4 ms·

Really, a marketing piece on their own website where they make a extraordinary claim that they can protect against the “most sophisticated digital threats” with

by Veserv 4y ago

Really, a marketing piece on their own website where they make a extraordinary claim that they can protect against the “most sophisticated digital threats” without any evidence supporting their claim at all, let alone the extraordinary evidence required to actually support such a claim that is generally viewed as impossible by most technically competent individuals, cements their leadership in the security space? It would make much more sense to look at their actual, independently validated security certifications that they advertise: https://support.apple.com/guide/sccc/security-certifications-for-ios-scccfa917cb49/1/web/1.0 https://support.apple.com/guide/sccc/security-certifications... https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11146-ci.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11036-aar.pdf#page217 https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... Where they have only managed to achieve the absolute lowest levels of security. Like, look at that last one, their security validation functionally consists of typing “public unpatched ios vulnerabilities” into Google and certifying that nothing comes up. It is utterly preposterous to claim they have any security expertise against highly skilled attackers at all when that is the limit of their advertised certifications. If they actually want to demonstrate security leadership, they should certify against the highest level, AVA_VAN.5, which actually verifies protection against HIGH attack potential threats instead of the lowest level, AVA_VAN.1, which only verifies protection against BASIC attack potential threats.

saagarjha 4y ago
My favorite part of Hacker News is when commenters just lazily make the same comments again a couple months later, without taking into account what people’s replies to them, and hope nobody will notice: https://news.ycombinator.com/item?id=32007917 https://news.ycombinator.com/item?id=32007917. Seriously though, this is pretty much the textbook definition of bad faith, so don’t do it.
- cmeacham98 4y ago
  Is my browser broken and not displaying some comments I should see? The only response I see there is basically "let's wait and see for Apple to provide more details and/or involve third party researchers", which Apple seems to have not done at all in the last 70 days?
  - saagarjha 4y ago
    The comment has been downvoted so it might be invisible to you unless you have showdead enabled.
- Veserv 4y ago
  Their lack of any independent audits of their claims continues to be relevant. Please point to a single third party who is competent to evaluate if they can actually protect against the “most sophisticated digital threats” that has actually supported Apple’s claims. Valid third parties include, but are not limited to, any national security agency or premier hacking organization with hundreds of members (i.e. actual “most sophisticated digital threats”) declaring it can protect against them, any individual or organization who has designed and implemented such a system in the past agreeing Apple has created such a system, or any certification body who has reliably certified such systems with low rates of false positives such as the Common Criteria. Invalid support includes, but is not limited to, certification bodies that give Windows their highest security rating, marketing articles, individual hackers of no particular renown, and claims of it being “better” or “harder” without even being able to quantify where in a multiple order of magnitude range it lies.
  - pyinstallwoes 4y ago
    Who says an auditor is to be trusted?
    - karottenreibe 4y ago
      Trust in this context is obviously not 1 or 0 but a sliding scale and some organizations are higher on that scale than others based on past conduct, as the previous poster pointed out at length. If you don't trust anyone but yourself, you'll have to do the audit yourself. How do you suggest to do that? An auditor with a good track record seems like the most trustworthy practically feasible alternative to me.
      - pyinstallwoes 4y ago
        I don’t think your feasible alternative is assessing the massively skewed information asymmetry at play. Given you are the most successful computer company on the planet, and the entire planet is connected by your products within two degrees of separation in a network; then the only thing you gain is a loss as any auditor is in a position of being unmatched in every category at best and at worst is an active agent who will dissipate information increasing vulnerability and attack surface. Bug bounties work well to solve this, and that’s how it’s done.

by Veserv 4y ago

saagarjha 4y ago

My favorite part of Hacker News is when commenters just lazily make the same comments again a couple months later, without taking into account what people’s replies to them, and hope nobody will notice: https://news.ycombinator.com/item?id=32007917 https://news.ycombinator.com/item?id=32007917. Seriously though, this is pretty much the textbook definition of bad faith, so don’t do it.

cmeacham98 4y ago
Is my browser broken and not displaying some comments I should see? The only response I see there is basically "let's wait and see for Apple to provide more details and/or involve third party researchers", which Apple seems to have not done at all in the last 70 days?
- saagarjha 4y ago
  The comment has been downvoted so it might be invisible to you unless you have showdead enabled.
Veserv 4y ago
Their lack of any independent audits of their claims continues to be relevant. Please point to a single third party who is competent to evaluate if they can actually protect against the “most sophisticated digital threats” that has actually supported Apple’s claims. Valid third parties include, but are not limited to, any national security agency or premier hacking organization with hundreds of members (i.e. actual “most sophisticated digital threats”) declaring it can protect against them, any individual or organization who has designed and implemented such a system in the past agreeing Apple has created such a system, or any certification body who has reliably certified such systems with low rates of false positives such as the Common Criteria. Invalid support includes, but is not limited to, certification bodies that give Windows their highest security rating, marketing articles, individual hackers of no particular renown, and claims of it being “better” or “harder” without even being able to quantify where in a multiple order of magnitude range it lies.
- pyinstallwoes 4y ago
  Who says an auditor is to be trusted?
  - karottenreibe 4y ago
    Trust in this context is obviously not 1 or 0 but a sliding scale and some organizations are higher on that scale than others based on past conduct, as the previous poster pointed out at length. If you don't trust anyone but yourself, you'll have to do the audit yourself. How do you suggest to do that? An auditor with a good track record seems like the most trustworthy practically feasible alternative to me.
    - pyinstallwoes 4y ago
      I don’t think your feasible alternative is assessing the massively skewed information asymmetry at play. Given you are the most successful computer company on the planet, and the entire planet is connected by your products within two degrees of separation in a network; then the only thing you gain is a loss as any auditor is in a position of being unmatched in every category at best and at worst is an active agent who will dissipate information increasing vulnerability and attack surface. Bug bounties work well to solve this, and that’s how it’s done.