Hacker News Reader

Comment by saagarjha | Hacker News Reader

> As someone working in security, the phone is an extremely leaky thing and very bad for privacy to begin with. On top of that you want to remove all restrictions and make it a security nightmare too?

One major issue is that Apple's security model is "we don't trust you". And by that I mean everything works from their root of trust; not yours. This isn't the usual "I think Apple is backdooring my iPhone, FWIW", what I'm really saying is that I want the ability to elevate some of my software to the same permissions that Apple gives theirs. There is no reason that I should not be able to vet my own code and add it to the "trust cache". So this isn't just "every app should run without a sandbox", but it should be "I think GDB that I personally should be able to attach to other apps, but nothing else".

View on HN

My security model actually is “I don’t trust myself”.

One of the obvious conclusions from modern security research is that the user has become the number one vulnerability in pretty much all systems.

The corollary that a lot of people miss is that developers and security researchers are users too. They get pwned too. They some give the wrong permissions to an executable.

Then perhaps a device that prevents you from doing stupid things may be what you want. But I would prefer that your choice does not prevent me from being unable to buy an iPhone that does let me do those things.

This is because apple feels its too easy to trick users into elevating software permissions - which in turn may cause risks and harms to their user base.

Let me ask you - do you have your elderly parents on an android? Then you will know already how totally owned those phones can become.

If you require the user to hook into iTunes/Xcode, flip the device into recovery mode, click a few buttons, and agree to a "You're hecked if you break it now" policy, it'll be enough to scare off 99.9% of people from getting owned. After that, just have it work like the current profiles/supervision system where Settings makes it clear that non-verified code is running and has a big "make it go away!" button (sideloaded IPAs show up in profiles with a delete app button, and that works well enough except for the time limit).

I don’t really agree to this, the end result is going to be a large number of YouTube tutorials instructing people on how to do this with captions like: watch free movies on iPhone, “popular mobile game” money hack, and Snapchat take screenshots without notifying hack.

Half of these developer / root mode required secrets are going to be occasionally working mods and tweaks except with tons of baked in spyware and ads that can no longer easily be removed.

Perhaps some sort of per device profile which requires a paid developer account could work, but I’ve gotten a number of odd calls about YouTube videos involving Kodi from family before, so I’m not sure trusting in the give users freedom front.

This proves exactly the point made above of Apple not trusting the user.

However if someone wants to be an idiot, how far do you go to stop them? Apple's approach stops too many great possibilities for knowledgeable users. It should be in the same category as those "will it blend" types. Screw it up? No warranty.

For me there's several things I need it that are impossible because Apple won't allow them, so I have to use Android. But that's comes infected with Google spyware out of the box :(

I think Apple point is that users that need being protected from themselves without even realizing it are far more than those who might get a benefit from root without getting burnt. Since the two things can’t exist at the same time, they’re going for the road that makes the majority happy.

And provides the least burden to their support service.

If you don’t mind, here’s a comment I wrote recently that I think is very relevant and I figured it just be easier to link to rather than retype: https://news.ycombinator.com/item?id=23784763

> Strange key combinations that lead to scary text and wiping the device seem to be fairly effective in keeping out people who cannot give informed consent.

Not in my experience and certainly not evidenced by all the YouTube videos advocating disabling this or that security feature for questionable gain, including ones with scary text and/or strange key combinations.

And wiping your device?

Yes

> This is because apple feels its too easy to trick users into elevating software permissions

Great, which is why I think offering a separate SKU to people who want control over their devices would be a wonderful compromise. Your parents can buy the normal locked-down iPhone that's sold in the Apple Store, and I'll buy the special one from the hidden page on Apple's website.

Reply on news.ycombinator.com