Hacker News Reader

Comment by dannyw | Hacker News Reader

This article can be summed up as "Apple relaxed the security model to that if you have physical access with password authentication, you have full access to everything else".

I don't entirely agree with this - if my iPhone PIN is compromised, I do not want my 2FA iCloud account to be compromised.

View on HN

I so strongly agree: the weakening of the iCloud 2FA is the key issue

Agree, the old model was fine. I've been using iPhone because IMO it's a more secure device than the alternative. Surely they could make this an option?

I think it’s might be possible to exclude your iPhone from trusted device and revert to security via phone number. And in case the phone number is your landline you still got your two factors.

This does not apply to most people but in the US at least, you can set your phone number to a Google Voice number. You don't have to forward text messages from Google Voice to a carrier so you can ensure your Apple ID two step (isn't it two step rather than two factor?) authentication is just as secure as your Google account.

> I've been using iPhone because IMO it's a more secure device than the alternative.

There are some alternatives that are absolutely more secure. Now the trade off might not what you want, but the iPhone and iOS isn't the most secure smart phone available.

https://www.silentcircle.com/products-and-solutions/devices/

> There are some alternatives that are absolutely more secure

Probably, but silent circle isn’t one of them. Silent circle is just a generic Chinese android phone without carrier bloatware. Instead, they ship a bunch of their own bloatware. They haven’t really made any fundamental improvements to security over what you can get with any other rootable android phone.

iOS has a generally much stronger hardware security model than Android, although it’s not perfect either, especially given that it’s closed source and not auditable.

I’m hopeful that Purism’s librem 5 cell phone will represent a substantive improvement in smartphone security. Runs standard Linux, isolated baseband, hardware kill switches, etc.

I would say CopperheadOS - https://copperhead.co/android/

Yeah that phone is so NOT secure. Like horribly not secure. I blame google/android. See: https://charlescarrollsociety.com/2016/01/22/silentcircle-bl...

Things have not gotten better. So no, there are not alternatives that are “absolutely more secure.”

That link is about privacy, not security, and horribly misunderstands some fundamental basics. Like that you can disable google applications just fine. Sure you have to trust the OS to actually disable like it says it will, but you also have to trust that iOS does what Apple says it does, too. But you don't have to trust anything Google on that phone.

I think the phone is silly for other reasons, but that link is nonsense and largely unrelated to the discussion at hand.

Bittium's ToughMobile has some special hardware and a government certification (KATAKRI) to be used as a container of classified information. Finnish Defence Forces just bought a bunch of them.

https://www.bittium.com/BittiumToughMobile

It also comes with its own Secure Suite MDM and is not tied to any unwanted third party. It's quite expensive, though, and I have no first-hand experience of it. Just talked with some Bittium guys recently. Lots of former Nokians working there.

It would be fine if they offered an option to keep the old way of doing things, but the new way is better for most users. Any security that's used is far superior than using no security.

I wonder if the other shoe will drop in iOS12 - Apple getting rid of the bruteforce limiter on PINs. Or making it much more relaxed, too. If it will be willing to do that, I would start getting worried about hidden changes to TouchID and FaceID, too, that could make them easier to crack as well.

I wonder if Apple changed its mind on blocking law enforcement from decrypting iPhones. It seems they were the ones to reach out to law enforcement when the Las Vegas attack happened.

I for one think it's completely ridiculous that every time such an attack happens it's encryption that gets most of the blame, rather than say the guns that were the actual tools that killed all of those people.

So one unhealthy individual can go and get an assault weapon, hundreds of bullets, no questions asked, but it's when he starts talking on his iPhone is when we should be getting worried and monitoring his conversationss?

Plus, such attacks are probably kept private, not shared with their best friends before they happen. The whole logic process seems so backwards. It's a little late to be reading the contents of the shooter's iPhone after he's already killed 20 people, no?

From an objective perspective, user's behavioral data on an electronic device would be a far stronger indicator of a potential attack than the purchase of firearms. I'm sure you're not saying that the government should have full access to behavioral data from every device/ISP.

A cowardly mass attack devoid of value for human life can occur using nearly anything (pressure cookers, fertilizer, vehicles, chemicals under your sink, etc, etc, etc). While certain individuals certainly should not be allowed to possess firearms (those with mental or criminal behavioral events/patterns - there is already a federal background check that occurs in obtaining firearms) it is near impossible to prevent someone from obtaining something they are dead set on obtaining unless you lock them up until their death.

Let's not forget that the only time the US has been invaded (technically not yet the US, I know) was when armed private civilians rose together and defeated the preeminent military power in the world. Had those people not been armed the US would not exist. Think how many potential conflicts on US soil the armed population may have deterred since then when you compare it's history with nearly any other country in the world over the last 250 years.

The US was invaded during the War of 1812. And arguably during the Civil War. And very, very arguably during the Mexican-American War.

Oh, and WWII: Aleutian Islands, even a small group of German spies.

My real counter-argument: the US has tremendous geographical advantages and a massive military. When it didn't have a massive military, it still had huge oceans around it, and both neighbors tested our borders before we had a massive military.

So I'm very skeptical about any correlation between firearms ownership and homeland defense.

I am interested in your assertion that private gun ownership has deterred foreign invasion. Can you provide a citation? I would think that the trillions spent on defense over the course of decades would have the largest deterrent effect.

Also the two massive oceans.

It's been over 200 years since Canada last invaded the US, and over 150 years since Mexico last invaded, doesn't that prove the point?

The US was invaded in the War of 1812. The White House (before it was called that) and many other official buildings were burned.

Mexico invaded after that.

And Canadians are still invading my sunny state every winter, they wear smiles and friendly greetings as their uniforms, and use loonies as ammunition.

Reply on news.ycombinator.com