9 ms·

He's not wrong. There's always a tradeoff between security and usability. http://www.schneier.com/blog/archives/2009/08/security_vs_usa.html http://www.schneier

by hhw 14y ago

He's not wrong. There's always a tradeoff between security and usability. http://www.schneier.com/blog/archives/2009/08/security_vs_usa.html http://www.schneier.com/blog/archives/2009/08/security_vs_us... The key is finding the right balance.

duaneb 14y ago
Surely some security comes for "free". My iPhone has military grade encryption, but all I see is a 4 digit passcode. If I shut it off, however, and have the 10 max attempts, then it's virtually impossible to break in (without other data, e.g. smudges where the passcode numbers are). In any case, it should be a tradeoff the user controls. People have drastically different needs, think OpenBSD versus Windows for a usability/security tradeoff.
- Evbn 14y ago
  You are aware the jail breaking exists, right? So iPhones aren't so secure.
  - duaneb 14y ago
    > So iPhones aren't so secure. What's your benchmark? If you have access to the hardware virtually everything can be jailbroken. With the iPhone, however, you can't do it non-destructively (i.e. you can't get personal information). At least that's my understanding, if I'm wrong please correct me.
    - nitrogen 14y ago
      The original user-friendly jailbreaks worked by pressing a button on a website. That means that any website could use the same technique to run native code with root privileges on your iPhone. I'm not sure how much physical access is required for current jailbreaks.
      - duaneb 14y ago
        IIRC it's been years since that's been possible, recent attempts seem to all fake a software update/reset via host computer connection. I'm not saying the iPhone is anywhere impossible to break into (I'm sure, like all OSs, there are vulnerabilities that allow access exposed to the user that have not been found yet), but because the apps are sandboxed, hackers need to break into software and then out of the sandbox (probably into kernely memory, again, but possibly just into privileged system access to the file system). The iPhone is certainly far more secure than most desktops because of this, and I suspect that because of Apple's control over it, the chance of your iPhone getting accessed without your permission is miniscule. However, I am no mobile developer, so take this with a grain of salt.
  - adamisen 14y ago
    Jailbreaks exploit security holes, but you currently need physical access and the passcode off to jailbreak.
dguido 14y ago
You couldn't be more wrong and, unfortunately, I don't have the karma yet to enable downvoting :-). Easy example as long as we're on the topic, the Chrome browser or ChromeOS. I can think of a dozen things that could be done to Android to both mitigate against current threats and exploited weaknesses and either not interfere with or improve user experience. Unfortunately, we are long past the point where fundamental architecture changes can be made to Android. We are stuck with a system that allows execution of downloaded code at runtime, that never updates, and that blames the user for security problems. Android would have been wise to adopt some of the best security decisions from iOS.
- rdl 14y ago
  I think Google can fix many of the security issues with Android, even at the cost of breaking compatibility. They will presumably try to merge Android and ChromeOS, and taking more of the ChromeOS security model on tablet/PC-form-factor devices makes sense.
- msutherl 14y ago
  The usability of the browser is severely hampered by the security requirements. For one, it necessitates running code downloaded from the web in a sandbox, which prevents it from interacting with the rest of the computer in a meaningful way except through narrow channels designed painstakingly by committee. The web would be a much more interesting place if we could hook up arbitrary peripherals. It's holding back the entire world from developing better computer interfaces.
  - oscargrouch 14y ago
    >The web would be a much more interesting place if we could hook up >arbitrary peripherals. It's holding back the entire world from developing >better computer interfaces. Im enginering something, that was a spinoff of this thougths.. i 've go an answer balancing the good parts of the web with the good parts of the app platforms.. plus some concepts of biological cells.. it may be a party for google, apple samsung and the like.. but we technological people are back to the nighmare that were the 90's.. with multiple platforms.. and thats the only reason browsers became popular.. even when we were loosing so much.. here we are into the nightmare again.. have to create things for multiple platforms :(

by hhw 14y ago

duaneb 14y ago

Surely some security comes for "free". My iPhone has military grade encryption, but all I see is a 4 digit passcode. If I shut it off, however, and have the 10 max attempts, then it's virtually impossible to break in (without other data, e.g. smudges where the passcode numbers are). In any case, it should be a tradeoff the user controls. People have drastically different needs, think OpenBSD versus Windows for a usability/security tradeoff.

Evbn 14y ago
You are aware the jail breaking exists, right? So iPhones aren't so secure.
- duaneb 14y ago
  > So iPhones aren't so secure. What's your benchmark? If you have access to the hardware virtually everything can be jailbroken. With the iPhone, however, you can't do it non-destructively (i.e. you can't get personal information). At least that's my understanding, if I'm wrong please correct me.
  - nitrogen 14y ago
    The original user-friendly jailbreaks worked by pressing a button on a website. That means that any website could use the same technique to run native code with root privileges on your iPhone. I'm not sure how much physical access is required for current jailbreaks.
    - duaneb 14y ago
      IIRC it's been years since that's been possible, recent attempts seem to all fake a software update/reset via host computer connection. I'm not saying the iPhone is anywhere impossible to break into (I'm sure, like all OSs, there are vulnerabilities that allow access exposed to the user that have not been found yet), but because the apps are sandboxed, hackers need to break into software and then out of the sandbox (probably into kernely memory, again, but possibly just into privileged system access to the file system). The iPhone is certainly far more secure than most desktops because of this, and I suspect that because of Apple's control over it, the chance of your iPhone getting accessed without your permission is miniscule. However, I am no mobile developer, so take this with a grain of salt.
- adamisen 14y ago
  Jailbreaks exploit security holes, but you currently need physical access and the passcode off to jailbreak.

dguido 14y ago

You couldn't be more wrong and, unfortunately, I don't have the karma yet to enable downvoting :-). Easy example as long as we're on the topic, the Chrome browser or ChromeOS. I can think of a dozen things that could be done to Android to both mitigate against current threats and exploited weaknesses and either not interfere with or improve user experience. Unfortunately, we are long past the point where fundamental architecture changes can be made to Android. We are stuck with a system that allows execution of downloaded code at runtime, that never updates, and that blames the user for security problems. Android would have been wise to adopt some of the best security decisions from iOS.

rdl 14y ago
I think Google can fix many of the security issues with Android, even at the cost of breaking compatibility. They will presumably try to merge Android and ChromeOS, and taking more of the ChromeOS security model on tablet/PC-form-factor devices makes sense.
msutherl 14y ago
The usability of the browser is severely hampered by the security requirements. For one, it necessitates running code downloaded from the web in a sandbox, which prevents it from interacting with the rest of the computer in a meaningful way except through narrow channels designed painstakingly by committee. The web would be a much more interesting place if we could hook up arbitrary peripherals. It's holding back the entire world from developing better computer interfaces.
- oscargrouch 14y ago
  >The web would be a much more interesting place if we could hook up >arbitrary peripherals. It's holding back the entire world from developing >better computer interfaces. Im enginering something, that was a spinoff of this thougths.. i 've go an answer balancing the good parts of the web with the good parts of the app platforms.. plus some concepts of biological cells.. it may be a party for google, apple samsung and the like.. but we technological people are back to the nighmare that were the 90's.. with multiple platforms.. and thats the only reason browsers became popular.. even when we were loosing so much.. here we are into the nightmare again.. have to create things for multiple platforms :(