Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rotten Apple

adactio.com

Post reply on HN
Print view View original

121–130 of 226 posts

Re: Rotten Apple

#121

Post by s1k3s »

> risks from installing software that compromises system integrity with malware or other malicious code

Sorry, what? Are they implying that iPhone's security isn't built inside the OS itself, but somehow depends on having every app pass their 30 second review on the store? That doesn't seem right.

> exposure to illicit, objectionable, and harmful content due to lower content and moderation standards, and increased risks of scams, fraud, and abuse

Like the deepfake video ads of politicians trying to sell me crypto that I constantly see on YouTube or Meta's apps, all coming from the official store?

Re: Rotten Apple

#122

Post by Fischgericht »

thimp wrote: post #93
Fischgericht wrote: post #79

Earlier quoted context omitted.

That story sounds rather fishy. So your father has found the hidden option to enable developer mode which allows APKs to be sideloaded, and then went to some website to download and install an APK? By the way: According to Kasparsky [1] last year there have been 600 Million downloads of malware that was installed from Google play store, without any sideloading or alternative App stores involved. And of course the App…

Yeah he was persuaded to do it, ironically considering YT is Google, using a video on YT which was trying to sell him VPN software. I blame the paranoia from the constant VPN industry adds being forced down your throat really but the point is that it still does happen. I will add that I have a lot of unsigned APKs on my device as well, but not from those sources!

Ok, but then we are talking about social engineering, and not a technical matter. Social engineering works no matter what the platform is. The caller could have convinced him to give him banking TAN numbers, or send them money etc.

And when it comes to malware it's easier for those attackers to have the malware App on the Google Play store, as this way it's much easier to convince the user to install it...

A friend of mine recently suddenly had someone drawing money from her account using an ATM that was 200 km away while she was shopping with her card. I had a look at her Android phone - nothing Sideloaded on it, they simply appear to have used a fake banking website to make her create a new card without her seeing it.

Long story short: I believe that people need to be taught on how to detect social engineering attempts. And kids should be trained on this in school already.

Re: Rotten Apple

#123

Post by devnullbrain »

this_user wrote: post #47
xandrius wrote: post #9

It's a shame, Apple is in a place to be the leader and decent, instead it decides not to be both.

Apple is the new Microsoft, except worse. Windows was at least still a reasonably open platform.

Crucially, that's not because Microsoft are more ethical - it's because they didn't figure it out first. The solution to this is not a better company, it's better adherence to and implementation of the existing laws.

Re: Rotten Apple

#124

Post by xbar »

zitterbewegung wrote: post #35

Why is it a bad response from Apple to disable a feature that they deem as a security risk if you allow for alternative browser engines? Browsers represent a significant attack surface since they can run code and also transmit data across the network. So when they are allowed to exist now Apple has either two options. One is to do the simple way and remove progressive web apps or extensively test and perform security…

The Apple response is false, thus dishonest and greedy at the expense of consumers.

Re: Rotten Apple

#125

Post by SigmundA »

everydaypanos wrote: post #8

Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”? PWAs are already a separate “island” of storage and share nothing with Safari App… Microsoft does it all the time with Edge on Windows.

The argument Apple is making from my understanding is that to comply with the law the system must allow other browsers and have a system setting of the default browser.

Currently PWA's open in an app that wraps Safari's engine to display the content and provide features but is not normal Safari. They interpret this to violate the browser choice law.

Their solution is to turn that feature off and go back to the icon just spawning the system default browser just like any link since that feature already existed.

To support true PWA's they probably have two choices:

1. Implement a standard WebView API that any engine can support then use that web view api for the PWA shell.

2. Do what Android seems to do and have a api that allows an app to create new launcher icons separate from the main app that starts the main app with parameters like url=https://pwa.com mode=pwa. Then if you create a PWA from Chrome it spawns Chrome if created from Safari it spawns Safari with whatever PWA UI they want. On Android it seems to make a little icon bottom right letting you know the parent app.

#1 is arguably more complex than #2, both are new api's for iOS that don't exist. #2 is on most desktop OS's like MacOS but not on iOS as far as I know.

Apples position is they don't want to put any resources in to creating a new api that could introduce new security surface area unless mandated to. Obviously their motives are not pure but it is a defensible position.

I think #2 would be a good feature adding flexibility to many apps, but the various shenanigans that apps could cause with that would need to be considered.

Re: Rotten Apple

#127

Post by hahamaster »

jadbox wrote: post #18
xandrius wrote: post #9

It's a shame, Apple is in a place to be the leader and decent, instead it decides not to be both.

I love apple for the hardware, but they would be a better company if they released their iron grip over the software. One day I dream I can install Linux on iOS devices.

But why? What does an iPhone have, hardware-wise, that a Samsung or Xiaomi phone does not?

Re: Rotten Apple

#128

Post by xandrius »

disgruntledphd2 wrote: post #48
Keyframe wrote: post #43

I have an ipad through which I subscribed for Apple arcade. I don't use it / play at all on it and there was recently an email that price is going up. Sure, I'll just cancel subscription I said. I don't have my ipad on me, nor any other apple device (I don't use them anymore), nor windows. I have linux machines and android phone. Ok, so how do I cancel subscription? icloud login? no. subscription place of sorts? it w…

Apple always assume that you use their devices as primaries. It can be very annoying. When I wanted to get my wife a replacement MB, I ended up checking out as a guest as they insisted on sending my 2FA code to my iPad (which mostly just annoyed my toddler).

Your toddler gets annoyed that you need a 2FA code on your iPad?

Re: Rotten Apple

#129

Post by Fischgericht »

thimp wrote: post #89
Fischgericht wrote: post #63

Earlier quoted context omitted.

How would suddenly disallowing users to run a PWA that worked for years improve platform security? How would having Spotify be able to use their own subscription system compromise platform security? Being able to install software without needing an OK from the hardware manufacturer has been standard for over 40 years now. People do it on Windows PCs, on Linux PCs, on MacBooks and on Android phones, and that very clea…

It's pretty obvious. They're not disallowing it. They are removing the integration with the home screen so that it will run in third party browsers. That limits it to the smallest common API surface which is "open link". Everything else was a luxury. I don't think you work in IT if you haven't had an infested windows, android or macOS box before. Hell I just spent the other day cleaning my father's Mac out of two VPN…

Not my intention to brag about it, but I run an R&D company and have invented and patents on quite a lot of network technologies :)

The only time in my life where I had an infected devices was in the year 1993 - a boot sector virus on a floppy disk I got from someone.

Luckily my wife is a nerd, too, by sister is trained and has not yet fallen for any of the social engineering tricks before. So no, I do not have to deal with other people's infected boxes either.

Re: Rotten Apple

#130

Post by withinboredom »

thimp wrote: post #73
itsoktocry wrote: post #61

Earlier quoted context omitted.

> This is actually a big problem on Android. The fact that you have an anecdote does not make it a "big problem". If you're side loading apps and entering banking credentials into them, that's a human problem, not a tech problem.

ALL problems are human problems. Don't try and write this off with that one. I can go all day on these. Second one ... corp Android phone. App update ships own browser engine to display about box. Flaw in about box implementation allows user to hit Google. End user uses about box to exfiltrate data from device. Not possible on iOS. Same browser engine and controls. As mentioned I'm an Android user, just a better huma…

> Not possible on iOS

I'm pretty sure it is possible to use a web browser on iOS.

Post reply on HN