JailbreakMe is a website that can root your iOS - so let me emphasize this - a freaking website that can get root access on your iPhone just by visiting that website.
It originally relied on some bug in the PDF reader. Then Apple released an update. Then JailbreakMe got upgraded to use a FreeType parser security flaw, again in that same PDF reader and so it works with iOS 4.3.3 - then Apple released iOS 4.3.4 to patch it. But now an update for iOS 5 is apparently in the works.
At this point you may now feel that Apple is in control, that they are patching iOS at a rapid pace and so on. However, these vulnerabilities are PUBLIC. Even the source-code for JailbreakMe was published. Bad people don't do that ;-)
So you can argue all you want against malware, a broken OS or about evil people stealing your data, however the iOS platform is nothing more than security theater - it keeps the script kiddies out, it gives you an illusion of safety, but it won't keep out the people with the right resources and experience. And those people are the people you should be worried about.
You should be worried about the script kiddies too. Security is all about layers and vectors. Installing an innocent looking wallpaper pack by casual users shouldn't lead to malware infestation. That is much easier for the bad guys to do rather than get people to visit a malicious website.
Reducing the attack surface definitely makes you safer on relative terms. It does not make you absolutely safe.
>Do you feel secure when using an iPhone?
If I had an iPhone I would feel safer installing a whole bunch of unknown third party apps compared to doing the same on, say an Android phone. I would not feel "secure" though.
You should be worried about the script kiddies too
However, when you're compromised by just connecting to the network or just by visiting a compromised website (and lots of high-profile websites have been compromised before) - then all bets are off.
Malware has been distributed on many major websites most people would consider "trusted", either via ad networks or through simply cracking the servers.
On the Internet, you can't "trust" anybody not to be a vector for malware onto your client. Your client must be able to protect itself.
The world is an ugly place, full of bad people. That doesn't mean I need to barricade inside the house and give Apple the key.
Which websites do you trust, exactly?
On Windows - I either buy my software, or I'm getting known open-source software from their respective websites. I can't remember the last time my anti-virus (commercial, kept up to date) detected anything.
First of all, I don't trust anyone from my social circle not to be a vector for malware on the Internet, just as I don't trust them to not be a vector for real-life viruses and bacteria. If they have been compromised, they can be an unwilling vector. Toward that end, I have an immune system, as well as additional strategies such as vaccinations, hand washing, good nutrition, etc., to help protect myself.
Websites that have been compromised can be a vector for malware. Even HN could be a vector for malware. You can't simply trust that it isn't.
Second, your "answer" has nothing to do with my question. I asked which websites you trust, not which software repositories you trust. Browsers can and have had flaws that permit malware installation and other arbitrary code execution without an affirmative action on your part.
So I say again, more forcefully, which websites do you trust so completely that you believe they can never be a vector for malware?
Yeah, I do. There is a site that can take advantage of some vulnerability? Not impressed. Until there are tons of such sites, like they are for PCs, and until there are tons of actual iPhones harmed that way, as PCs are, I feel secure.
"however the iOS platform is nothing more than security theater - it keeps the script kiddies out, it gives you an illusion of safety, but it won't keep out the people with the right resources and experience."
I don't care about those people. I'm not targeted by some Dr. No style guy. I care about general experience and the law of large numbers.
And, statistically, I'm totally safe using an iPhone. When that changes, you can write to me again.
until there are tons of actual iPhones harmed
that way, as PCs are ...
So you can feel safe, but only because your platform is not popular enough right now, or useful enough for anybody to bother (PCs are wonderful for building botnets).
I don't care about those people. I'm not targeted
by some Dr. No style guy.
And, statistically, I'm totally safe using an iPhone.
Seriously?
That's a stupid fallacy. In the 90's the Mac had a tiny marker share, nothing like the near 10% it has today, and it still had tons of viruses. And even platforms like the Amiga and Atari had viruses, while having insignificantly less market share than PCs at the time. The OSX Macs, on the other hand, has only seen a few trojan horses and no actual virus distributed outside of some lab or something.
So, it's not just numbers or units, or relative percentage of market share. Other things count, stuff like the UNIX like permissions OS X had from the start, compared to the silly Windows 3->XP user being automatically admin.
"""Statistically? I just gave you as an example a freaking website that can do whatever the author wants on your iPhone and you're giving me statistics?"""
I'd care about that website when ACTUAL iPhones in the wild ACTUALLY VISIT websites such as this and are hacked, in large numbers.
Until then, I could care less.
It's the difference between being scared of violence in a seedy neighborhood and being scared of being targeted by a serial killer. Yeah, they do exist. What are you chances?
who needs malware when all these locked devices already come with location logger, key typing logger, remote wipe and other stuff we yet to discover.
Poor timing on your part: https://news.ycombinator.com/item?id=3295341