3 ms·

Whenever I point out that Apple's "security by obscurity" strategy is a complete failure I get downvotes. Person suspecting their iPhone has been hacked has no

Whenever I point out that Apple's "security by obscurity" strategy is a complete failure I get downvotes. Person suspecting their iPhone has been hacked has no way to check it. Apple only offer cope mechanism in form of "lockdown mode", which likely can be bypassed just as well. This situation shows that Apple devices are not secure and liability. They'll likely protect your grandma from getting low effort malware, but if you are a CEO - buy something else.

tptacek 8mo ago
What do you mean by "security by obscurity"? What's your comparand that doesn't have the same software defects iPhone-targeting CNE is exploiting?
- varispeed 8mo ago
  One for instance is that Apple doesn't offer an API for deep system scanning. So if your phone is infected, you have no way of knowing this, because there is no software that can scan it. You cannot trust it. Or things like Memory Tagging Extension (MTE) Apple has implemented, but they have not released specification and implementation details, so you don't know if it has backdoors.
  - EPWN3D 8mo ago
    I don't think you know what security by obscurity is.
    - alwillis 8mo ago
      He sure doesn’t.
  - alwillis 8mo ago
    > So if your phone is infected, you have no way of knowing this, because there is no software that can scan it. You cannot trust it. Not true. There are commercial apps that can scan your iPhone for vulnerabilities and exploits [1]. Apple goes through ridiculous lengths regarding security on their platforms [2]. > Memory Tagging Extension (MTE) Apple has implemented, but they have not released the specification. It's based on the Memory Tagging Extension (MTE) added to the ARMv8.5 architecture in 2019, co-designed by ARM and Google [3]. MTE support has recently been added to Android 12+ and some Linux distros like recent Fedora and Ubuntu 24.04. Apple's Memory Integrity Enforcement (MIE) is based on MTE. Now that Apple designs its own ARM-based processors, they used MTE as a starting point for Apple Silicon. The iPhone 17 series and the iPhone Air shipped with MIE enabled in September. The point of these technologies is to enable software that hasn't been written in memory-safe languages (many millions of lines of C, C++, etc. that will never be rewritten) to run safely. Although it's starting to change, the vast majority of the rendering engines used by Safari, Chrome, and Firefox are written in C/C++; so it makes sense to address potential browser vulnerabilities at the hardware level. [1]: https://iverify.io/products/enterprise-protection https://iverify.io/products/enterprise-protection [2]: https://support.apple.com/guide/security/toc https://support.apple.com/guide/security/toc [3]: https://www.usenix.org/system/files/login/articles/login_summer19_03_serebryany.pdf https://www.usenix.org/system/files/login/articles/login_sum...
mikestew 8mo ago
Whenever I point out that Apple's "security by obscurity" strategy is a complete failure I get downvotes. Maybe because you apparently don’t know what “security by obscurity” means? Regardless, what’s your recommendation for “buy something else”?
alwillis 8mo ago
> A person suspecting their iPhone has been hacked has no way to check it. Apple only offers a cope mechanism in the form of "lockdown mode", which likely can be bypassed just as well. In the past, Apple alerted users (journalists, political activists, dissidents) when a "state-level actor" attempted to hack their iPhones [1]. Apparently, the FBI couldn't get past Lockdown Mode: FBI stymied by Apple’s Lockdown Mode after seizing journalist’s iPhone [2]" And don't forget about Memory Integrity Enforcement (MIE) that debuted on iPhone 17 and iPhone Air [3]: MIE is described as the industry's first always-on, comprehensive memory safety protection, built on the Enhanced Memory Tagging Extension (EMTE) in synchronous mode, combined with secure typed allocators and tag confidentiality protections. [1]: https://www.sentinelone.com/blog/so-state-sponsored-attackers-are-targeting-your-mobile-device-now-what/ https://www.sentinelone.com/blog/so-state-sponsored-attacker... [2]: https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-apples-lockdown-mode-after-seizing-journalists-iphone/ https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-a... [3]: https://security.apple.com/blog/memory-integrity-enforcement https://security.apple.com/blog/memory-integrity-enforcement
- varispeed 8mo ago
  Yes, Apple controls who gets alerted about security breach. This means not everyone with compromised phone will get alerted. You are still in the dark. Maybe they could maybe they couldn't, doesn't mean criminals couldn't. MIE is opaque - Apple has not disclosed its design - it also means it can contain intentional backdoors and other security holes. In other words this is just meaningless PR and doesn't change the fact that Apple's security is poor.
  - alwillis 8mo ago
    > This means not everyone with compromised phone will get alerted. You are still in the dark Apple only alerts people who are potentially in life threatening situations because of who they are or what they do: Apple today detailed two initiatives to help protect users who may be personally targeted by some of the most sophisticated digital threats, such as those from private companies developing state-sponsored mercenary spyware. Lockdown Mode — the first major capability of its kind, coming this fall with iOS 16, iPadOS 16, and macOS Ventura — is an extreme, optional protection for the very small number of users who face grave, targeted threats to their digital security. “Apple expands industry-leading commitment to protect users from highly targeted mercenary spyware” — https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-from-mercenary-spyware/ https://www.apple.com/newsroom/2022/07/apple-expands-commitm...

tptacek 8mo ago

What do you mean by "security by obscurity"? What's your comparand that doesn't have the same software defects iPhone-targeting CNE is exploiting?

varispeed 8mo ago
One for instance is that Apple doesn't offer an API for deep system scanning. So if your phone is infected, you have no way of knowing this, because there is no software that can scan it. You cannot trust it. Or things like Memory Tagging Extension (MTE) Apple has implemented, but they have not released specification and implementation details, so you don't know if it has backdoors.
- EPWN3D 8mo ago
  I don't think you know what security by obscurity is.
  - alwillis 8mo ago
    He sure doesn’t.
- alwillis 8mo ago
  > So if your phone is infected, you have no way of knowing this, because there is no software that can scan it. You cannot trust it. Not true. There are commercial apps that can scan your iPhone for vulnerabilities and exploits [1]. Apple goes through ridiculous lengths regarding security on their platforms [2]. > Memory Tagging Extension (MTE) Apple has implemented, but they have not released the specification. It's based on the Memory Tagging Extension (MTE) added to the ARMv8.5 architecture in 2019, co-designed by ARM and Google [3]. MTE support has recently been added to Android 12+ and some Linux distros like recent Fedora and Ubuntu 24.04. Apple's Memory Integrity Enforcement (MIE) is based on MTE. Now that Apple designs its own ARM-based processors, they used MTE as a starting point for Apple Silicon. The iPhone 17 series and the iPhone Air shipped with MIE enabled in September. The point of these technologies is to enable software that hasn't been written in memory-safe languages (many millions of lines of C, C++, etc. that will never be rewritten) to run safely. Although it's starting to change, the vast majority of the rendering engines used by Safari, Chrome, and Firefox are written in C/C++; so it makes sense to address potential browser vulnerabilities at the hardware level. [1]: https://iverify.io/products/enterprise-protection https://iverify.io/products/enterprise-protection [2]: https://support.apple.com/guide/security/toc https://support.apple.com/guide/security/toc [3]: https://www.usenix.org/system/files/login/articles/login_summer19_03_serebryany.pdf https://www.usenix.org/system/files/login/articles/login_sum...

mikestew 8mo ago

Whenever I point out that Apple's "security by obscurity" strategy is a complete failure I get downvotes. Maybe because you apparently don’t know what “security by obscurity” means? Regardless, what’s your recommendation for “buy something else”?

alwillis 8mo ago

> A person suspecting their iPhone has been hacked has no way to check it. Apple only offers a cope mechanism in the form of "lockdown mode", which likely can be bypassed just as well. In the past, Apple alerted users (journalists, political activists, dissidents) when a "state-level actor" attempted to hack their iPhones [1]. Apparently, the FBI couldn't get past Lockdown Mode: FBI stymied by Apple’s Lockdown Mode after seizing journalist’s iPhone [2]" And don't forget about Memory Integrity Enforcement (MIE) that debuted on iPhone 17 and iPhone Air [3]: MIE is described as the industry's first always-on, comprehensive memory safety protection, built on the Enhanced Memory Tagging Extension (EMTE) in synchronous mode, combined with secure typed allocators and tag confidentiality protections. [1]: https://www.sentinelone.com/blog/so-state-sponsored-attackers-are-targeting-your-mobile-device-now-what/ https://www.sentinelone.com/blog/so-state-sponsored-attacker... [2]: https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-apples-lockdown-mode-after-seizing-journalists-iphone/ https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-a... [3]: https://security.apple.com/blog/memory-integrity-enforcement https://security.apple.com/blog/memory-integrity-enforcement

varispeed 8mo ago
Yes, Apple controls who gets alerted about security breach. This means not everyone with compromised phone will get alerted. You are still in the dark. Maybe they could maybe they couldn't, doesn't mean criminals couldn't. MIE is opaque - Apple has not disclosed its design - it also means it can contain intentional backdoors and other security holes. In other words this is just meaningless PR and doesn't change the fact that Apple's security is poor.
- alwillis 8mo ago
  > This means not everyone with compromised phone will get alerted. You are still in the dark Apple only alerts people who are potentially in life threatening situations because of who they are or what they do: Apple today detailed two initiatives to help protect users who may be personally targeted by some of the most sophisticated digital threats, such as those from private companies developing state-sponsored mercenary spyware. Lockdown Mode — the first major capability of its kind, coming this fall with iOS 16, iPadOS 16, and macOS Ventura — is an extreme, optional protection for the very small number of users who face grave, targeted threats to their digital security. “Apple expands industry-leading commitment to protect users from highly targeted mercenary spyware” — https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-from-mercenary-spyware/ https://www.apple.com/newsroom/2022/07/apple-expands-commitm...