Comment by Terretta | Hacker News Reader

Comment by Terretta | Hacker News Reader

Parent Full thread

This is great, but also clever.

By offering users a more locked down option with clear tradeoffs, (a) users can make a choice between security and convenience, and (b) given user agency, negative press around hacks of not locked-down devices loses potency.

Meanwhile, the choice seems straightforward on most of these...

Lockdown Mode includes the following protections:

- Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled.

GREAT!

- Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.

GREAT!

- Apple services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent the initiator a call or request.

GREAT!

- Wired connections with a computer or accessory are blocked when iPhone is locked.

GREAT! (Used to have to do this yourself with Configurator if you wanted to be hostile border-crossing proof.)

- Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

HMM ... there are hardening settings only available through Configurator or MDM profiles. Will those be defaulted on as well?

>> - Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

> HMM ... there are hardening settings only available through Configurator or MDM profiles. Will those be defaulted on as well?

Reading between the lines here - on lockdown mode, you can't install a profile, or enroll in MDM. What it doesn't say, is that you can't enable lockdown mode with a profile installed, or if enrolled in MDM.

I take this to mean, with lockdown turned on, I can't install profiles or enroll in MDM (but presumably could uninstall profiles or unenroll from MDM).

I also take it to mean that most of these hardening features will be able to be enabled by configuration proflies / MDM anyway. Lockdown mode being essentially "Apple being the MDM for individual who don't otherwise have an MDM."

Correct. Existing MDM profiles will be unaffected.

>- Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

>HMM ... there are hardening settings only available through Configurator or MDM profiles. Will those be defaulted on as well?

Yes, that one leapt out at me as well as kind of an awkward one with more compromises, painting with a very broad brush. It's obvious that some of the very powerful config profiles/MDM capabilities could be used for a lot of mischief, but some of them are also exactly what I'd want to be running myself if I was at a lot of risk, and some are both. Ie., continuing to have one's own offline based CA with proper Name Constraints could be handy for a group of people who want to try to better secure and keep private their own internal network services from anything short of a government physical assault, but if an attacker can slip on a profile with an unlimited CA your goose is cooked.

Perhaps Apple simply doesn't have the capability for fine grained control of those capabilities yet, which wouldn't be surprising given their path up until now. I'll be interested to see if over time Apple leaves this mostly untouched or invests in seriously improving it. Like it'd be interesting if you could boot into a special mode ala DFU though requiring password and with graphics up and have a bunch of toggles for various capabilities that would then be enforced in normal usage. Analogous to the Recovery Mode on Macs.

You can simply enable those MDM profiles then enable Lockdown mode; they will stay on. You just can't enable new ones while Lockdown mode is enabled.

Perhaps Apple simply doesn't have the capability for fine grained control of those capabilities yet, which wouldn't be surprising given their path up until now.

I have to believe they’re working on exposing some of this via MDM. Certain organizations may never want the JIT turned on, for example or allow attachments in iMessage.

I expect we’ll hear more about more capabilities this summer and fall.

Do you really trust your average IT department to make an informed decision about whether WebKit JIT is currently secure or not? I don't see Apple putting these in MDM Configuration Profiles. If they do, it will only be for Supervised Devices (i.e. devices owned by your employer, must be wiped to enroll).

Do you really trust your average IT department to make an informed decision about whether WebKit JIT is currently secure or not?

In general, no.

For specific website or web apps, yes.

I'm worried about that last point simply because I assume that most corporate CEOs would need MDM enabled to access their corporate email, which means they won't be able to use this feature despite being prime targets.

Still a really good feature for those that qualify, though.

I'm worried about that last point simply because I assume that most corporate CEOs would need MDM enabled to access their corporate email…

As long as the MDM profile is installed before using Lockdown Mode, they’ll be fine. They just can’t install an MDM profile once the phone is locked down, which makes sense.

Oh, well that's way better. Thanks for clarifying!

I believe you can still have it, you just have to set it up before you put the device in lockdown mode.

Ideal approach would be to be able to manage all those features individually via MDM. This way corp admins would be able to lock down managed phones while bringing necessary configuration to access corp services.

Reply on news.ycombinator.com