6 ms·

This further cements my opinion that Apple is just leaps ahead of anyone else wrt security and privacy these days. They should be applauded for this. I look fo

This further cements my opinion that Apple is just leaps ahead of anyone else wrt security and privacy these days. They should be applauded for this. I look forward to when this comes to iPad. An iPad with a Bluetooth keyboard is an excellent option over a traditional laptop for a high-risk target, and this’ll make it even better.

3pt14159 4y ago
Privacy, yes. Security qua security (ie, not counting security loss due to privacy loss) it's pretty tight between Android and iOS: https://zerodium.com/program.html https://zerodium.com/program.html
- judge2020 4y ago
  While rootkits et al. are bad, privacy loss can be just as bad ie. “reads your email” or “passively reads clipboard [containing passwords]”.
- gpt5 4y ago
  To be fair, this mode is a direct counter to the zero-click attacks that Zerodium is offering the high payouts for. It specifically blocks all the (currently) known attack vectors. Maybe Zerodium will offer a new tier for a zero-click attack on an iPhone on Lockdown mode in the future.
  - 3pt14159 4y ago
    I wouldn't say that is fair in that very few people can use that mode, so the net security win is minor and there exist hyperlocked down Android versions for years on the open market. A friend of mine even worked on one. This space is murky at the top end. The Zerodium payout offering is a rough proxy, but for 99.99% of consumers the security win for a iPhone are mostly about how they don't have to think about the manufacturer (tell your tech illiterate friend to buy an iPhone is easier than saying "Android but only Google or XYZ manufacturer") and how the privacy differential helps out a bit. Also, plenty of people can't enable crazy hyper secure mode without bleeding information that they've enabled it. So this isn't as helpful as it may seem.
    - gpt5 4y ago
      > I wouldn't say that is fair in that very few people can use that mode Very few people are being targeted by nation-states. But more importantly, these are not a random set of people. These are head of states and companies, free speech activists and journalists, and people with access to top secret information. I suspect that a large set of them are aware that they are potential targets.
- dan-robertson 4y ago
  My understanding was that the median iPhone is much more secure than the median android phone due to things like regular updates being widely installed. Lots of the things that used to be worse for android (eg bad app permission model) have been fixed.
- nr2x 4y ago
  There is no privacy when the device sends a full unencrypted backup to the mothership by default. It’s theater.
- Melatonic 4y ago
  They are always one upping each other. On the positive side both OS are very, very good generally for security (comparatively to what we used to have) Privacy I am not even so sure - you can turn a ton of Google stuff off fairly easily and on top of that while Apple may not directly sell your aggregated data to third parties they sure as hell are using it themselves
- saagarjha 4y ago
  Bug bounty payouts are generally not a good proxy for security, because they must take into account market conditions and platform relevance.
skybrian 4y ago
Compare with Google's "enhanced safe browsing" for Chrome and Gmail [1] and lockdown mode on Android. [1] https://support.google.com/accounts/answer/11577602?hl=en https://support.google.com/accounts/answer/11577602?hl=en
- HL33tibCe7 4y ago
  Neither are equivalent to this. In general, the Android ecosystem is far less secure.
  - nr2x 4y ago
    In general, yes - but hardware key authentication and Titan are leaps ahead.
- MatthiasPortzel 4y ago
  Enhanced safe browsing is stops you from clicking on links to malicious domains and lockdown mode just requires you to enter your pin (equivalent to holding down volume up and power on a recent iPhone). Both are completely different from iOS's lockdown mode.
- kccqzy 4y ago
  Enhanced Safe Browsing is not directly comparable with Lockdown Mode. It's only enhanced against phishing attacks. It doesn't do things like turning off unpopular image formats or WebGL or JIT.
Veserv 4y ago
Really, a marketing piece on their own website where they make a extraordinary claim that they can protect against the “most sophisticated digital threats” without any evidence supporting their claim at all, let alone the extraordinary evidence required to actually support such a claim that is generally viewed as impossible by most technically competent individuals, cements their leadership in the security space? It would make much more sense to look at their actual, independently validated security certifications that they advertise: https://support.apple.com/guide/sccc/security-certifications-for-ios-scccfa917cb49/1/web/1.0 https://support.apple.com/guide/sccc/security-certifications... https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11146-ci.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11036-aar.pdf#page217 https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... Where they have only managed to achieve the absolute lowest levels of security. Like, look at that last one, their security validation functionally consists of typing “public unpatched ios vulnerabilities” into Google and certifying that nothing comes up. It is utterly preposterous to claim they have any security expertise against highly skilled attackers at all when that is the limit of their advertised certifications. If they actually want to demonstrate security leadership, they should certify against the highest level, AVA_VAN.5, which actually verifies protection against HIGH attack potential threats instead of the lowest level, AVA_VAN.1, which only verifies protection against BASIC attack potential threats.
- saagarjha 4y ago
  My favorite part of Hacker News is when commenters just lazily make the same comments again a couple months later, without taking into account what people’s replies to them, and hope nobody will notice: https://news.ycombinator.com/item?id=32007917 https://news.ycombinator.com/item?id=32007917. Seriously though, this is pretty much the textbook definition of bad faith, so don’t do it.
  - cmeacham98 4y ago
    Is my browser broken and not displaying some comments I should see? The only response I see there is basically "let's wait and see for Apple to provide more details and/or involve third party researchers", which Apple seems to have not done at all in the last 70 days?
int_19h 4y ago
Edge has something called "Super Duper Secure Mode" (for real) these days: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
nottorp 4y ago
> Apple is just leaps ahead of anyone else Anyone else being ... just Google. It's not like we have many options for mainstream mobile phones. It's easy to be ahead of the competition when the competition's business model is selling your data. One can dream of a day when Apple gets real competition.
user3939382 4y ago
Put a proxy on macOS or iOS and see how both incessantly phone home to Apple, including on both which programs you’re running and when. Apple’s privacy reputation is mostly marketing and boils down to “if anyone’s going to spy on you it’s going to be us!”
- s3p 4y ago
  Do you read apple's privacy policy? They go to extreme lengths to ensure none of the diagnostic data they collect is personally identifiable without user permission. They invest millions into certain programs [1] to ensure they can collect data in a way that doesn't even point back to any specific identifier. I just don't see how you could equate apple to every other company and accuse them of spying on their users when it is clearly not the case. You have options when it comes to phones and computers and only one fortune 500 company seems seriously committed to keeping their users personal info private. [1] https://www.apple.com/privacy/docs/Differential_Privacy_Overview.pdf https://www.apple.com/privacy/docs/Differential_Privacy_Over...
  - user3939382 4y ago
    There’s tons of research on the weakness and reversibility of differential privacy. Privacy doesn’t mean being or making representations that you’re being a good steward of the information you’ve spied on me to collect, it means not collecting it.

3pt14159 4y ago

Privacy, yes. Security qua security (ie, not counting security loss due to privacy loss) it's pretty tight between Android and iOS: https://zerodium.com/program.html https://zerodium.com/program.html

judge2020 4y ago
While rootkits et al. are bad, privacy loss can be just as bad ie. “reads your email” or “passively reads clipboard [containing passwords]”.
gpt5 4y ago
To be fair, this mode is a direct counter to the zero-click attacks that Zerodium is offering the high payouts for. It specifically blocks all the (currently) known attack vectors. Maybe Zerodium will offer a new tier for a zero-click attack on an iPhone on Lockdown mode in the future.
- 3pt14159 4y ago
  I wouldn't say that is fair in that very few people can use that mode, so the net security win is minor and there exist hyperlocked down Android versions for years on the open market. A friend of mine even worked on one. This space is murky at the top end. The Zerodium payout offering is a rough proxy, but for 99.99% of consumers the security win for a iPhone are mostly about how they don't have to think about the manufacturer (tell your tech illiterate friend to buy an iPhone is easier than saying "Android but only Google or XYZ manufacturer") and how the privacy differential helps out a bit. Also, plenty of people can't enable crazy hyper secure mode without bleeding information that they've enabled it. So this isn't as helpful as it may seem.
  - gpt5 4y ago
    > I wouldn't say that is fair in that very few people can use that mode Very few people are being targeted by nation-states. But more importantly, these are not a random set of people. These are head of states and companies, free speech activists and journalists, and people with access to top secret information. I suspect that a large set of them are aware that they are potential targets.
dan-robertson 4y ago
My understanding was that the median iPhone is much more secure than the median android phone due to things like regular updates being widely installed. Lots of the things that used to be worse for android (eg bad app permission model) have been fixed.
nr2x 4y ago
There is no privacy when the device sends a full unencrypted backup to the mothership by default. It’s theater.
Melatonic 4y ago
They are always one upping each other. On the positive side both OS are very, very good generally for security (comparatively to what we used to have) Privacy I am not even so sure - you can turn a ton of Google stuff off fairly easily and on top of that while Apple may not directly sell your aggregated data to third parties they sure as hell are using it themselves
saagarjha 4y ago
Bug bounty payouts are generally not a good proxy for security, because they must take into account market conditions and platform relevance.

skybrian 4y ago

Compare with Google's "enhanced safe browsing" for Chrome and Gmail [1] and lockdown mode on Android. [1] https://support.google.com/accounts/answer/11577602?hl=en https://support.google.com/accounts/answer/11577602?hl=en

HL33tibCe7 4y ago
Neither are equivalent to this. In general, the Android ecosystem is far less secure.
- nr2x 4y ago
  In general, yes - but hardware key authentication and Titan are leaps ahead.
MatthiasPortzel 4y ago
Enhanced safe browsing is stops you from clicking on links to malicious domains and lockdown mode just requires you to enter your pin (equivalent to holding down volume up and power on a recent iPhone). Both are completely different from iOS's lockdown mode.
kccqzy 4y ago
Enhanced Safe Browsing is not directly comparable with Lockdown Mode. It's only enhanced against phishing attacks. It doesn't do things like turning off unpopular image formats or WebGL or JIT.

Veserv 4y ago

Really, a marketing piece on their own website where they make a extraordinary claim that they can protect against the “most sophisticated digital threats” without any evidence supporting their claim at all, let alone the extraordinary evidence required to actually support such a claim that is generally viewed as impossible by most technically competent individuals, cements their leadership in the security space? It would make much more sense to look at their actual, independently validated security certifications that they advertise: https://support.apple.com/guide/sccc/security-certifications-for-ios-scccfa917cb49/1/web/1.0 https://support.apple.com/guide/sccc/security-certifications... https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11146-ci.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11036-aar.pdf#page217 https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... Where they have only managed to achieve the absolute lowest levels of security. Like, look at that last one, their security validation functionally consists of typing “public unpatched ios vulnerabilities” into Google and certifying that nothing comes up. It is utterly preposterous to claim they have any security expertise against highly skilled attackers at all when that is the limit of their advertised certifications. If they actually want to demonstrate security leadership, they should certify against the highest level, AVA_VAN.5, which actually verifies protection against HIGH attack potential threats instead of the lowest level, AVA_VAN.1, which only verifies protection against BASIC attack potential threats.

saagarjha 4y ago
My favorite part of Hacker News is when commenters just lazily make the same comments again a couple months later, without taking into account what people’s replies to them, and hope nobody will notice: https://news.ycombinator.com/item?id=32007917 https://news.ycombinator.com/item?id=32007917. Seriously though, this is pretty much the textbook definition of bad faith, so don’t do it.
- cmeacham98 4y ago
  Is my browser broken and not displaying some comments I should see? The only response I see there is basically "let's wait and see for Apple to provide more details and/or involve third party researchers", which Apple seems to have not done at all in the last 70 days?

int_19h 4y ago

Edge has something called "Super Duper Secure Mode" (for real) these days: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

nottorp 4y ago

> Apple is just leaps ahead of anyone else Anyone else being ... just Google. It's not like we have many options for mainstream mobile phones. It's easy to be ahead of the competition when the competition's business model is selling your data. One can dream of a day when Apple gets real competition.

user3939382 4y ago

Put a proxy on macOS or iOS and see how both incessantly phone home to Apple, including on both which programs you’re running and when. Apple’s privacy reputation is mostly marketing and boils down to “if anyone’s going to spy on you it’s going to be us!”

s3p 4y ago
Do you read apple's privacy policy? They go to extreme lengths to ensure none of the diagnostic data they collect is personally identifiable without user permission. They invest millions into certain programs [1] to ensure they can collect data in a way that doesn't even point back to any specific identifier. I just don't see how you could equate apple to every other company and accuse them of spying on their users when it is clearly not the case. You have options when it comes to phones and computers and only one fortune 500 company seems seriously committed to keeping their users personal info private. [1] https://www.apple.com/privacy/docs/Differential_Privacy_Overview.pdf https://www.apple.com/privacy/docs/Differential_Privacy_Over...
- user3939382 4y ago
  There’s tons of research on the weakness and reversibility of differential privacy. Privacy doesn’t mean being or making representations that you’re being a good steward of the information you’ve spied on me to collect, it means not collecting it.