4 ms·

Why should that be apples decision to make? There are many software vendors with much better security track records than apple.

tpmoney 1y ago
Because Apple’s reputation (and customer trust in the ecosystem) depends on their security posture, and the less headlines that involve 3rd party applications on your computer being able to read the iPhone clipboard while the phone remains locked the better? Also because people should have the choice to buy a device from a vendor that is locked down if that is what they want.
- _aavaa_ 1y ago
  Nothing about providing the API for this requires that your phone automatically accept such requests. They can change it so that all first requests require confirmation with password.
  - tpmoney 1y ago
    And you can secure your HTTP server and SSH server with credentials too, but if your wanting a secure internal service it’s also probably a good idea to put a firewall in place and only allow access from authorized endpoints. Security isn’t a binary thing. It comes in layers and “no publicly accessible API” is (or at least can be) more secure than “public API”.
    - _aavaa_ 1y ago
      It just so happens that Apple gets to make that decision for us for “our good” and provides us with no say in the matter. Why does Apple get to dictate what is an authorized endpoint for my device?
      - tpmoney 1y ago
        Because they made it and you don't have to buy it. If you don't want a device that's locked down as much as Apple locks down theirs, you can buy any number of alternative devices.
        _aavaa_ 1y ago
        First of all, this is such an anti-consumer sentiment. Voting with our wallets means that those with the biggest wallets dictate the rules. We have the first sale doctoring for a reason. That Apple can get away with this behaviour at the moment is a not a justification for continuing to let them do it. Second of all, which devices? Google is slowly boiling the frog on Android too, see their recent announcement about installing your own apps without their blessing. And before anyone replies about “oh just use android Linux phone, or build your own phone, or don’t use a phone”, that’s not a realistic option for 99.9% of people and it’s ceding ground (see my first point).
- supermatt 1y ago
  Then they should enable interoperability. Either provide a secure platform that others can access, or let third parties offer their own. The whole point of passkeys is to handle remote authentication and authorisation securely - and is effectively what Apple are already doing under the hood. This whole "we can only trust Apple" argument is outdated given modern security standards like FIDO2/WebAuthn and passkeys

tpmoney 1y ago

Because Apple’s reputation (and customer trust in the ecosystem) depends on their security posture, and the less headlines that involve 3rd party applications on your computer being able to read the iPhone clipboard while the phone remains locked the better? Also because people should have the choice to buy a device from a vendor that is locked down if that is what they want.

_aavaa_ 1y ago
Nothing about providing the API for this requires that your phone automatically accept such requests. They can change it so that all first requests require confirmation with password.
- tpmoney 1y ago
  And you can secure your HTTP server and SSH server with credentials too, but if your wanting a secure internal service it’s also probably a good idea to put a firewall in place and only allow access from authorized endpoints. Security isn’t a binary thing. It comes in layers and “no publicly accessible API” is (or at least can be) more secure than “public API”.
  - _aavaa_ 1y ago
    It just so happens that Apple gets to make that decision for us for “our good” and provides us with no say in the matter. Why does Apple get to dictate what is an authorized endpoint for my device?
    - tpmoney 1y ago
      Because they made it and you don't have to buy it. If you don't want a device that's locked down as much as Apple locks down theirs, you can buy any number of alternative devices.
      - _aavaa_ 1y ago
        First of all, this is such an anti-consumer sentiment. Voting with our wallets means that those with the biggest wallets dictate the rules. We have the first sale doctoring for a reason. That Apple can get away with this behaviour at the moment is a not a justification for continuing to let them do it. Second of all, which devices? Google is slowly boiling the frog on Android too, see their recent announcement about installing your own apps without their blessing. And before anyone replies about “oh just use android Linux phone, or build your own phone, or don’t use a phone”, that’s not a realistic option for 99.9% of people and it’s ceding ground (see my first point).
supermatt 1y ago
Then they should enable interoperability. Either provide a secure platform that others can access, or let third parties offer their own. The whole point of passkeys is to handle remote authentication and authorisation securely - and is effectively what Apple are already doing under the hood. This whole "we can only trust Apple" argument is outdated given modern security standards like FIDO2/WebAuthn and passkeys