7 ms·

> it seems it is most further ahead of the mainstream OSes Noob here, I recall often hearing that iOS has superior security to Android. Has this situation reve

by andai 4y ago

> it seems it is most further ahead of the mainstream OSes Noob here, I recall often hearing that iOS has superior security to Android. Has this situation reversed in the last few years, or was it never true?

transpute 4y ago
> Running blobs traditionally run in higher exception levels (like ARM EL2) in a restricted, mutually untrusted VM The pKVM hypervisor is new to Android 13 and requires Pixel 7 hardware, both of which are a few months old.
- milkey_mouse 4y ago
  pKVM (theoretically) works on Pixel 6, 6 Pro, and 6a as well.
lrem 4y ago
Isn’t most of the value here in not allowing sideloading? In iOS your grandma/child cannot be tricked into clicking “allow apps from untrusted sources”, which is how most breaches happen.
- gkbrk 4y ago
  If the apps sandboxed, how can installing an app cause breaches? As far as I know, iOS apps are sandboxed. Either the sandbox is very weak and Apple instead relies on App Store audits, or they disallow users installing apps outside the app store to protect their 30% tax that makes them a LOT of money.
  - Consultant32452 4y ago
    The sandboxes are regularly breached. Basically any time you hear about people "rooting" their phones, that's an intentional sandbox breach.
    - charcircuit 4y ago
      Not always. Unlocking the bootloader doesn't breach the sandbox since it factory resets the device.
  - lrem 4y ago
    When you’re tricked into installing a nasty app, you’re likely also tricked into giving it whatever permissions it needs for the nastiness.
    - phyphy 4y ago
      Which is not the fault of the OS
      - fragmede 4y ago
        who's fault is it then, if not the OS? that's basically the os's job; to isolate and manage the system's resources and access to them therin
        qu4z-2 4y ago
        At the direction of the device owner, though.
    - fragmede 4y ago
      the malicious app, even signed off the app store could also exploit unpublished vulnerabilities to gain elevated access and not require asking for permission. even or especially if it's not a full sandbox escape.
- rkachowski 4y ago
  Is that true? the process of sideloading and running a 3rd party app is pretty far from simple, trivial or even easy to explain to a grandma / child.
- abirch 4y ago
  I think Apple will have to allow different stores in Europe soon. It'll be interesting to see what happens.
bo1024 4y ago
Maybe you're thinking of privacy, not security? In terms of privacy, Android is "compromised" by default, i.e. Google collects and stores a ton of private information about you. I believe Apple used to be much better, and still is, but getting worse.
- jacooper 4y ago
  Both are one the same level at this point.
  - aio2 4y ago
    It seems before, Apple was trying to gain a monopoly. Now that it has enough users, it turns to tracking. However, this is a speculation, so please take it as a grain of salt.
    - jacooper 4y ago
      More like tracking monopoly https://www.macrumors.com/2022/11/15/apple-employees-unhappy-with-ads-for-iphone-users/ https://www.macrumors.com/2022/11/15/apple-employees-unhappy...
  - fsflover 4y ago
    Not the same, but similar enough: https://news.ycombinator.com/item?id=26639261 https://news.ycombinator.com/item?id=26639261.
- doc_gunthrop 4y ago
  > In terms of privacy, Android is "compromised" by default, i.e. Google collects and stores a ton of private information about you. Apple also does the same. Also, this only applies if you're running an Android device "out-of-the-box". Fortunately, there exist AOSP forks that mitigate this type of intrusion (e.g. GrapheneOS).
  - roydivision 4y ago
    Apple may collect some minimal information, but the crucial difference is that that data is not the basis of Apple's business model.
lrvick 4y ago
iOS is a proprietary OS making security research unreasonably difficult with new setbacks on every new version. It can only be regarded as reasonably private and secure if you trust the Apple marketing team.
- ghostpepper 4y ago
  My understanding is that Apple has gotten a lot better about this with their bug bounty payouts and providing debug hardware to researchers, and it’s not like there’s not a ton of proprietary code running on most consumer android devices. I would also assume the fact that their vertical integration all the way down to silicon is an advantage here as well.
  - lrvick 4y ago
    In Android you at least have the choice to run a fully open source OS and open source apps, albeit with some driver blobs. With the exception of the blobs, everything on Android is auditable. Meanwhile very little of MacOS or iOS is auditable. Personally I do not use or trust any of the above, but if forced to choose Android is worlds ahead of iOS in terms of publicly auditable privacy and security. You cannot form reasonable confidence something is secure unless it can be readily audited by yourself or capable unbiased third parties of your choosing. This means source code availability is a hard requirement for any security claims. Even if you had teams de-compile everything you could never keep up with updates. Not all open source code is secure, but all secure code is open source.
  - Godel_unicode 4y ago
    Better, sure. A lot better? Definitely not. The bug bounty is pretty hard to actually get access to, there’s still no source outside of the kernel, and the Security Research Devices are really hard to get access to. You have to be someone they’ve heard of, in a country they approve of, you can’t move the device around, and you have to sign your life away to get it for 12* months.
  - aio2 4y ago
    What @Irvick is talking about is the fact that you have more freedom to test the security in an Android than in iOS, such as being able to flash other systems.
ccouzens 4y ago
The price of an Android zero day has been slightly higher than the price of an iOS zero day since late 2019. Make of that what you like https://zerodium.com/program.html https://zerodium.com/program.html I suspect remarkably few people are qualified to objectively say which is more secure. If you're an expert on one, you're unlikely to be an expert on the other. Security is multidimensional. It's unlikely there will be a platform that's more secure from every possible angle. What's secure for you might not be secure for a less technical person, or a world traveler.

by andai 4y ago

transpute 4y ago

> Running blobs traditionally run in higher exception levels (like ARM EL2) in a restricted, mutually untrusted VM The pKVM hypervisor is new to Android 13 and requires Pixel 7 hardware, both of which are a few months old.

milkey_mouse 4y ago
pKVM (theoretically) works on Pixel 6, 6 Pro, and 6a as well.

lrem 4y ago

Isn’t most of the value here in not allowing sideloading? In iOS your grandma/child cannot be tricked into clicking “allow apps from untrusted sources”, which is how most breaches happen.

gkbrk 4y ago
If the apps sandboxed, how can installing an app cause breaches? As far as I know, iOS apps are sandboxed. Either the sandbox is very weak and Apple instead relies on App Store audits, or they disallow users installing apps outside the app store to protect their 30% tax that makes them a LOT of money.
- Consultant32452 4y ago
  The sandboxes are regularly breached. Basically any time you hear about people "rooting" their phones, that's an intentional sandbox breach.
  - charcircuit 4y ago
    Not always. Unlocking the bootloader doesn't breach the sandbox since it factory resets the device.
- lrem 4y ago
  When you’re tricked into installing a nasty app, you’re likely also tricked into giving it whatever permissions it needs for the nastiness.
  - phyphy 4y ago
    Which is not the fault of the OS
    - fragmede 4y ago
      who's fault is it then, if not the OS? that's basically the os's job; to isolate and manage the system's resources and access to them therin
      - qu4z-2 4y ago
        At the direction of the device owner, though.
  - fragmede 4y ago
    the malicious app, even signed off the app store could also exploit unpublished vulnerabilities to gain elevated access and not require asking for permission. even or especially if it's not a full sandbox escape.
rkachowski 4y ago
Is that true? the process of sideloading and running a 3rd party app is pretty far from simple, trivial or even easy to explain to a grandma / child.
abirch 4y ago
I think Apple will have to allow different stores in Europe soon. It'll be interesting to see what happens.

bo1024 4y ago

Maybe you're thinking of privacy, not security? In terms of privacy, Android is "compromised" by default, i.e. Google collects and stores a ton of private information about you. I believe Apple used to be much better, and still is, but getting worse.

jacooper 4y ago
Both are one the same level at this point.
- aio2 4y ago
  It seems before, Apple was trying to gain a monopoly. Now that it has enough users, it turns to tracking. However, this is a speculation, so please take it as a grain of salt.
  - jacooper 4y ago
    More like tracking monopoly https://www.macrumors.com/2022/11/15/apple-employees-unhappy-with-ads-for-iphone-users/ https://www.macrumors.com/2022/11/15/apple-employees-unhappy...
- fsflover 4y ago
  Not the same, but similar enough: https://news.ycombinator.com/item?id=26639261 https://news.ycombinator.com/item?id=26639261.
doc_gunthrop 4y ago
> In terms of privacy, Android is "compromised" by default, i.e. Google collects and stores a ton of private information about you. Apple also does the same. Also, this only applies if you're running an Android device "out-of-the-box". Fortunately, there exist AOSP forks that mitigate this type of intrusion (e.g. GrapheneOS).
- roydivision 4y ago
  Apple may collect some minimal information, but the crucial difference is that that data is not the basis of Apple's business model.

lrvick 4y ago

iOS is a proprietary OS making security research unreasonably difficult with new setbacks on every new version. It can only be regarded as reasonably private and secure if you trust the Apple marketing team.

ghostpepper 4y ago
My understanding is that Apple has gotten a lot better about this with their bug bounty payouts and providing debug hardware to researchers, and it’s not like there’s not a ton of proprietary code running on most consumer android devices. I would also assume the fact that their vertical integration all the way down to silicon is an advantage here as well.
- lrvick 4y ago
  In Android you at least have the choice to run a fully open source OS and open source apps, albeit with some driver blobs. With the exception of the blobs, everything on Android is auditable. Meanwhile very little of MacOS or iOS is auditable. Personally I do not use or trust any of the above, but if forced to choose Android is worlds ahead of iOS in terms of publicly auditable privacy and security. You cannot form reasonable confidence something is secure unless it can be readily audited by yourself or capable unbiased third parties of your choosing. This means source code availability is a hard requirement for any security claims. Even if you had teams de-compile everything you could never keep up with updates. Not all open source code is secure, but all secure code is open source.
- Godel_unicode 4y ago
  Better, sure. A lot better? Definitely not. The bug bounty is pretty hard to actually get access to, there’s still no source outside of the kernel, and the Security Research Devices are really hard to get access to. You have to be someone they’ve heard of, in a country they approve of, you can’t move the device around, and you have to sign your life away to get it for 12* months.
- aio2 4y ago
  What @Irvick is talking about is the fact that you have more freedom to test the security in an Android than in iOS, such as being able to flash other systems.

ccouzens 4y ago

The price of an Android zero day has been slightly higher than the price of an iOS zero day since late 2019. Make of that what you like https://zerodium.com/program.html https://zerodium.com/program.html I suspect remarkably few people are qualified to objectively say which is more secure. If you're an expert on one, you're unlikely to be an expert on the other. Security is multidimensional. It's unlikely there will be a platform that's more secure from every possible angle. What's secure for you might not be secure for a less technical person, or a world traveler.