5 ms·

>However it is only a matter of time before the radio cannot be fully disabled for some reason or another (oh we just turn on the radio to get guaranteed networ

>However it is only a matter of time before the radio cannot be fully disabled for some reason or another (oh we just turn on the radio to get guaranteed network time as part of our Trusted Cloud Experience that we secure you with!). Once that ship sails the devices will no longer be owned by the users and cannot be trusted. Couldn't this same concern apply to Wi-Fi chips? I fail to see how cellular would change much here. If any company (Apple or anyone else) wanted to do something nefarious like this, they could already do it today.

thfuran 3y ago
But (while you're at home) you control the WiFi access point and so can still ultimately control the traffic. That isn't the case for cellular. Though I think that's ultimately a relatively minute difference. Once you're in that adversarial of a position with your hardware, you ought not trust it.
- WhoAmThing 3y ago
  I think that's the future Apple sees and I agree with it. WiFi is an outdated technology with security flaws. Cellular is encrypted and maintained centrally. For indoor access all you need is an AP repeater and daisy chain that, unlike Wifi which needs to be configured, goes down, etc. Wifi is in the same boat as the 3.5mm headphone jack
  - bigstrat2003 3y ago
    > Wifi is in the same boat as the 3.5mm headphone jack Right, it's an excellent technology that Apple wants to abandon without any valid reason.
    - WhoAmThing 3y ago
      Excellent in what context? Cellular does more or less what WiFi does, but better. Connections are encrypted and centralized without a local network, less risk of security flaws and hacks, your security is not subject to the firmware and setup of the wifi router you are currently on. I easily see this being a thing at some point where we discuss WiFi like its the fax machine. There's absolutely no need for WiFi if you have cellular + internet, it does everything better with less cost and maintenance. Makes no sense to have two chips doing the exact same thing on space-premium hardware such as iPhone
- gumby 3y ago
  > But (while you're at home) you control the WiFi access point and so can still ultimately control the traffic Most people cannot do this. Also an increasing number of people don't have wifi at home but just use their phones.
  - sentientslug 3y ago
    Citation definitely needed for that last point. I know exactly zero people in that situation.
    - EricE 3y ago
      One of my co-workers who teleworks. He's in an apartment where they gate keep internet access with ridiculous fees. It's way cheaper to use his phone, so he does. And since he's in a dense urban area with ample 5G coverage, it's probably faster than the building provided internet.
    - gumby 3y ago
      This has been discussed even on HN; a quick search would have answered your question. Just because your community can afford it doesn't mean everybody can: In 2021, 15% had access only through mobile devices (no wifi): https://www.pewtrusts.org/en/research-and-analysis/fact-sheets/2022/07/how-do-americans-connect-to-the-internet https://www.pewtrusts.org/en/research-and-analysis/fact-shee... > More than 83% of people in the U.S. access the internet on their smartphones, tablets, or other mobile devices. And these devices are the only means of internet connection for 15% of Americans. In general, because mobile access and wireline connections offer different speeds and functionality, consumers tend to view the two types of service as complementary and subscribe to both if they have the means. A govt report (based on older data) points out that 20% of households have no household connectivity, and while various reasons are given ("don't need it" "can't afford it") the unconnected households tend to be the poorest, suggesting cost is a barrier: https://www.ntia.gov/blog/2022/switched-why-are-one-five-us-households-not-online https://www.ntia.gov/blog/2022/switched-why-are-one-five-us-... One of the reasons for going mobile-first, though these households have less spending money.
    - 3y ago
- sleepybrett 3y ago
  Lol from my desk i can see 68 wifi access points.
- deleted 3y ago
  [deleted]
- acdha 3y ago
  > But (while you're at home) you control the WiFi access point and so can still ultimately control the traffic Is this meaningfully true for anyone? Most people can’t view activity at all or block anything, but even people who have some of the skills aren’t going to be able to keep up with the flood of activity on a household network. This is also a fool’s errand if you’re worried about the OS vendor. They have a ton of ways to bury the data (would you know if time.apple.com was getting your data one packet at a time?) and could subtly compromise other things (is this connection to an ad server snuggling out data in the TCP source port or cookies?). I think your last sentence is really the final word here: auditing can help, regulation can help, but I don’t think traffic monitoring is giving more than false confidence for this kind of advanced attack.
  - wolrah 3y ago
    To both of your points, I think there are two different scenarios for which there are two very different answers. For the those who are concerned about mass surveillance, tracking, etc, the fact that those of us who can view activity or block things don't see suspicious traffic is almost as valuable as doing it yourself. Kinda the same "many eyes" theory that applies to malicious code in open source, even if you can't check it yourself you benefit from those who can existing. For those who are concerned about being the specific target of a government or major data company, if you don't have all the skills you're probably best off living like it's 1995.
- wkat4242 3y ago
  Control but not view since everything tends to be encrypted and they can easily do cert pinning.
- EricE 3y ago
  Almost every cable company has open wifi networks on their customer equipment. Right now I can see three such devices in my wifi. All Apple has to do is contract with Comcast, Cox, etc. and bam - as long as your wifi can see one of those companies open networks, the device can connect to these widely distributed wifi networks. Heck I'm pretty sure more than a few smart TVs already do this.
- theshrike79 3y ago
  If we're going full-on moustache twirling evil here, why would they use _your_ wifi? Of course they know which networks are yours and you control them and might monitor them. Your neighbour doesn't care about your data, nor the Starbucks you drive past to get to work. They could make the system connect to one of those and send its Secret Data Exfiltration Package using them. Samsung has already done this with their TVs. If you don't connect it to a wifi, iIt'll just find an open one and connect so it can load ads.
- lencastre 3y ago
  I’m staring at this POS fibergateway router modem with ISP locked down settings with permanent open public Wi-Fi access to ISP subscribers and fixed DNS IPs, who knows what else they can do remotely…

thfuran 3y ago

But (while you're at home) you control the WiFi access point and so can still ultimately control the traffic. That isn't the case for cellular. Though I think that's ultimately a relatively minute difference. Once you're in that adversarial of a position with your hardware, you ought not trust it.

WhoAmThing 3y ago
I think that's the future Apple sees and I agree with it. WiFi is an outdated technology with security flaws. Cellular is encrypted and maintained centrally. For indoor access all you need is an AP repeater and daisy chain that, unlike Wifi which needs to be configured, goes down, etc. Wifi is in the same boat as the 3.5mm headphone jack
- bigstrat2003 3y ago
  > Wifi is in the same boat as the 3.5mm headphone jack Right, it's an excellent technology that Apple wants to abandon without any valid reason.
  - WhoAmThing 3y ago
    Excellent in what context? Cellular does more or less what WiFi does, but better. Connections are encrypted and centralized without a local network, less risk of security flaws and hacks, your security is not subject to the firmware and setup of the wifi router you are currently on. I easily see this being a thing at some point where we discuss WiFi like its the fax machine. There's absolutely no need for WiFi if you have cellular + internet, it does everything better with less cost and maintenance. Makes no sense to have two chips doing the exact same thing on space-premium hardware such as iPhone
gumby 3y ago
> But (while you're at home) you control the WiFi access point and so can still ultimately control the traffic Most people cannot do this. Also an increasing number of people don't have wifi at home but just use their phones.
- sentientslug 3y ago
  Citation definitely needed for that last point. I know exactly zero people in that situation.
  - EricE 3y ago
    One of my co-workers who teleworks. He's in an apartment where they gate keep internet access with ridiculous fees. It's way cheaper to use his phone, so he does. And since he's in a dense urban area with ample 5G coverage, it's probably faster than the building provided internet.
  - gumby 3y ago
    This has been discussed even on HN; a quick search would have answered your question. Just because your community can afford it doesn't mean everybody can: In 2021, 15% had access only through mobile devices (no wifi): https://www.pewtrusts.org/en/research-and-analysis/fact-sheets/2022/07/how-do-americans-connect-to-the-internet https://www.pewtrusts.org/en/research-and-analysis/fact-shee... > More than 83% of people in the U.S. access the internet on their smartphones, tablets, or other mobile devices. And these devices are the only means of internet connection for 15% of Americans. In general, because mobile access and wireline connections offer different speeds and functionality, consumers tend to view the two types of service as complementary and subscribe to both if they have the means. A govt report (based on older data) points out that 20% of households have no household connectivity, and while various reasons are given ("don't need it" "can't afford it") the unconnected households tend to be the poorest, suggesting cost is a barrier: https://www.ntia.gov/blog/2022/switched-why-are-one-five-us-households-not-online https://www.ntia.gov/blog/2022/switched-why-are-one-five-us-... One of the reasons for going mobile-first, though these households have less spending money.
  - 3y ago
sleepybrett 3y ago
Lol from my desk i can see 68 wifi access points.
deleted 3y ago
[deleted]
acdha 3y ago
> But (while you're at home) you control the WiFi access point and so can still ultimately control the traffic Is this meaningfully true for anyone? Most people can’t view activity at all or block anything, but even people who have some of the skills aren’t going to be able to keep up with the flood of activity on a household network. This is also a fool’s errand if you’re worried about the OS vendor. They have a ton of ways to bury the data (would you know if time.apple.com was getting your data one packet at a time?) and could subtly compromise other things (is this connection to an ad server snuggling out data in the TCP source port or cookies?). I think your last sentence is really the final word here: auditing can help, regulation can help, but I don’t think traffic monitoring is giving more than false confidence for this kind of advanced attack.
- wolrah 3y ago
  To both of your points, I think there are two different scenarios for which there are two very different answers. For the those who are concerned about mass surveillance, tracking, etc, the fact that those of us who can view activity or block things don't see suspicious traffic is almost as valuable as doing it yourself. Kinda the same "many eyes" theory that applies to malicious code in open source, even if you can't check it yourself you benefit from those who can existing. For those who are concerned about being the specific target of a government or major data company, if you don't have all the skills you're probably best off living like it's 1995.
wkat4242 3y ago
Control but not view since everything tends to be encrypted and they can easily do cert pinning.
EricE 3y ago
Almost every cable company has open wifi networks on their customer equipment. Right now I can see three such devices in my wifi. All Apple has to do is contract with Comcast, Cox, etc. and bam - as long as your wifi can see one of those companies open networks, the device can connect to these widely distributed wifi networks. Heck I'm pretty sure more than a few smart TVs already do this.
theshrike79 3y ago
If we're going full-on moustache twirling evil here, why would they use _your_ wifi? Of course they know which networks are yours and you control them and might monitor them. Your neighbour doesn't care about your data, nor the Starbucks you drive past to get to work. They could make the system connect to one of those and send its Secret Data Exfiltration Package using them. Samsung has already done this with their TVs. If you don't connect it to a wifi, iIt'll just find an open one and connect so it can load ads.
lencastre 3y ago
I’m staring at this POS fibergateway router modem with ISP locked down settings with permanent open public Wi-Fi access to ISP subscribers and fixed DNS IPs, who knows what else they can do remotely…