Hacker News Reader

Comment by filoleg | Hacker News Reader

>Is this because they are generally not as airtight in design as iphones are?

>Is it because iPhones are more likely to be up-to-date in terms of patches and security updates, and hence android is easier to crack?

I don't want to make premature judgements without factual supporting evidence, but my personal anecdotal evidence suggests that these two guesses might be the correct ones. Me and some of my friends got S8+ a few years ago, back when it was Samsung's flagship smartphone. Among other things, we were all appalled by the update cadence. We were getting security updates, not even talking about major OS updates, about 3-6 months after Pixel phones were getting theirs. I cannot even imagine the horror show that non-flagship Android device owners have to go through in terms of updates.

View on HN

the problem with Android fragmentation is as old as Android. If you're a journalist, activist or anyone who needs critical security on a phone you're better off not having one.

The options for anyone else is usually a) always use the latest iOS device or b) use a hardened Android, or c) use a dumb phone for all non-critical comms. I should repeat that: if you're worried about security consider using f2f interaction because the number of places you're likely to trip up are endless no matter what device.

Why does fragmentation have to be so bad on Android? Windows runs on millions of different hardware configurations, including custom home-built machines, and all Windows machines receive software updates at the same time.

As I commented in another article (https://news.ycombinator.com/item?id=22264553), every PC descends from the original IBM 5150 from the 1980s, which gives the PC a common base which phones never had.

Counterpoint: a bunch of bored teenagers hacked every single iPhone in Hollywood just to get some celebrity nudes.

I don't believe in "hardened Android" either, unless it's developed and maintained by nsa or gchq.

That was password stuffing against iCloud. Only mandatory 2FA would’ve prevented it - which Apple did with the next release of iOS.

The hackers could bypass 2FA, see my other comment.

It was silently fixed by apple once the story hit the mainstream news.

That was iCloud.

Does it matter? The data is out, and while the attack surface was not the iphone itself it was a service closely connected to it.

Right, but the exact same thing could have happened with Google Photos or whatever it's called these days if you don't have 2fa enabled.

Not really. Google has invested heavily in making its login process as secure as possible. Unless you had a very easily guessed password and were unlucky enough to live in the same region as your attacker, it'd be very unlikely for this to happen to a Google Photos user.

That said, nudes don't belong in any cloud.

The vulnerabilities that opened iCloud to these attacks were due to its iPhone integration (restoring device from backup to be more specific). It also allowed the attacker to bypass 2FA (probably in the name of user experience).

Reply on news.ycombinator.com