3 ms·

People should stop pretending Apple products are secure in any sense of the word. Pegasus software and similar have been working just fine on iPhone. For litera

People should stop pretending Apple products are secure in any sense of the word. Pegasus software and similar have been working just fine on iPhone. For literal _years_. Apple is fundamentally incapable and more to the point unwilling, to protect the users from external threats but especially from Apple itself. They are abusing their control over iOS and strip mining the users for data regardless.

stephc_int13 3y ago
Exactly. The alleged superior safety of Apple products is basically a myth. They are not even able (or willing) to curate their own store from blatant scams.
- deleted 3y ago
  [deleted]
frizlab 3y ago
That is not an excuse to make it even more insecure, though.
- _aavaa_ 3y ago
  The horror and insecurity of letting people choose what should go onto their device. Apple's increased security comes at the OS level. The OS prevents apps from accessing my contacts, not Apple's 30% tax.
- pornel 3y ago
  This whole legislation probably wouldn't exist if Apple wasn't so greedy and manipulative for all these years. Apple has been bundling real security with brazen anti-competive behaviors, pretending they're all or nothing. If you don't want to be overcharged 10x for payments, the only option is fraud and malware (as opposed to processing payments at a market rate, or allowing vetted payment providers, having APIs for external subscriptions integrating with iOS's subscription management, etc.). Sandboxing and app reviews for malware are great, but Apple bundled them with rejecting apps for competing with Apple ("duplicating" their functionality), mentioning competitors' names, lower prices elsewhere, or showing nipples anywhere (nipples can't hack your iPhone). They've been intentionally blurring the line between what they select as appropriate for their boutique child-friendly store, and what users have right to do with devices they thought they own.
tpmoney 3y ago
Nation state level malware is an entirely different threat profile to the one most people are worried about when it comes to their non-tech relatives. Most people are more worried about protecting their relatives from the mobile phone equivalent of “Bonzai Buddy”, not “Stuxnet”
- FireBeyond 3y ago
  Like LassPass on the App Store recently? Except in that case, the RDF is still so strong that Gruber literally tried to shrug it off as being "not that expensive, for a scam": > > Instead, the scam LassPass app tries to steer you to creating a “pro” account subscription for $2/month, $10/year, or a $50 lifetime purchase. Those are actually low prices for a scam app — a lot of scammy apps try to charge like $10/week. (emphasis mine) Lucky people, I guess? They could have been scammed for more? He also claims, without any way to know, that "it doesn't look like this was made to steal LastPass credentials". The whole article is very much a "yeah it sucks and shouldn't happen, but this is no big deal, really, why are you getting all up in Apple's face about it?" vibe.
drexlspivey 3y ago
Even if you are targeted by nation states (Pegasus) iOS offers Lockdown Mode. Is there something similar in Android?
threeseed 3y ago
Apple introduced Lockdown Mode in 2022 specifically as a measure against Pegasus: https://www.washingtonpost.com/technology/2022/07/06/apple-spyware-lockdown-pegasus/ https://www.washingtonpost.com/technology/2022/07/06/apple-s...
- TheLoafOfBread 3y ago
  But then you would need to assume that you are infected with this malware at a first place. So do you have Lockdown enabled on your iPhone?
  - threeseed 3y ago
    The purpose of Lockdown is for people who (a) have a reasonable chance of being targeted by state actors and (b) if they were would expect significant impact to their wellbeing. For everyone else the existing security controls are more than sufficient.
  - drexlspivey 3y ago
    You would enable it if you are a high value target that people might hire NSO to go after you like some billionaire or journalist etc.
Uehreka 3y ago
When people say Apple products are secure, we’re not saying they’ll stand up to the world’s top hackers, we’re saying when we visit grandpa we won’t find that he’s installed a toolbar in his browser that’s vacuuming up his bank password every time he types it. I know that if one of my relatives installs a sketchy app suggested by a popup, it can’t sit in the background and snoop on them without even being opened. There’s no Cha$e app in the app store pretending to be the official Chase banking app. For sure it’s still possible to “hack” someone who is using Apple products (using social engineering for instance) but entire classes of mischief are off the table because of how Apple locks things down.

stephc_int13 3y ago

Exactly. The alleged superior safety of Apple products is basically a myth. They are not even able (or willing) to curate their own store from blatant scams.

deleted 3y ago
[deleted]

frizlab 3y ago

That is not an excuse to make it even more insecure, though.

_aavaa_ 3y ago
The horror and insecurity of letting people choose what should go onto their device. Apple's increased security comes at the OS level. The OS prevents apps from accessing my contacts, not Apple's 30% tax.
pornel 3y ago
This whole legislation probably wouldn't exist if Apple wasn't so greedy and manipulative for all these years. Apple has been bundling real security with brazen anti-competive behaviors, pretending they're all or nothing. If you don't want to be overcharged 10x for payments, the only option is fraud and malware (as opposed to processing payments at a market rate, or allowing vetted payment providers, having APIs for external subscriptions integrating with iOS's subscription management, etc.). Sandboxing and app reviews for malware are great, but Apple bundled them with rejecting apps for competing with Apple ("duplicating" their functionality), mentioning competitors' names, lower prices elsewhere, or showing nipples anywhere (nipples can't hack your iPhone). They've been intentionally blurring the line between what they select as appropriate for their boutique child-friendly store, and what users have right to do with devices they thought they own.

tpmoney 3y ago

Nation state level malware is an entirely different threat profile to the one most people are worried about when it comes to their non-tech relatives. Most people are more worried about protecting their relatives from the mobile phone equivalent of “Bonzai Buddy”, not “Stuxnet”

FireBeyond 3y ago
Like LassPass on the App Store recently? Except in that case, the RDF is still so strong that Gruber literally tried to shrug it off as being "not that expensive, for a scam": > > Instead, the scam LassPass app tries to steer you to creating a “pro” account subscription for $2/month, $10/year, or a $50 lifetime purchase. Those are actually low prices for a scam app — a lot of scammy apps try to charge like $10/week. (emphasis mine) Lucky people, I guess? They could have been scammed for more? He also claims, without any way to know, that "it doesn't look like this was made to steal LastPass credentials". The whole article is very much a "yeah it sucks and shouldn't happen, but this is no big deal, really, why are you getting all up in Apple's face about it?" vibe.

drexlspivey 3y ago

Even if you are targeted by nation states (Pegasus) iOS offers Lockdown Mode. Is there something similar in Android?

threeseed 3y ago

Apple introduced Lockdown Mode in 2022 specifically as a measure against Pegasus: https://www.washingtonpost.com/technology/2022/07/06/apple-spyware-lockdown-pegasus/ https://www.washingtonpost.com/technology/2022/07/06/apple-s...

TheLoafOfBread 3y ago
But then you would need to assume that you are infected with this malware at a first place. So do you have Lockdown enabled on your iPhone?
- threeseed 3y ago
  The purpose of Lockdown is for people who (a) have a reasonable chance of being targeted by state actors and (b) if they were would expect significant impact to their wellbeing. For everyone else the existing security controls are more than sufficient.
- drexlspivey 3y ago
  You would enable it if you are a high value target that people might hire NSO to go after you like some billionaire or journalist etc.

Uehreka 3y ago

When people say Apple products are secure, we’re not saying they’ll stand up to the world’s top hackers, we’re saying when we visit grandpa we won’t find that he’s installed a toolbar in his browser that’s vacuuming up his bank password every time he types it. I know that if one of my relatives installs a sketchy app suggested by a popup, it can’t sit in the background and snoop on them without even being opened. There’s no Cha$e app in the app store pretending to be the official Chase banking app. For sure it’s still possible to “hack” someone who is using Apple products (using social engineering for instance) but entire classes of mischief are off the table because of how Apple locks things down.