Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 10 Security White Paper [pdf]

apple.com

Post reply on HN
Print view View original

21–30 of 99 posts

Re: iOS 10 Security White Paper [pdf]

#21

Post by acover »

AsyncAwait wrote: post #9
CalChris wrote: post #5

Its previous edition was required reading for CS 161 at Berkeley. Would that it were required reading in Mountain View. http://www-inst.cs.berkeley.edu/~cs161/fa16/ (Yeah, it says optional on the syllabus but Weaver said required in lecture.)

Do they don't know/care about security, or is it simply the case that it is hard to have something like the secure enclave across all Android devices? Genuine question.

It feels like users don't care about security. Nearly all Android phones are not running a supported OS.[1] As an Android user it appears my only choice is a custom ROM or buying a new device every 2 years.

[1] - https://developer.android.com/about/dashboards/index.html#Pl...

Re: iOS 10 Security White Paper [pdf]

#22

Post by Nullabillity »

izacus wrote: post #13
AsyncAwait wrote: post #9

Earlier quoted context omitted.

Do they don't know/care about security, or is it simply the case that it is hard to have something like the secure enclave across all Android devices? Genuine question.

Mmm? Secure enclave is present on most Android devices and is mandatory since Android 6.0. (It's just called something else.) Historically Android has been lagging behind a bit from iOS devices when it comes to security, but Pixels and their software have a very similar security model and design (with some exceptions - less granularity with file-based encryption and some other mostly minor details). Non Google device…

My OnePlus 3T uses dm-verity as well, sadly. Displaying an "unlocked" badge during boot is acceptable. Actually pausing boot for 10 seconds every time is not by a long shot.

Re: iOS 10 Security White Paper [pdf]

#23

Post by FT_intern »

AsyncAwait wrote: post #9
CalChris wrote: post #5

Its previous edition was required reading for CS 161 at Berkeley. Would that it were required reading in Mountain View. http://www-inst.cs.berkeley.edu/~cs161/fa16/ (Yeah, it says optional on the syllabus but Weaver said required in lecture.)

Do they don't know/care about security, or is it simply the case that it is hard to have something like the secure enclave across all Android devices? Genuine question.

I would guess that it is tougher to secure the OS when you don't own the hardware, although I don't know enough about this to comment

Re: iOS 10 Security White Paper [pdf]

#24

Post by AsyncAwait »

acover wrote: post #21
AsyncAwait wrote: post #9

Earlier quoted context omitted.

Do they don't know/care about security, or is it simply the case that it is hard to have something like the secure enclave across all Android devices? Genuine question.

It feels like users don't care about security. Nearly all Android phones are not running a supported OS.[1] As an Android user it appears my only choice is a custom ROM or buying a new device every 2 years. [1] - https://developer.android.com/about/dashboards/index.html#Pl...

If you go with the Pixel, which is basically the iPhone of Android, you'll get a similar to iOS update experience.

Re: iOS 10 Security White Paper [pdf]

#27

Post by floatboth »

This is really cool:

> Securely erasing saved keys is just as important as generating them. It’s especially challenging to do so on flash storage, where wear-leveling might mean multiple copies of data need to be erased. To address this issue, iOS devices include a feature dedicated to secure data erasure called Effaceable Storage. This feature accesses the underlying storage technology (for example, NAND) to directly address and erase a small number of blocks at a very low level.

I guess that means separate storage, as the main storage in recent iPhones is an NVMe SSD and not raw NAND attached to the processor.

BTW, is there a good / easy way to connect raw NAND to a normal desktop PC?

Re: iOS 10 Security White Paper [pdf]

#28

Post by acover »

AsyncAwait wrote: post #24
acover wrote: post #21

Earlier quoted context omitted.

It feels like users don't care about security. Nearly all Android phones are not running a supported OS.[1] As an Android user it appears my only choice is a custom ROM or buying a new device every 2 years. [1] - https://developer.android.com/about/dashboards/index.html#Pl...

If you go with the Pixel, which is basically the iPhone of Android, you'll get a similar to iOS update experience.

You are mistaken. The pixel has the same 2 year support length of the Nexus series.

iPhones are typically supported for 4 years.

Re: iOS 10 Security White Paper [pdf]

#30

Post by comex »

alphabettsy wrote: post #4
bjelkeman-again wrote: post #3

Earlier quoted context omitted.

It is sad that something like the iCloud Keychain is so poorly implemented across the different devices.

How so? You mean from user access and usability standpoint? I know I certainly wish there was a Keychain access app like on macOS available for iOS rather than only being able to access passwords via Safari settings.

Probably referring to the key distribution process, where to enable iCloud Keychain you have to approve from another device. It's a sound design in theory - the keys are only stored locally, so even Apple can't access them - but I've personally experienced issues several times where the approval notification wouldn't show up on my other devices, or the UI was in an inconsistent state, etc.
Post reply on HN