3 ms·

>Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integrat

by rany_ 3y ago

>Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps. If alternative browser engines and PWA is enough to pwn iOS, maybe it was never really secure in the first place.

shuckles 3y ago
Why use this extremely indirect signal to evaluate security when the direct signals like exploit markets indicate iOS is among the most secure consumer computing environments ever?
0x457 3y ago
Do you not know how JIT works?
- SkiFire13 3y ago
  How is JIT relevant here? We're talking about removing homescreen shortcuts to PWAs. This doesn't limit JIT in any way.
  - 0x457 3y ago
    Home screen shortcuts have larger sandbox. JIT is a large attack surface because of how JIT works. When there is only browser - Apple can easily push an emergency patch. With 3rd party browsers this isn't possible.
    - SkiFire13 3y ago
      > JIT is a large attack surface because of how JIT works. From the point of view of the OS, a 3rd party application using JIT can't do anything more than a 3rd party application not using JIT, which Apple have to allow anyway. And still it's laughable that the only "mitigation" Apple found was to remove a feature that most people didn't even know about (because Apple made it difficult to even access in the first place!). That surely will have an impact on the security of the 2 people that knew about that feature. By the way, why isn't MacOS so insecure if it allows all sorts of 3rd party apps, with or without JIT, and even allow apps creating shortcuts on the desktop themselves? > When there is only browser - Apple can easily push an emergency patch. With 3rd party browsers this isn't possible. Lot of people don't immediately apply OS updates, and Safari is part of the OS so it cannot be updated in other ways. 3rd party browsers instead can be very quickly updated like any normal apps without even requiring a reboot of the OS. It seems to me that a competent 3rd party app has a better security model than Safari.
- lxgr 3y ago
  They explicitly allow JIT for DMA third-party browser engines (even for embedded engines, I believe, which is technically quite tricky to do compared to for full browser apps!), so that can't be the problem here.
thesz 3y ago
An application may not "pwn" device directly, but it can execute an attack on the out-of-order CPU and steal valuable data.
- lxgr 3y ago
  If you're talking about Spectre-like attacks from within PWAs, the same risk exists for every page you visit using Safari today (and "Firefox EU edition" on iOS tomorrow).

by rany_ 3y ago

shuckles 3y ago

Why use this extremely indirect signal to evaluate security when the direct signals like exploit markets indicate iOS is among the most secure consumer computing environments ever?

0x457 3y ago

Do you not know how JIT works?

SkiFire13 3y ago
How is JIT relevant here? We're talking about removing homescreen shortcuts to PWAs. This doesn't limit JIT in any way.
- 0x457 3y ago
  Home screen shortcuts have larger sandbox. JIT is a large attack surface because of how JIT works. When there is only browser - Apple can easily push an emergency patch. With 3rd party browsers this isn't possible.
  - SkiFire13 3y ago
    > JIT is a large attack surface because of how JIT works. From the point of view of the OS, a 3rd party application using JIT can't do anything more than a 3rd party application not using JIT, which Apple have to allow anyway. And still it's laughable that the only "mitigation" Apple found was to remove a feature that most people didn't even know about (because Apple made it difficult to even access in the first place!). That surely will have an impact on the security of the 2 people that knew about that feature. By the way, why isn't MacOS so insecure if it allows all sorts of 3rd party apps, with or without JIT, and even allow apps creating shortcuts on the desktop themselves? > When there is only browser - Apple can easily push an emergency patch. With 3rd party browsers this isn't possible. Lot of people don't immediately apply OS updates, and Safari is part of the OS so it cannot be updated in other ways. 3rd party browsers instead can be very quickly updated like any normal apps without even requiring a reboot of the OS. It seems to me that a competent 3rd party app has a better security model than Safari.
lxgr 3y ago
They explicitly allow JIT for DMA third-party browser engines (even for embedded engines, I believe, which is technically quite tricky to do compared to for full browser apps!), so that can't be the problem here.

thesz 3y ago

An application may not "pwn" device directly, but it can execute an attack on the out-of-order CPU and steal valuable data.

lxgr 3y ago
If you're talking about Spectre-like attacks from within PWAs, the same risk exists for every page you visit using Safari today (and "Firefox EU edition" on iOS tomorrow).