It's detestable how Apple handled the aftermath of this: https://en.wikipedia.org/wiki/FORCEDENTRY In November 2021, Apple Inc. filed a complaint against NSO Group and its parent company Q Cyber Technologies in the United States District Court for the Northern District of California in relation to FORCEDENTRY, requesting injunctive relief, compensatory damages, punitive damages, and disgorgement of profits but in 202…
If I remember correctly the Israeli government stepped in and seized all the material that Apple could use in the lawsuit, so there was no point in continuing.
If Israel can deter Apple so easily, that doesn't bode well at all for Apple's stance towards American surveillance.
> That is, unless we balkanize our systems and services. ...all the way back to pen and paper
I wouldn't be surprised for certain kinds of secret sharing. Storage is cheap and sneaker-nets are easy. I'm sure someone is figuring out a network solution where 2 computers both have a 100tb hard drive with the same one-time pad. https://en.wikipedia.org/wiki/One-time_pad
Add a a sliding window aliasing mode to the hardware? You'd set a page table bit saying "check capabilities not against my VA, but those VAs over there"
Voting with your wallet doesn't work when the overwhelming majority does want to be locked up.
Maybe it is not that they want to be locked up, but they are clueless / don't care. It sucks when the reason for why we can't have nice things is... the majority of people, doesn't it? In politics they would just say democracy at work, and believe me, people are just as clueless about that as they are with technology / privacy / security.
In this very thread you can see really smart technologists largely praising this. Those aren't random Joes, and they have pretty convincing arguments - it really does improve security (and for some people, physical safety). Apple always makes very convincing points and plausible cases which are truly hard to argue against, when it takes away any kind of control from the users for their own good.
This doesn't change the fact that you're being gradually locked up, though.
If I remember correctly the Israeli government stepped in and seized all the material that Apple could use in the lawsuit, so there was no point in continuing.
If Israel can deter Apple so easily, that doesn't bode well at all for Apple's stance towards American surveillance.
It's just a private company. They only have power compared to governments in Cyberpunk.
Maybe it is not that they want to be locked up, but they are clueless / don't care. It sucks when the reason for why we can't have nice things is... the majority of people, doesn't it? In politics they would just say democracy at work, and believe me, people are just as clueless about that as they are with technology / privacy / security.
In this very thread you can see really smart technologists largely praising this. Those aren't random Joes, and they have pretty convincing arguments - it really does improve security (and for some people, physical safety). Apple always makes very convincing points and plausible cases which are truly hard to argue against, when it takes away any kind of control from the users for their own good. This doesn't change t…
Truth be told, I do not know that much about Apple, I have no clue what their reasonings are, but you have heard of the old and tiring "think of the children" one, for example. Seemingly it seems benign and way too many fall for it, unfortunately. No one wants to seem, or even feel evil about themselves. Can you give me any references to Apple's convincing points I could read about? I wonder if it is something akin to that, or "anti-terrorism". We have to take away your freedom in the name of national security, fighting terrorism, and protecting our children, as it is the case in the political sphere.
Maybe it is not that they want to be locked up, but they are clueless / don't care. It sucks when the reason for why we can't have nice things is... the majority of people, doesn't it? In politics they would just say democracy at work, and believe me, people are just as clueless about that as they are with technology / privacy / security.
In this very thread you can see really smart technologists largely praising this. Those aren't random Joes, and they have pretty convincing arguments - it really does improve security (and for some people, physical safety). Apple always makes very convincing points and plausible cases which are truly hard to argue against, when it takes away any kind of control from the users for their own good. This doesn't change t…
> There has never been a successful, widespread malware attack against iPhone. The only system-level iOS attacks we observe in the wild come from mercenary spyware ... to target a very small number of specific individuals and their devices. Although the vast majority of users will never be targeted in this way.. Correct me if I'm wrong, but the spyware that has been developed certainly could be applied at scale at th…
I wonder why XcodeGhost doesn't count as successful, widespread malware attack against iPhone. WeChat was infected. It was before iOS had pasteboard protections. [1] https://en.wikipedia.org/wiki/XcodeGhost
XcodeGhost was an attack against app developers. It did not exploit the iphone or iOS in any way, it exploited humans who build iOS apps. Memory corruption and zero-day / zero-click exploits on devices is a very different thing.
Four bits provide too few possibilities. Since memory allocations happen millions of times per minute, the chance of collisions grows very quickly, even with periodic reseeding.
But you only get one try. 15/16 times you get a very visible failure. It isn't great. Most users won't assume malice when an app crashes. And if they reopen it a few times your chance of succeeding goes up quickly. But this is also assuming that you need a single pointer tag to exploit something. If you need more you need to get even luckier. So it definitely isn't perfect protection. But it isn't trivial to bypass.
This could be solved at the OS level. Just crashing and closing the app would lead the user to simply re-open it and try again. However, if iOS detects this type of crash it could sternly alert the user that the application they are using is likely compromised. It could also transmit analytics for these specific types of crashes to Apple, who would have very realtime insights into newly compromised apps. I don't think the idea here is "crash silently and let the user reopen the app as many times as they want" I think its "crash very very loudly"
> If you need more you need to get even luckier.
This is a good point. Im not an expert but im guessing one is rarely enough, which would exponentially decrease your chances of success by brute force, e.g. 2 tags would be 1/256 etc
1988 called and wants it memory tagging back https://www.devever.net/~hl/ppcas ! But yeah this was support for a the longest time by IBM basically. It's nice to see it's getting more widespread.
SPARC ADI was a predecessor to ARM MTE. ARM MTE has been available and used in production for several years now. ADI is also 4 bit but with 64 byte granularity rather than 16 byte.