Apple and Security

[Srhsrh]

Interesting and short read about how Apple is selling out on security, while talking tough publicly.

https://www.reuters.com/article/us-...ps-after-fbi-complained-sources-idUSKBN1ZK1CT

if you’re using an iPhone, most likely Apple and the feds already can read your texts to your favorite honey if they want to.

 

[Chiparlor]

It is true and that includes additional apps on iPhone! Some will disagree that it is safer and that would be their prerogatives.

 

[Srhsrh]

Well, remember too, it’s not just you, it’s accessible from your providers phone, which is the part I’m worried about more usually.

 

[krideynyc]

It's been an uphill fight from the start. If Apple didn't relent, it would ultimately result in a legal fight with the Justice Department over Obstruction of Justice/Hampering Investigations.

 

[Srhsrh]

It's been an uphill fight from the start. If Apple didn't relent, it would ultimately result in a legal fight with the Justice Department over Obstruction of Justice/Hampering Investigations.

I agree. I just find it ironic we have all these politicians grandstanding about Apple not unlocking phones in high profile cases, while the reality is it’s wide open on the back end. I have customers tell me every day that they prefer Apple devices, because they are more secure. So basically Apple and the government collude to present iPhones as the safe and secure platform. Great marketing.
i am just waiting for the case when they arrest a provider, get her texts and wechat, identify a high profile monger, and then get a surveillance warrant on him.

 

[krideynyc]

You could approach this from multiple viewpoints. Apple is the better system at both the OS and iOS level because you can't auto-install a virus. The user has to be tricked into it. As for the encryption, it wasn't a major secret that Apple kept backdoor access. But I agree that hiding that fact from the general public was a rotten move.

As for monger, they'll get the call histories and the texts. But WeChat will be much harder, as that needs the Chinese Gov't to be involved. I've always advocated that texting specific conversations was stupid. Even if you wipe it from your phone, a copy still exists on the provider's phone, as well as the app's servers.

 

[Chiparlor]

I will say this once! WeChat is not very hard to retrieve copies! I learned that trick from a C provider on December of 2019 when we lodged together one night in NY.

Another provider in another state confirmed the same procedure.

 

[Srhsrh]

Well, do you remember when they got a virus inserted into their SDK about 5 years ago? They again kept it quiet, but thousands of apps went out from their secure store infected. A closed system meant most people couldn’t clean that mess up themselves, they had to wait for Apple.
I think for an intelligent user, the control you get with android is more powerful.
But theres arguments both ways.

last I knew with wechat, it was transport encryption, but the Chinese had a key on servers too. I don’t know that the Apple backup of your message history was encrypted. Wechat works a little different than whatsapp does. I agree though about texting. That’s completely out there. If your texting with an indie provider setting up a session you should be very careful about incriminating yourself, by doing things like asking her price for bbbj. Or use an untraceable burner.

 

[krideynyc]

I will say this once! WeChat is not very hard to retrieve copies! I learned that trick from a C provider on December of 2019 when we lodged together one night in NY.

Another provider in another state confirmed the same procedure.

Slightly different procedure for a user to retrieve her conversations, and for the Gov't to retrieve conversations for anyone.

Well, do you remember when they got a virus inserted into their SDK about 5 years ago? They again kept it quiet, but thousands of apps went out from their secure store infected. A closed system meant most people couldn’t clean that mess up themselves, they had to wait for Apple.

That one was strictly Apple missing the boat. Usually they are able to catch those inserts. Since then, and up to now, Apple has been more active in their security updates.

 

[Srhsrh]

Slightly different procedure for a user to retrieve her conversations, and for the Gov't to retrieve conversations for anyone.
That one was strictly Apple missing the boat. Usually they are able to catch those inserts. Since then, and up to now, Apple has been more active in their security updates.

That's a matter of opinion, of course. In my world, 90% of the security experts use and recommend androids, 90% of the executives we try to protect use apple. It's a lot of fun trying to pry the iphones out of their hands. But they get religion real fast once they get hacked.

 

[krideynyc]

That's a matter of opinion, of course. In my world, 90% of the security experts use and recommend androids, 90% of the executives we try to protect use apple. It's a lot of fun trying to pry the iphones out of their hands. But they get religion real fast once they get hacked.

Android is better at offering customized security. Lots of flexibility in that platform. iOS by itself is fairly robust. Again, hard for hackers to self install any apps. But the weak link will always be the user. But that applies to any platform.

 

[Srhsrh]

Android is better at offering customized security. Lots of flexibility in that platform. iOS by itself is fairly robust. Again, hard for hackers to self install any apps. But the weak link will always be the user. But that applies to any platform.

Anything you can lock down in Apple, you can do in Android. And then some. You also dont have as much trouble with planned obsolescence with Android. But yes the biggest problem is the user. We have lots of guys that have a nice secure setup on their work phone, then like our brilliant president, they use their personal phone for what should be a very private secure conversation and get caught.

 

[krideynyc]

Anything you can lock down in Apple, you can do in Android. And then some.

True. But what most people don't know is that Apple can be flexible, but learning the system settings to make those changes is not easy, or intuitive. Especially since the majority of people are fine with what they get out of the box from Apple.

You also dont have as much trouble with planned obsolescence with Android.

This used to be an issue. But given the lifespan now of most handsets, the OS lives longer than the hardware.

 

[Srhsrh]

True. But what most people don't know is that Apple can be flexible, but learning the system settings to make those changes is not easy, or intuitive. Especially since the majority of people are fine with what they get out of the box from Apple.

This used to be an issue. But given the lifespan now of most handsets, the OS lives longer than the hardware.

Not true for many corporate devices. Lots of places being forced to upgrade perfectly usable iPads because apple dropped support for them in recent OS so they could do cool consumer things. And because of closed ecosystem, nothing can be done to make them safe.

 

[krideynyc]

Not true for many corporate devices. Lots of places being forced to upgrade perfectly usable iPads because apple dropped support for them in recent OS so they could do cool consumer things. And because of closed ecosystem, nothing can be done to make them safe.

Yes and no. They can't use the latest version of iOS, but the iOS they are on is still supported. This is more about corporations using specific software that dictates the level of iOS required.

 

[Srhsrh]

Yes and no. They can't use the latest version of iOS, but the iOS they are on is still supported. This is more about corporations using specific software that dictates the level of iOS required.

It's one and the same, if the Application needs to be refreshed all the time because of legality issues, and apple forces the new version of the app onto the new IOS. We've wandered pretty far past anyones needs here though. I'm still gonna check and see if I can easily lift wechat texts from an iphone backup. I think it can be done pretty easy.

 

[krideynyc]

It's one and the same, if the Application needs to be refreshed all the time because of legality issues, and apple forces the new version of the app onto the new IOS. We've wandered pretty far past anyones needs here though.

Agreed. But from my experience, it's the App Developers that does the software update to take advantage of the new iOS features. Apple doesn't require every app to update, unless a specific function can only be used with the new release. It's very rare that any Apple specific app that would require corporations to do a hardware migration.

 

[krideynyc]

Forgot to add: your average iPhone/iPad user isn't constrained as much by software as would a corporation.

 

[Erotes]

If anything it sounds like iPhone itself is still very secure. It’s the iCloud backups that are unsecure.

 

[Srhsrh]

Ask Jeff Bezos about that. Taken out by a chicken shit rudimentary attack.