Microsoft's paper: https://www.microsoft.com/en-us/research/wp-content/uploads/...
Slightly offtopic, that cant be a wordpress instance can it? I've only seen `wp-content` paths on wordpress blogs...
wordpress is popular man
iOS 10 Security White Paper [pdf]
71–80 of 99 posts
Re: iOS 10 Security White Paper [pdf]
#72What's lacking is a requirement that Apple Store apps must cooperate with user privacy settings. If the user denies an app access to location services, contacts, or calendars, Apple should require that the app still run. For example, if the user denies the Uber app location information when the app is not being used, Uber car ordering should still work. Apps should not be allowed to demand access they do not need to…
You picked a bad example, as Uber car ordering does work with location services disabled. Any better examples come to mind of apps that refuse to run unless hey have an unreasonable feature granted?
Signal won't run without access to your contacts (at least on iOS). Whether that's considered "unreasonable" is being actively argued on Twitter at the moment...
Re: iOS 10 Security White Paper [pdf]
#73This is one of the reasons why Apple is still great. Their designs are thoughtful and deeply-considered. They may disappear up their own asses with a fair amount of regularity, but that doesn't stop them from excelling in certain areas (such as, indeed, privacy and security).
And stuff like accessibility and environmental sustainability.
There's a bunch of areas which only matter a lot to a small group of people where, when you investigate it, Apple has quietly been doing the right thing for a long time.
Re: iOS 10 Security White Paper [pdf]
#74This is really cool: > Securely erasing saved keys is just as important as generating them. It’s especially challenging to do so on flash storage, where wear-leveling might mean multiple copies of data need to be erased. To address this issue, iOS devices include a feature dedicated to secure data erasure called Effaceable Storage. This feature accesses the underlying storage technology (for example, NAND) to directl…
What purpose do you want to access raw NAND? If you are okay with just a basic low speed connection to read the NAND, there is a fairly standardized async protocol which you could achieve with a dozen GPIO pins. You could also use a FPGA or and NAND flash programmer (like of like the old EPROM programmers) However beyond this, you need to know a bit more information to interpret this raw data. This includes any data…
I just want it to show up in the OS as MTD so e.g. I could use it with JFFS2 like OpenWrt does on routers. But on a desktop PC.
Re: iOS 10 Security White Paper [pdf]
#75Earlier quoted context omitted.
It is sad that something like the iCloud Keychain is so poorly implemented across the different devices.
How so? You mean from user access and usability standpoint? I know I certainly wish there was a Keychain access app like on macOS available for iOS rather than only being able to access passwords via Safari settings.
It's worth noting that the iOS and macOS keychains are very different. In fact, if you check the design docs you'll find they share only four functions between them. Essentially, as far as I could tell, the iOS keychain participates in the sandboxing of apps, while the macOS one does not.
Re: iOS 10 Security White Paper [pdf]
#76Earlier quoted context omitted.
You picked a bad example, as Uber car ordering does work with location services disabled. Any better examples come to mind of apps that refuse to run unless hey have an unreasonable feature granted?
Signal won't run without access to your contacts (at least on iOS). Whether that's considered "unreasonable" is being actively argued on Twitter at the moment...
I dont often join in, but the fact this doesn't work without contacts seems alarming. Any guess as to why?
Re: iOS 10 Security White Paper [pdf]
#77There is also this: https://www.youtube.com/watch?v=BLGFriOKz6U
Re: iOS 10 Security White Paper [pdf]
#78Earlier quoted context omitted.
Yes, indeed they went above and beyond - probably because they also need to defend not only against external threats, but against the user of the device himself to keep the walled garden intact.
Yes (dunno why all the downvotes) but Apple went even further than the walled garden would require. They could have easily left an Apple backdoor. But they encrypt the protocol going over wires to/from the Enclave. They go insanely far rather than sufficiently far. Yeah, nation state level attacks will still work, especially if they have the phone. But with Android it's not nation state level. It's corporate level an…
There was an article about iOS security where someone argued that Apple controls the enclave for security reasons, to which I answered that this is basically security by obscurity. You can see I was downvoted for this: https://news.ycombinator.com/item?id=13676135
I still downvoted izacus because it was an uncharitable fanboy rambling. The charitable interpretation would be that the walled garden (in regards to the enclave) is a side effect of their implementation, and not the intention.
Re: iOS 10 Security White Paper [pdf]
#79"Security architecture diagram of iOS provides a visual overview of the different technologies discussed
in this document."
as opposed to what I'd expect:
'Security architecture diagram of iOS provides a visual overview of the different technologies IN AN IPHONE.'
Re: iOS 10 Security White Paper [pdf]
#80@computerality extracted the sections that changed between the iOS 9 and 10 security white papers here: https://gist.github.com/computerality/3e0bc104cd216bf0f03f8d... tl;dr: https://twitter.com/computerality/status/844652877058625536 https://twitter.com/computerality/status/844654500141060096 https://twitter.com/computerality/status/844655868377550848
And here's a direct link to the computerality diff in plain text for easy viewing on mobile:
https://gist.githubusercontent.com/computerality/3e0bc104cd2...