4 ms·

I would never rely on a closed system for secure messaging to many unknowns.

by trinsic2 6mo ago

dewey 6mo ago
And yet iOS is probably the most secure mobile platform for secure messaging. Especially in lock down mode.
- trinsic2 6mo ago
  Except, you cant really verify all of that. so IMHO that's just speculation based on the surfacing of news which can easily be distorted. Or maybe you can. Is there any sources on people that have evaluated the security of these features.
  - dewey 6mo ago
    You can’t verify that even on an open OS as there will still be closed hardware blobs. At least with popular systems there’s a lot of state level hacking activity so zero days get patched routinely. Also Apple has a program for researchers where they get more access to the system (That program was criticized heavily though for the way it was implemented). It’s not a perfect system so right now you still have to trust someone at some point in the chain.
    - j_maffe 6mo ago
      > At least with popular systems there’s a lot of state level hacking activity so zero days get patched routinely Not sure how you're implying one leads to the other.
exfil 6mo ago
Agree. Peoples are trusting App with unknown source code & delivery path, infrastructure controlled by 3rd party. Application cannot protect against OS and OS cannot protect against HW. Too many known unknowns. Seek the arguments how and why OTF got re-funded last time.
indycliff 6mo ago
The thing is, this whole debate is happening above the baseband. Linux phones (Librem 5, PinePhone) tried to solve this and went nowhere, you can open-source everything above the modem, but the GSM/LTE protocol stack is still a proprietary blob with DMA access to your main memory. It's basically a second computer in your phone that's directly addressable by carrier infrastructure, and nobody gets to audit it. Doesn't matter if you're running iOS, Android, or postmarketOS. Qualcomm/MediaTek own that layer and it's not changing anytime soon.

I would never rely on a closed system for secure messaging to many unknowns.

dewey 6mo ago

And yet iOS is probably the most secure mobile platform for secure messaging. Especially in lock down mode.

trinsic2 6mo ago
Except, you cant really verify all of that. so IMHO that's just speculation based on the surfacing of news which can easily be distorted. Or maybe you can. Is there any sources on people that have evaluated the security of these features.
- dewey 6mo ago
  You can’t verify that even on an open OS as there will still be closed hardware blobs. At least with popular systems there’s a lot of state level hacking activity so zero days get patched routinely. Also Apple has a program for researchers where they get more access to the system (That program was criticized heavily though for the way it was implemented). It’s not a perfect system so right now you still have to trust someone at some point in the chain.
  - j_maffe 6mo ago
    > At least with popular systems there’s a lot of state level hacking activity so zero days get patched routinely Not sure how you're implying one leads to the other.

exfil 6mo ago

Agree. Peoples are trusting App with unknown source code & delivery path, infrastructure controlled by 3rd party. Application cannot protect against OS and OS cannot protect against HW. Too many known unknowns. Seek the arguments how and why OTF got re-funded last time.

indycliff 6mo ago

The thing is, this whole debate is happening above the baseband. Linux phones (Librem 5, PinePhone) tried to solve this and went nowhere, you can open-source everything above the modem, but the GSM/LTE protocol stack is still a proprietary blob with DMA access to your main memory. It's basically a second computer in your phone that's directly addressable by carrier infrastructure, and nobody gets to audit it. Doesn't matter if you're running iOS, Android, or postmarketOS. Qualcomm/MediaTek own that layer and it's not changing anytime soon.