Live data from Hacker News

iOS 10 Security White Paper [pdf]

apple.com

61–70 of 99 posts

Re: iOS 10 Security White Paper [pdf]

#61

This is really cool: > Securely erasing saved keys is just as important as generating them. It’s especially challenging to do so on flash storage, where wear-leveling might mean multiple copies of data need to be erased. To address this issue, iOS devices include a feature dedicated to secure data erasure called Effaceable Storage. This feature accesses the underlying storage technology (for example, NAND) to directl…

What purpose do you want to access raw NAND? If you are okay with just a basic low speed connection to read the NAND, there is a fairly standardized async protocol which you could achieve with a dozen GPIO pins. You could also use a FPGA or and NAND flash programmer (like of like the old EPROM programmers)

However beyond this, you need to know a bit more information to interpret this raw data. This includes any data framing structure, error correction, scrambling, encryption and read error recovery algorithms. A lot of this information is non-standard or only available under NDA from the manufacturer.

Re: iOS 10 Security White Paper [pdf]

#62
post #52

What's lacking is a requirement that Apple Store apps must cooperate with user privacy settings. If the user denies an app access to location services, contacts, or calendars, Apple should require that the app still run. For example, if the user denies the Uber app location information when the app is not being used, Uber car ordering should still work. Apps should not be allowed to demand access they do not need to…

You picked a bad example, as Uber car ordering does work with location services disabled.

Any better examples come to mind of apps that refuse to run unless hey have an unreasonable feature granted?

Re: iOS 10 Security White Paper [pdf]

#63
post #8

I really do respect Apple's attention to security and privacy, however I was a little disappointed when I came across an Apple ID leak from their login form [0] last week. They patched a fix a couple days after I reported it, but still haven't responded to my initial report. It's quite concerning given how easy this simple flaw could have been used for malicious purposes to potentially collect millions of Apple ID's.…

Literally every company is going to have some non-zero number of security leaks. I don't think it's reasonable to be disappointed in an entire company because of a bug written by (likely) one engineer. God knows I've written my share, but none of my software is on routes easily accessible to the public. Unless it's part of a larger pattern, this reaction is going to lead to you being disappointed with 100% of produce…

Iirc, QQ uses a number as the "username," sort of like a phone number.

Re: iOS 10 Security White Paper [pdf]

#65
post #32

Anyone here on an Android phone ever been hacked? Yeah I didn't think so. This is just more Apple propaganda

> Anyone here on an Android phone ever been hacked? You must be new, but here's some resources I suggest you review before you go on a crusade in future Apple articles: https://en.wikipedia.org/wiki/Stagefright_(bug) https://arstechnica.com/security/2016/06/godless-apps-some-f... https://arstechnica.com/security/2016/10/android-phones-root... http://blog.elevenpaths.com/2016/07/another-month-another-ne... Also, keep…

I suggest you read the Android Security 2016 Year in Review before posting any further links to blog sites whose primary goal is to post scaremongering articles for click bait. According to Adrian Ludwig there has not been one known successful StageFright exploit in the wild.

https://static.googleusercontent.com/media/source.android.co...

Re: iOS 10 Security White Paper [pdf]

#66
post #52

What's lacking is a requirement that Apple Store apps must cooperate with user privacy settings. If the user denies an app access to location services, contacts, or calendars, Apple should require that the app still run. For example, if the user denies the Uber app location information when the app is not being used, Uber car ordering should still work. Apps should not be allowed to demand access they do not need to…

This, every app that requests "Always" location access should have an option available to restrict to "While Using" no reason not to

Re: iOS 10 Security White Paper [pdf]

#67
post #52

What's lacking is a requirement that Apple Store apps must cooperate with user privacy settings. If the user denies an app access to location services, contacts, or calendars, Apple should require that the app still run. For example, if the user denies the Uber app location information when the app is not being used, Uber car ordering should still work. Apps should not be allowed to demand access they do not need to…

You picked a bad example, as Uber car ordering does work with location services disabled. Any better examples come to mind of apps that refuse to run unless hey have an unreasonable feature granted?

Perhaps this has changed recently, but the last time I tried to use Uber without "allow location access even when not using the app," I was unable to call a ride. Instead, I was given instructions on how to enable that setting.

Re: iOS 10 Security White Paper [pdf]

#68
post #52

What's lacking is a requirement that Apple Store apps must cooperate with user privacy settings. If the user denies an app access to location services, contacts, or calendars, Apple should require that the app still run. For example, if the user denies the Uber app location information when the app is not being used, Uber car ordering should still work. Apps should not be allowed to demand access they do not need to…

You picked a bad example, as Uber car ordering does work with location services disabled. Any better examples come to mind of apps that refuse to run unless hey have an unreasonable feature granted?

On Android, GM's Maven car-sharing app (similar to ZipCar) does not run unless all permissions are granted, which include the ability to manage phone calls.

The Chinese WeChat messenger also refuses to run unless location access is granted, even though messaging apps do not depend on location to work.

This type of behavior makes fine-grained permissions systems not very useful. It should be prohibited by the Apple App Store and Google Play Store.

Re: iOS 10 Security White Paper [pdf]

#69
post #64

Microsoft's paper: https://www.microsoft.com/en-us/research/wp-content/uploads/...

Slightly offtopic, that cant be a wordpress instance can it? I've only seen `wp-content` paths on wordpress blogs...

Yep, it's WordPress: https://www.microsoft.com/en-us/research/wp-login.php
Post reply on HN