4 ms·

iPhone: Why Apple is working hard to break into its own phones

11 points by alwillis 3y ago

trealira 3y ago
I think it's great that they're working to provide some sort of protection against spyware like Pegasus, and investing into cyber security and rewarding bug bounties more liberally. It makes me wonder if they'll spend time formally verifying the most critical components of their software for further security assurances. The part about why Apple is against the EU making them allow users to sideload apps, I didn't quite understand. Could someone who understands what Krstić meant please reword it? These last two paragraphs I don't understand, and the first is just for context. Krstić does not agree, and Apple has been explicit in its opposition to sideloading. The idea that people are being given an extra choice – including the choice of sticking with the App Store and keeping its protections – is a false one, he says with some frustration. “That’s a great misunderstanding – and one we have tried to explain over and over. The reality of what the alternative distribution requirements enable is that software that users in Europe need to use – sometimes business software, other times personal software, social software, things that they want to use – may only be available outside of the store, alternatively distributed. “In that case, those users don’t have a choice to get that software from a distribution mechanism that they trust. And so, in fact, it is simply not the case that users will retain the choice they have today to get all of their software from the App Store.”
- isodev 3y ago
  It means that by forcing Apple to allow sideloading, there will be app makers who won’t publish their apps to the store. As a result, people who must use such an app will be forced to sideload it without the option to use the safer download from the App Store.
  - trealira 3y ago
    Thanks for the summary. That makes sense as an argument.
  - gloryjulio 3y ago
    Or I could use firefox which is a safer option
    - isodev 3y ago
      No it isn’t, because we’re talking about apps. And regarding the browser ;-), without WebKit, it will probably take Mozilla a decade before they make an iOS engine that doesn’t try to melt your phone (remember how long it took for Firefox on the Mac to not make your fans spin up)
      - lopis 3y ago
        Mozilla has been working on an iOS port for years, waiting for EU to force the platform open. They just can't release it. And their engine on android has been rewritten recently, so I don't understand why it would take them decades.
        isodev 3y ago
        I was being sarcastic - At a point in time I used to be a Firefox user but after years of suboptimal experience on macOS I was happy to move on. No idea what Mozilla is up to these days, I hear Google kind of owns them, so Firefox on iOS will be whatever big G asks them to be.
        gloryjulio 3y ago
        > At a point in time I used to be a Firefox user but after years of suboptimal experience on macOS I was happy to move on. You might not be using it but the there are still many people that do. Firefox is fine especially when you have multiple OSes and you could have a single profile with extensions synced. How are you using ublock and the sorts of the privacy extensions on chrome? > Firefox on iOS will be whatever big G asks them to be. Has firefox removed manifest v3 or implemented web integrity api because of Google? Or are you saying firefox is gonna do those just for the ios version? Isn't that assumption more ridiculous?
      - 3y ago
hulitu 3y ago
> Unlike with software, where even significant security holes can be fixed relatively simply with a security update, Especially when everybody knows about them (0 days exployted for years by NGO). /s
m463 3y ago
The sideloading part is a load of malarky. The one reason I would like sideloading is being able to secure my phone, even (especially) against apple itself. If you need any evidence of this, just set up a new iphone. You cannot do it without contacting apple's servers. After that you will quickly get to their privacy page, which is hundreds or thousands of pages long. But there is no setting, nothing you can do. It is clear they want data from your phone, continuously and promiscuously. Why can't we say no?
- dagmx 3y ago
  Side loading wouldn’t help you with that. What you’re describing is the activation lock, there as a theft deterrent. It happens before any point you’d be able to side load. After that point, you can setup the phone completely offline.
  - m463 3y ago
    > sideloading will not help with that folks will be able to create a "little snitch" or other firewall apps without asking apple permission (unless apple is locking down their phone right now in preparation) > After that point, you can setup the phone completely offline. you cannot. It continues to contact apple and others unless you turn off wifi, bluetooth and cellular data. It might contact apple through NFC/find my as well (I'm uncertain with default settings) (wifi will auto-connect to some APs depending on carrier settings. bluetooth does all kinds of stuff including ibeacon.)

11 points by alwillis 3y ago

I think it's great that they're working to provide some sort of protection against spyware like Pegasus, and investing into cyber security and rewarding bug bounties more liberally. It makes me wonder if they'll spend time formally verifying the most critical components of their software for further security assurances. The part about why Apple is against the EU making them allow users to sideload apps, I didn't quite understand. Could someone who understands what Krstić meant please reword it? These last two paragraphs I don't understand, and the first is just for context. Krstić does not agree, and Apple has been explicit in its opposition to sideloading. The idea that people are being given an extra choice – including the choice of sticking with the App Store and keeping its protections – is a false one, he says with some frustration. “That’s a great misunderstanding – and one we have tried to explain over and over. The reality of what the alternative distribution requirements enable is that software that users in Europe need to use – sometimes business software, other times personal software, social software, things that they want to use – may only be available outside of the store, alternatively distributed. “In that case, those users don’t have a choice to get that software from a distribution mechanism that they trust. And so, in fact, it is simply not the case that users will retain the choice they have today to get all of their software from the App Store.”

isodev 3y ago
It means that by forcing Apple to allow sideloading, there will be app makers who won’t publish their apps to the store. As a result, people who must use such an app will be forced to sideload it without the option to use the safer download from the App Store.
- trealira 3y ago
  Thanks for the summary. That makes sense as an argument.
- gloryjulio 3y ago
  Or I could use firefox which is a safer option
  - isodev 3y ago
    No it isn’t, because we’re talking about apps. And regarding the browser ;-), without WebKit, it will probably take Mozilla a decade before they make an iOS engine that doesn’t try to melt your phone (remember how long it took for Firefox on the Mac to not make your fans spin up)
    - lopis 3y ago
      Mozilla has been working on an iOS port for years, waiting for EU to force the platform open. They just can't release it. And their engine on android has been rewritten recently, so I don't understand why it would take them decades.
      - isodev 3y ago
        I was being sarcastic - At a point in time I used to be a Firefox user but after years of suboptimal experience on macOS I was happy to move on. No idea what Mozilla is up to these days, I hear Google kind of owns them, so Firefox on iOS will be whatever big G asks them to be.
        gloryjulio 3y ago
        > At a point in time I used to be a Firefox user but after years of suboptimal experience on macOS I was happy to move on. You might not be using it but the there are still many people that do. Firefox is fine especially when you have multiple OSes and you could have a single profile with extensions synced. How are you using ublock and the sorts of the privacy extensions on chrome? > Firefox on iOS will be whatever big G asks them to be. Has firefox removed manifest v3 or implemented web integrity api because of Google? Or are you saying firefox is gonna do those just for the ios version? Isn't that assumption more ridiculous?
    - 3y ago

hulitu 3y ago

> Unlike with software, where even significant security holes can be fixed relatively simply with a security update, Especially when everybody knows about them (0 days exployted for years by NGO). /s

m463 3y ago

The sideloading part is a load of malarky. The one reason I would like sideloading is being able to secure my phone, even (especially) against apple itself. If you need any evidence of this, just set up a new iphone. You cannot do it without contacting apple's servers. After that you will quickly get to their privacy page, which is hundreds or thousands of pages long. But there is no setting, nothing you can do. It is clear they want data from your phone, continuously and promiscuously. Why can't we say no?

dagmx 3y ago
Side loading wouldn’t help you with that. What you’re describing is the activation lock, there as a theft deterrent. It happens before any point you’d be able to side load. After that point, you can setup the phone completely offline.
- m463 3y ago
  > sideloading will not help with that folks will be able to create a "little snitch" or other firewall apps without asking apple permission (unless apple is locking down their phone right now in preparation) > After that point, you can setup the phone completely offline. you cannot. It continues to contact apple and others unless you turn off wifi, bluetooth and cellular data. It might contact apple through NFC/find my as well (I'm uncertain with default settings) (wifi will auto-connect to some APs depending on carrier settings. bluetooth does all kinds of stuff including ibeacon.)