6 ms·

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. The

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody parrots the nonsense caveat that everyone shouldn't use it, only those special enough should like it was a zero-sum game or scarce resource. Everyone should use it because it disables a lot of nonsense that doesn't serve you and probably even saves battery power. Also, the more people use it, the less it can be used to fingerprint specific users.

s3p 3y ago
> They really do try to talk you out of it. Who? Apple? I can't find any statements from them begging us not to use it. It's also a dumb argument since they can just --not-- release the feature if they don't want us to use it.
andrewia 3y ago
It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromises between the two, perhaps letting you lower your security for a few minutes when you need the extra functionality. For example, Safari could detect when JavaScript is being slow and pop up an offer to re-enable JIT.
- barryrandall 3y ago
  I’d settle for being able to toggle the individual controls (specifically iMessage attachments) instead of full lockdown mode.
  - jiofj 3y ago
    YES! Current lockdown mode proposition of all-or-nothing is inconvenient.
    - klausa 3y ago
      Why increase your security bug surface 2x when you can increase it exponentially!
    - bonestamp2 3y ago
      I assume that inconvenience is intentional -- otherwise everyone would enable it.
    - sneak 3y ago
      You can leave lockdown off, and disable iMessage.
      - runeks 3y ago
        I don't want to disable iMessage, just attachments from unknown contacts.
        cj 3y ago
        Another idea for Apple would simply be quarantining attachments from unknown contacts. E.g. display that an attachment exists but don't download it to the device until a user accepts a "attachment from unknown sender" warning box
        sneak 3y ago
        AFAIK all iMessage attachments (since iOS 14) are quarantined via BlastDoor, any such full system takeover must include at least two escapes: one from BlastDoor, and another from the application sandbox. They also need to cope with ASLR. It's pretty heavy duty even in the most basic default configuration. https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html?m=1 https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime... Upon re-reading this, it seems like crashes in BlastDoor are reported to Apple in real-time. I think this qualifies as "clientside scanning", tbh.
- kbenson 3y ago
  I think attackers would just try to make the system offer to disable security whenever possible then. Anything as easy as clicking an already offered option by the OS itself will be used often enough to negate most of the security benefits of that mode IMO, meaning you deal with it being slower be default and probably not as secure as you think because people will opt out often for convenience, so the worst of both worlds. As I understand it this was a real problem with earlier versions of Windows where it kept asking for admin privileges all the time for simple things, and people got conditioned to just authorize it. They made a concerted effort to provide APIs that didn't require it for most actions to combat this.
- Obscurity4340 3y ago
  I would argue that iMessage is way to problematic to be used safetly, at all. By anyone. Full-stop. It also seems to be the primary attack vector of NSO related zero-days as well and its become known that phone country/area codes have relevance to its chance of succes in past exploits, which suggests a phone/messaging type attack vector.
  - sneak 3y ago
    It's also insecure. The sync keys for iMessage are backed up in the non-e2ee iCloud Backup, which means that iCloud serves as a key escrow for iMessage's e2ee, rendering it useless (as Apple, which is definitively not an endpoint, has a private key of the participant and can read all the messages in real-time). iMessage should be assiduously avoided.
    - Obscurity4340 3y ago
      Was going to mention. iMessage seems to be that golden key thing the FBeye asked them for back in 2015 in San Bernadino (insofar as iCloud itself isn't a/the key itself, already)
    - jxcl 3y ago
      This is less true now, with the option to enable “advanced data protection”. Turning this setting on disables Apple’s access to your iMessage keys along with a bunch of other stuff, though of course if you get locked out, Apple can’t help you
      - rodgerd 3y ago
        Yeah, and this is the sort of thing that I think drives Apple's care in recommending the most secure modes; they don't want people causally turning it on and discovered that they've buggered themselves up.
        glompers 3y ago
        I agree with you; Amazon servers receiving 80,000 or 800,000 requests per second or 8,000,000 is all a different ballgame than it is for 800 individual actual families around the world (or 8,000 or 80,000) to get their telephones totally buggered up before work that morning on any given workday -- just because somebody trustworthy has advised them to play it super safe without making equally sure the listeners were understanding the UX difficulties of recovering their smartphone's functionality in certain mundane use cases, etc, which would ensue. That's a lot of panic to deal with. Apple user help forum volunteers would be helpless to reach all the affected frustrated people.
- n8cpdx 3y ago
  You can turn off lockdown mode per site and per-app in safari. I had to do that to get Obsidian to work, but I also use it for specific trusted sites.
  - vladvasiliu 3y ago
    What do you mean "per-app in safari"? I'd like to turn it on globally, with a single exception: I want to be able to continue using shared photos albums with my two best friends. I don't care enough about JS performance or, more generally, the mobile web, to want to disable it on safari, or even parts of it.
    - n8cpdx 3y ago
      You can disable lockdown mode in web views for specific apps. You do it in settings because those apps don’t have the usual Safari UI for configuring that.
- RetpolineDrama 3y ago
  >And zero-day spyware is usually targeted towards important individuals, Yeah but have you ever had someone ImportantTM's old phone number? What about their IP?
- webninja 3y ago
  The only bothersome issue I see on lockdown mode is not being able to search through text messages anymore :’( Please bring that back (safely) if you can, Apple.
  - bobbylarrybobby 3y ago
    Wait, seriously? Do you know what the rationale is?
- joshspankit 3y ago
  > Apple wants to avoid making iOS feel slower or clunkier than Android Then they should let us selectively disable all background processes
deleted 3y ago
[deleted]
SamuelAdams 3y ago
I use Lockdown Mode on my Mac because I don’t use iMessage, FaceTime, or other apple services on that device. It’s literally just a computer for software dev and maybe YouTube videos. I haven’t noticed any difference with web content either, but I also use Firefox / Chrome instead of Safari. What I would really like to see is options. For example on iOS I use shared photo albums, so it would be nice to keep that feature but disable all the other capabilities.
- Obscurity4340 3y ago
  Ironically, you need it all the more specifically on the devices you like to use those services with. Even moreso than on the devices you don't use them with. The fact of the matter is Lockdown makes iMessage as safe as is possible (I still wouldn't take the risk, personally, but YOLO). It doesn't hurt to be using Lockdown everywhere.
- ramraj07 3y ago
  Sounds like it's not foolproof unless you enable lockdown mode on all devices.
- vladvasiliu 3y ago
  > For example on iOS I use shared photo albums, so it would be nice to keep that feature but disable all the other capabilities. I'm in the same boat. I was a bit confused, since I'm pretty sure I read somewhere that you could selectively disable it for some "apps", but I've never found out how to disable it for photos specifically. My requirements of my phone being otherwise slim, I didn't encounter any other issue with lockdown mode.
- akyuu 3y ago
  > I haven’t noticed any difference with web content either, but I also use Firefox / Chrome instead of Safari Lockdown mode only affects Safari. If you use another browser, it doesn't make any difference. Here are some features that are disabled in Safari when lockdown mode is enabled: - JIT - Remote fonts - WebAssembly - WebGL - WebRTC - PDF Viewer - MP3 Playback - Gamepad API - Web Audio API - Speech Recognition API - MathML - JPEG 2000 - MediaDevices.getUserMedia() You can configure most of those in Firefox and Chrome, but it has to be done manually and cannot be disabled easily on a per-site basis like in Safari.
userbinator 3y ago
Just like disabling JavaScript in the browser by default, or using LTSC versions of Windows --- it's propaganda to keep you on the path they want, and not the path you want, because there are powerful interests in the former direction.
- ramraj07 3y ago
  If this was true Apple would have never released the lockdown mode feature. A good conspiracy theorist will drop a theory when there's clear proof they're not up to anything.
  - userbinator 3y ago
    Much like LTSC and the ability to disable JS still remains, it's merely a concession they don't actually want you to use, and in the case of lockdown mode, serves as a feature to tick off their privacy-oriented marketing.
YeBanKo 3y ago
Lockdown mode disables shared albums, which I use a lot. I would rathe have a full app firewall with configurable profiles instead of lockdown mode.
highwaylights 3y ago
I’ve noticed a lot of things that start going wonky with Lockdown mode on. Continuity seems to go right out the window for me for one, which is something I really rely on. Airplay also seems to become really temperamental. All of this could just be my network but it only seems to have been the case since switching to lockdown mode. Also, screen time requests don’t work which is a real pain.
derefr 3y ago
Capitalist view: If they didn't emphasize it, some first-time Apple customers might be convinced by concerned friends and family to enable Lockdown Mode by default, and then might complain to Apple / return their device because it "doesn't do the things it was advertised to do" (because those features don't work in Lockdown Mode.) Realpolitik view: repressive regimes probably only allow Apple to release devices with this feature available, as long as they don't heavily push it / make it the default. If Lockdown Mode defaulted to "on" in China, and so was used by the majority of users, then Apple would be quickly booted out of China.
- Obscurity4340 3y ago
  Yes, this is the angle I've been trying to capture. Its realpolitik, thank you for helping crystalize that. But I maintain that it extends to the US as well in terms of cooperation with domestic enforcement bodies.
- timfsu 3y ago
  How about the alternative capitalist view that they don't have to spend as much time on QA in lockdown mode? Seems like one of those things that could cause all kinds of unintentrd consequences across apps.
- jbverschoor 3y ago
  Many websites simply don't work with it enabled
nequo 3y ago
> Everyone should use it because it disables a lot of nonsense that doesn't serve you and probably even saves battery power. Lockdown mode acts as a natural ad block which is great (as a reader). But it also disables JIT. I assume this causes wasted CPU cycles and perhaps, on balance, worse battery life?
- Obscurity4340 3y ago
  On the balance, I have found the opposite to my experience. Your phone spends more time passively carrying out a multitude of background tasks and analystics stuff then it does with you actively web browsing.
saghm 3y ago
> Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. If they didn't want people to have all of the background stuff running, they wouldn't put it on there in the first place. It's not super surprising that they want people to use the features (whether "nonsense" or not) that they purposely put there.

s3p 3y ago

> They really do try to talk you out of it. Who? Apple? I can't find any statements from them begging us not to use it. It's also a dumb argument since they can just --not-- release the feature if they don't want us to use it.

andrewia 3y ago

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromises between the two, perhaps letting you lower your security for a few minutes when you need the extra functionality. For example, Safari could detect when JavaScript is being slow and pop up an offer to re-enable JIT.

barryrandall 3y ago
I’d settle for being able to toggle the individual controls (specifically iMessage attachments) instead of full lockdown mode.
- jiofj 3y ago
  YES! Current lockdown mode proposition of all-or-nothing is inconvenient.
  - klausa 3y ago
    Why increase your security bug surface 2x when you can increase it exponentially!
  - bonestamp2 3y ago
    I assume that inconvenience is intentional -- otherwise everyone would enable it.
  - sneak 3y ago
    You can leave lockdown off, and disable iMessage.
    - runeks 3y ago
      I don't want to disable iMessage, just attachments from unknown contacts.
      - cj 3y ago
        Another idea for Apple would simply be quarantining attachments from unknown contacts. E.g. display that an attachment exists but don't download it to the device until a user accepts a "attachment from unknown sender" warning box
        sneak 3y ago
        AFAIK all iMessage attachments (since iOS 14) are quarantined via BlastDoor, any such full system takeover must include at least two escapes: one from BlastDoor, and another from the application sandbox. They also need to cope with ASLR. It's pretty heavy duty even in the most basic default configuration. https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html?m=1 https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime... Upon re-reading this, it seems like crashes in BlastDoor are reported to Apple in real-time. I think this qualifies as "clientside scanning", tbh.
kbenson 3y ago
I think attackers would just try to make the system offer to disable security whenever possible then. Anything as easy as clicking an already offered option by the OS itself will be used often enough to negate most of the security benefits of that mode IMO, meaning you deal with it being slower be default and probably not as secure as you think because people will opt out often for convenience, so the worst of both worlds. As I understand it this was a real problem with earlier versions of Windows where it kept asking for admin privileges all the time for simple things, and people got conditioned to just authorize it. They made a concerted effort to provide APIs that didn't require it for most actions to combat this.
Obscurity4340 3y ago
I would argue that iMessage is way to problematic to be used safetly, at all. By anyone. Full-stop. It also seems to be the primary attack vector of NSO related zero-days as well and its become known that phone country/area codes have relevance to its chance of succes in past exploits, which suggests a phone/messaging type attack vector.
- sneak 3y ago
  It's also insecure. The sync keys for iMessage are backed up in the non-e2ee iCloud Backup, which means that iCloud serves as a key escrow for iMessage's e2ee, rendering it useless (as Apple, which is definitively not an endpoint, has a private key of the participant and can read all the messages in real-time). iMessage should be assiduously avoided.
  - Obscurity4340 3y ago
    Was going to mention. iMessage seems to be that golden key thing the FBeye asked them for back in 2015 in San Bernadino (insofar as iCloud itself isn't a/the key itself, already)
  - jxcl 3y ago
    This is less true now, with the option to enable “advanced data protection”. Turning this setting on disables Apple’s access to your iMessage keys along with a bunch of other stuff, though of course if you get locked out, Apple can’t help you
    - rodgerd 3y ago
      Yeah, and this is the sort of thing that I think drives Apple's care in recommending the most secure modes; they don't want people causally turning it on and discovered that they've buggered themselves up.
      - glompers 3y ago
        I agree with you; Amazon servers receiving 80,000 or 800,000 requests per second or 8,000,000 is all a different ballgame than it is for 800 individual actual families around the world (or 8,000 or 80,000) to get their telephones totally buggered up before work that morning on any given workday -- just because somebody trustworthy has advised them to play it super safe without making equally sure the listeners were understanding the UX difficulties of recovering their smartphone's functionality in certain mundane use cases, etc, which would ensue. That's a lot of panic to deal with. Apple user help forum volunteers would be helpless to reach all the affected frustrated people.
n8cpdx 3y ago
You can turn off lockdown mode per site and per-app in safari. I had to do that to get Obsidian to work, but I also use it for specific trusted sites.
- vladvasiliu 3y ago
  What do you mean "per-app in safari"? I'd like to turn it on globally, with a single exception: I want to be able to continue using shared photos albums with my two best friends. I don't care enough about JS performance or, more generally, the mobile web, to want to disable it on safari, or even parts of it.
  - n8cpdx 3y ago
    You can disable lockdown mode in web views for specific apps. You do it in settings because those apps don’t have the usual Safari UI for configuring that.
RetpolineDrama 3y ago
>And zero-day spyware is usually targeted towards important individuals, Yeah but have you ever had someone ImportantTM's old phone number? What about their IP?
webninja 3y ago
The only bothersome issue I see on lockdown mode is not being able to search through text messages anymore :’( Please bring that back (safely) if you can, Apple.
- bobbylarrybobby 3y ago
  Wait, seriously? Do you know what the rationale is?
joshspankit 3y ago
> Apple wants to avoid making iOS feel slower or clunkier than Android Then they should let us selectively disable all background processes

deleted 3y ago

[deleted]

SamuelAdams 3y ago

I use Lockdown Mode on my Mac because I don’t use iMessage, FaceTime, or other apple services on that device. It’s literally just a computer for software dev and maybe YouTube videos. I haven’t noticed any difference with web content either, but I also use Firefox / Chrome instead of Safari. What I would really like to see is options. For example on iOS I use shared photo albums, so it would be nice to keep that feature but disable all the other capabilities.

Obscurity4340 3y ago
Ironically, you need it all the more specifically on the devices you like to use those services with. Even moreso than on the devices you don't use them with. The fact of the matter is Lockdown makes iMessage as safe as is possible (I still wouldn't take the risk, personally, but YOLO). It doesn't hurt to be using Lockdown everywhere.
ramraj07 3y ago
Sounds like it's not foolproof unless you enable lockdown mode on all devices.
vladvasiliu 3y ago
> For example on iOS I use shared photo albums, so it would be nice to keep that feature but disable all the other capabilities. I'm in the same boat. I was a bit confused, since I'm pretty sure I read somewhere that you could selectively disable it for some "apps", but I've never found out how to disable it for photos specifically. My requirements of my phone being otherwise slim, I didn't encounter any other issue with lockdown mode.
akyuu 3y ago
> I haven’t noticed any difference with web content either, but I also use Firefox / Chrome instead of Safari Lockdown mode only affects Safari. If you use another browser, it doesn't make any difference. Here are some features that are disabled in Safari when lockdown mode is enabled: - JIT - Remote fonts - WebAssembly - WebGL - WebRTC - PDF Viewer - MP3 Playback - Gamepad API - Web Audio API - Speech Recognition API - MathML - JPEG 2000 - MediaDevices.getUserMedia() You can configure most of those in Firefox and Chrome, but it has to be done manually and cannot be disabled easily on a per-site basis like in Safari.

userbinator 3y ago

Just like disabling JavaScript in the browser by default, or using LTSC versions of Windows --- it's propaganda to keep you on the path they want, and not the path you want, because there are powerful interests in the former direction.

ramraj07 3y ago
If this was true Apple would have never released the lockdown mode feature. A good conspiracy theorist will drop a theory when there's clear proof they're not up to anything.
- userbinator 3y ago
  Much like LTSC and the ability to disable JS still remains, it's merely a concession they don't actually want you to use, and in the case of lockdown mode, serves as a feature to tick off their privacy-oriented marketing.

YeBanKo 3y ago

Lockdown mode disables shared albums, which I use a lot. I would rathe have a full app firewall with configurable profiles instead of lockdown mode.

highwaylights 3y ago

I’ve noticed a lot of things that start going wonky with Lockdown mode on. Continuity seems to go right out the window for me for one, which is something I really rely on. Airplay also seems to become really temperamental. All of this could just be my network but it only seems to have been the case since switching to lockdown mode. Also, screen time requests don’t work which is a real pain.

derefr 3y ago

Capitalist view: If they didn't emphasize it, some first-time Apple customers might be convinced by concerned friends and family to enable Lockdown Mode by default, and then might complain to Apple / return their device because it "doesn't do the things it was advertised to do" (because those features don't work in Lockdown Mode.) Realpolitik view: repressive regimes probably only allow Apple to release devices with this feature available, as long as they don't heavily push it / make it the default. If Lockdown Mode defaulted to "on" in China, and so was used by the majority of users, then Apple would be quickly booted out of China.

Obscurity4340 3y ago
Yes, this is the angle I've been trying to capture. Its realpolitik, thank you for helping crystalize that. But I maintain that it extends to the US as well in terms of cooperation with domestic enforcement bodies.
timfsu 3y ago
How about the alternative capitalist view that they don't have to spend as much time on QA in lockdown mode? Seems like one of those things that could cause all kinds of unintentrd consequences across apps.
jbverschoor 3y ago
Many websites simply don't work with it enabled

nequo 3y ago

> Everyone should use it because it disables a lot of nonsense that doesn't serve you and probably even saves battery power. Lockdown mode acts as a natural ad block which is great (as a reader). But it also disables JIT. I assume this causes wasted CPU cycles and perhaps, on balance, worse battery life?

Obscurity4340 3y ago
On the balance, I have found the opposite to my experience. Your phone spends more time passively carrying out a multitude of background tasks and analystics stuff then it does with you actively web browsing.

saghm 3y ago

> Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. If they didn't want people to have all of the background stuff running, they wouldn't put it on there in the first place. It's not super surprising that they want people to use the features (whether "nonsense" or not) that they purposely put there.