; they have to issue me a phone if they want that kind of control. And in that case it's their device; they are welcome to manage it as they see fit. Also: this is different from TestFlight.

tshaddox 4y ago

> "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. I'm missing how these are incompatible statements. You might as well say "if Apple thought certain apps could be dangerous they wouldn't have an App Store or even allow their own first-party apps on iPhones." Of course the position of Apple is that they should be able to approve every app/vendor before it's allowed to be installed on iPhones. The fact that they do approve some apps and vendors isn't incompatible with their position.