3 ms·

Because sandboxing on iOS is terrible. Not that any of the other commercial vendors are any better. If they could provide good sandboxes do you think the highe

by Veserv 3y ago

Because sandboxing on iOS is terrible. Not that any of the other commercial vendors are any better. If they could provide good sandboxes do you think the highest security certifications advertised on their website [1][2] would only certify protection against attackers with “basic attack potential”, the lowest possible level. Three whole levels below “moderate attack potential”. I mean, seriously, they certify their security sucks on their website, is it any wonder their security sucks. [1] https://support.apple.com/guide/certifications/ios-security-certifications-apc3fa917cb49/1/web/1.0 https://support.apple.com/guide/certifications/ios-security-... [2] https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11238-ci.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE...

barsonme 3y ago
From a security perspective, Common Criteria certification isn’t particularly meaningful. Plus, it’s not really worth getting certified at a higher level than you need. Why expend extra effort?
- Veserv 3y ago
  No. From a security perspective a Common Criteria certification to the lowest possible level does not establish meaningful security. That is kind of the point. The companies that develop easily hacked systems that are repeatedly hacked hundreds of times a year like Apple, Microsoft, Cisco, Amazon, Google, etc. can only achieve certification levels indicating they are easily hacked. They have never once succeeded at certifying meaningful security. The certification is pinpoint accurate, just the trillion dollar commercial IT companies do not like the results. I agree it is largely not a useful differentiator, but that is because all of the commercial IT vendors are certified incompetent. The Common Criteria will not help you determine which fish in the barrel is hardest to shoot. Its job is to distinguish serious security by professionals.

by Veserv 3y ago

barsonme 3y ago

From a security perspective, Common Criteria certification isn’t particularly meaningful. Plus, it’s not really worth getting certified at a higher level than you need. Why expend extra effort?

Veserv 3y ago
No. From a security perspective a Common Criteria certification to the lowest possible level does not establish meaningful security. That is kind of the point. The companies that develop easily hacked systems that are repeatedly hacked hundreds of times a year like Apple, Microsoft, Cisco, Amazon, Google, etc. can only achieve certification levels indicating they are easily hacked. They have never once succeeded at certifying meaningful security. The certification is pinpoint accurate, just the trillion dollar commercial IT companies do not like the results. I agree it is largely not a useful differentiator, but that is because all of the commercial IT vendors are certified incompetent. The Common Criteria will not help you determine which fish in the barrel is hardest to shoot. Its job is to distinguish serious security by professionals.