3 ms·

If someone physically steals my phone, they can’t install a keylogger that loads before the login screen. The sandboxing actually works pretty well and serves

If someone physically steals my phone, they can’t install a keylogger that loads before the login screen. The sandboxing actually works pretty well and serves a useful feature, the PinePhone doesn’t have sandboxing at all (and even Flatpak sandboxing often has massive holes punched through). The iPhone has dozens, if not hundreds, of research organizations working on it to find bugs. Even Apple’s competitors like Google contribute. I have no assurance the PinePhone’s login screen doesn’t have an obvious buffer overflow. If my iPhone does somehow get a virus, no virus has been found that can persist between reboots since iOS 9. Linux, persistence is the default. If an iPhone app gains my PIN code, it’s bad but mostly meaningless to system integrity, which is forbidden at a kernel level from being tampered with by anything. If a Linux app gets your root password, or a privilege escalation bug is found in the many userspace utilities, daemons, or processes, you’re SOL. The iPhone has hardware level features called “mailboxes” in the Secure Enclave, which enforce the limits for how often a PIN can be guessed; making a software bypass impossible and even a 4-digit code relatively safe. PinePhone doesn’t even have secure boot, so loading a tool that runs unlimited guesses could not be easier. Do I need to go on?

mixmastamyk 2y ago
You’re comparing a trillion dollar (of value) product to a thousand dollar one, and then implying the second is failing due to a technical issue. Pine drops hardware and lets other folks do the software work.
- 0x457 2y ago
  To a customer, it's irrelevant.
- scintill76 2y ago
  > > PinePhone doesn’t even have secure boot If GP is correct about that, software won’t fix that limitation in PinePhone hardware. I expect the lack of a secure enclave is a similar story.
- yjftsjthsd-h 2y ago
  To be quite fair, I think the pinephone is technically inferior in some ways; having a TPM and secure boot would let you make the device safer than is currently possible. But that's orthogonal to it being a walled garden; if users could run arbitrary apps downloaded off the internet, iPhones would still be safer, and if the next pinephone includes a TPM and user-controlled secure boot, it would have most of the same security properties while still being completely under the user's control.
  - Arnavion 2y ago
    PinePhone SoC (Allwinner A64) does have the hardware needed for verifying boot via TBBR. It's just that no person or distro uses it for that because the key can only be written once. Also IIRC it's vulnerable to bus snooping.
yjftsjthsd-h 2y ago
> Do I need to go on? It would help; it feels like you're trying to argue in favor of a walled garden but only using arguments that are unrelated. Actually, it kinda feels like you might only be arguing that you think iPhones specifically happen to be really secure in a way that has nothing to do with user freedom at all. In more details: > If someone physically steals my phone, they can’t install a keylogger that loads before the login screen. Fully mitigated by secure boot with user-controlled keys; unrelated to letting the user run whatever they want. Also, perfectly possible to mitigate on a pinephone by just reimaging everything except your encrypted home partition. > The sandboxing actually works pretty well and serves a useful feature, the PinePhone doesn’t have sandboxing at all (and even Flatpak sandboxing often has massive holes punched through). Yes, we agree that the sandbox matters... in fact, much of my point is that once you have a good sandbox it doesn't matter what the user wants to run inside it. (Also, you can use bubblewrap/firejail to sandbox things properly on Linux, it's just less common.) > The iPhone has dozens, if not hundreds, of research organizations working on it to find bugs. Even Apple’s competitors like Google contribute. I have no assurance the PinePhone’s login screen doesn’t have an obvious buffer overflow. Well that one's totally unrelated to letting users run whatever they want. At this point it almost feels like you're trying to just argue that iPhones are pretty robust and have completely given up on whether user control is relevant at all. > If my iPhone does somehow get a virus, no virus has been found that can persist between reboots since iOS 9. Linux, persistence is the default. Default in common distros, sure, but 1. still unrelated to walled garden, and 2. there are immutable distros if that's what you want. > If an iPhone app gains my PIN code, it’s bad but mostly meaningless to system integrity, which is forbidden at a kernel level from being tampered with by anything. If a Linux app gets your root password, or a privilege escalation bug is found in the many userspace utilities, daemons, or processes, you’re SOL. Is iOS somehow immune to privilege escalation bugs? Anyways, if you really want to lock down root selinux does exist, but also... what exactly are we protecting here? At the point where a program has the ability to impersonate the user including their password, we're at https://xkcd.com/1200/ https://xkcd.com/1200/ and you might manage to protect the OS but if you lose all userspace what's the point? > The iPhone has hardware level features called “mailboxes” in the Secure Enclave, which enforce the limits for how often a PIN can be guessed; making a software bypass impossible and even a 4-digit code relatively safe. PinePhone doesn’t even have secure boot, so loading a tool that runs unlimited guesses could not be easier. Again, unrelated to user freedom; the only reason not to add a TPM to the pinephone is cost.

mixmastamyk 2y ago

You’re comparing a trillion dollar (of value) product to a thousand dollar one, and then implying the second is failing due to a technical issue. Pine drops hardware and lets other folks do the software work.

0x457 2y ago
To a customer, it's irrelevant.
scintill76 2y ago
> > PinePhone doesn’t even have secure boot If GP is correct about that, software won’t fix that limitation in PinePhone hardware. I expect the lack of a secure enclave is a similar story.
yjftsjthsd-h 2y ago
To be quite fair, I think the pinephone is technically inferior in some ways; having a TPM and secure boot would let you make the device safer than is currently possible. But that's orthogonal to it being a walled garden; if users could run arbitrary apps downloaded off the internet, iPhones would still be safer, and if the next pinephone includes a TPM and user-controlled secure boot, it would have most of the same security properties while still being completely under the user's control.
- Arnavion 2y ago
  PinePhone SoC (Allwinner A64) does have the hardware needed for verifying boot via TBBR. It's just that no person or distro uses it for that because the key can only be written once. Also IIRC it's vulnerable to bus snooping.

yjftsjthsd-h 2y ago

> Do I need to go on? It would help; it feels like you're trying to argue in favor of a walled garden but only using arguments that are unrelated. Actually, it kinda feels like you might only be arguing that you think iPhones specifically happen to be really secure in a way that has nothing to do with user freedom at all. In more details: > If someone physically steals my phone, they can’t install a keylogger that loads before the login screen. Fully mitigated by secure boot with user-controlled keys; unrelated to letting the user run whatever they want. Also, perfectly possible to mitigate on a pinephone by just reimaging everything except your encrypted home partition. > The sandboxing actually works pretty well and serves a useful feature, the PinePhone doesn’t have sandboxing at all (and even Flatpak sandboxing often has massive holes punched through). Yes, we agree that the sandbox matters... in fact, much of my point is that once you have a good sandbox it doesn't matter what the user wants to run inside it. (Also, you can use bubblewrap/firejail to sandbox things properly on Linux, it's just less common.) > The iPhone has dozens, if not hundreds, of research organizations working on it to find bugs. Even Apple’s competitors like Google contribute. I have no assurance the PinePhone’s login screen doesn’t have an obvious buffer overflow. Well that one's totally unrelated to letting users run whatever they want. At this point it almost feels like you're trying to just argue that iPhones are pretty robust and have completely given up on whether user control is relevant at all. > If my iPhone does somehow get a virus, no virus has been found that can persist between reboots since iOS 9. Linux, persistence is the default. Default in common distros, sure, but 1. still unrelated to walled garden, and 2. there are immutable distros if that's what you want. > If an iPhone app gains my PIN code, it’s bad but mostly meaningless to system integrity, which is forbidden at a kernel level from being tampered with by anything. If a Linux app gets your root password, or a privilege escalation bug is found in the many userspace utilities, daemons, or processes, you’re SOL. Is iOS somehow immune to privilege escalation bugs? Anyways, if you really want to lock down root selinux does exist, but also... what exactly are we protecting here? At the point where a program has the ability to impersonate the user including their password, we're at https://xkcd.com/1200/ https://xkcd.com/1200/ and you might manage to protect the OS but if you lose all userspace what's the point? > The iPhone has hardware level features called “mailboxes” in the Secure Enclave, which enforce the limits for how often a PIN can be guessed; making a software bypass impossible and even a 4-digit code relatively safe. PinePhone doesn’t even have secure boot, so loading a tool that runs unlimited guesses could not be easier. Again, unrelated to user freedom; the only reason not to add a TPM to the pinephone is cost.