Hacker News Reader

Comment by goblin89 | Hacker News Reader

As a user, I cannot recommend iPhone to my older relatives if there is a way to run arbitrary code beyond Safari’s JS sandbox. Simple as that.

It is a nuanced question with a computer[0], but for a phone (increasingly used for more important transactions and sensitive private data by people more naive when it comes to security) it is simply a no-brainer.

Unless cyber crime is prosecuted as robustly as robberies, I want this kind of jail to constrain the device. Believe it or not, it is a feature.

[0] I do run arbitrary code on my MBP, but then I am a dev who writes code. And, being that, I recently re-enabled the warning for running non-app-store apps on my Mac—I consider myself proficient enough, but perhaps that is exactly why I prefer having to go through an extra warning dialog if it helps reduce the attack surface.

View on HN

I work across the street from a well-known security research group who has been on HN front page before.

Every one of them uses iPhones because they cannot be rooted and are encrypted by default.

Venn of old people and at least one group of security professionals.

> cannot be rooted

https://en.wikipedia.org/wiki/IOS_jailbreaking

Remind me what the bounty is for an iPhone jailbreak right now, would you please?

Can't find prices for a jailbreak, but a zero click full chain exploit with persistence is $2.5M for Android, $2M for iPhone:

https://zerodium.com/images/zerodium_prices_mobiles.png

Seems iPhone exploits got cheaper because they're too abundant: https://twitter.com/Zerodium/status/1260541578747064326

Apple has released phones with major vulnerabilities hard-coded in the silicon. When the checkra1n jailbreak was released, the only fix was to buy a new phone because it exploited flaws in the bootrom & secure enclave silicon.

https://www.malwarebytes.com/blog/news/2019/09/new-ios-explo...

https://checkra.in/news/2020/09/iOS-14-announcement

(That was in 2020, as of iOS 13 IIRC. It’d be interesting how much of that works against the current iOS 17, and whether Zerodium simply had cashflow issues at the time.)

checkra1n was abandoned, but palera1n seems to use the same vulnerabilities and works with iOS 17.

https://en.wikipedia.org/wiki/IOS_jailbreaking#Table_of_tool...

17.3, and not a zero-click exploit but a jailbreak tool.

If you need to infantilize your relatives because they cannot be trusted with their devices, then MDM them, or even have that be the default. But we do not need to surrender in the war on general purpose computing for it.

> MDM them

Many of us cannot afford the luxury of working overtime as tech support for relatives. I personally do not even think I can do a good enough job at that for myself, in fact—I would have to be a professional information security researcher.

Furthermore, I am sure if there is enough misplaced outrage, MDM will be unable to restrict this.

> But we do not need to surrender in the war on general purpose computing for it.

Where is that war? General purpose computing is everywhere, with all of its associated benefits and liabilities[0].

iOS has more or less been the only island where it is reliably not an option, that making it preferred for the reasons I mention.

[0] How many of us literally airgap machines that run unvetted code (at least once you realize that all vitalization and containerization is circumventable), not letting any personal data on them? How feasible is that with a phone, and by an average person that is not exactly infosec-savvy but who is obligated to have a phone to simply get on with daily life?

What is your opinion on S-mode in Windows?

I don't agree with the hyperbole of the person you're replying to. But I also don't think the possibility of fair competition is mutually excusive with the security of the vulnerable few.

That's assuming that something like an opt-in lockdown mode is compatible with the DMA.

I believe the vulnerable (the non-infosec-experts) are not few but majority. It’s a spectrum, and I’m definitely on it. For example, I don’t know anything about the S-mode.

Folks on this site vastly overestimate how much people who actually buy and use these devices care about literally any of the stuff being talked about in this thread.

Apple's schtick was "It just works." that's what people like and want. They don't want to have to go thru and make choices, dig thru settings, install other app stores, explain to meemaw that the nice man cold-calling her telling her to install this special app isn't actually from the IRS coming to arrest her, etc...

They just want it to work.

Oh I agree that they don't care, but that doesn't mean that Apple isn't distorting the market in a way that some of us, the very technologists building the next round of innovation, find abhorrent. This is a case where the public can have it all. The defaults can be "it just works" without also ceding all control over who wins and loses and a significant chunk of revenue to Apple.

The nice man cold calling here won't be a f*cking idiot so he won't try to get her to jump through a bunch of complicated technical hoops that will surely fail because your poor meemaw is not tech savy enough to pull it off, to turn on a buried setting then visit a sketchy website then download and locate a package then agree to the warning at the package install and he isn't an idiot and knows that so he will just tell meemaw he's from the bank and he needs her credentials and she'll turn them over or hang up the phone. That you think the App Store is protecting her bank account is effing laughable. Malware is the very last thing a baddie on the phone with your poor meemaw is going to try and you either know that and are feigning stupidity or the alternative.

https://imgs.xkcd.com/comics/security.png needs a companion for people like you who infantalize seniors (if they're 80, they were using Windows 7 at work before they retired) and make up hacker scenarios that would never happen to seniors to defend an indefensible position that is "I stan Apple, or possibly all multi-trillion dollar mega-corporations with walled gardens, because hacking is for losers and I'm here on a hacking forum to let everyone know that."

> As a user, I cannot recommend iPhone to my older relatives if there is a way to run arbitrary code beyond Safari’s JS sandbox. Simple as that.

This is a false dichotomy made in bad faith. You can have open computers and security for those who you wish to infantilize. Chromebooks for example have physical write protect screw inside to do exactly this: https://www.ifixit.com/Guide/Remove+the+Write+Protect+Screw/...

I fully expect the company that engineered the Vision Pro to come up with something like this if they wanted to. But they choose to spread FUD to continue collecting rent on the appstore instead.

Reply on news.ycombinator.com