Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a travel iPhone

blog.filippo.io

Post reply on HN
Print view View original

81–90 of 113 posts

Re: Securing a travel iPhone

#81

Post by johncolanduoni »

Esau wrote: post #80
rimantas wrote: post #62

Earlier quoted context omitted.

Talk about throwing out the baby with bathwater. Being unconscious ir a very rare use case for iPhone. In other cases having protection provided by Touch ID beats passcode which is to inconvenient so many would skip and left without ANY protection. Touch ID is basically transparent and provides adequate protection for common scenarios.

I would rather have no passcode than use Touch ID.

Instead of being vulnerable in some specific scenarios, you want to be vulnerable in a lot of common scenarios as well as the original ones?

Re: Securing a travel iPhone

#82

Post by rdtsc »

Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

> but what can be done to increase the recoverability of these expensive items?

Don't buy or walk with expensive items around? Sounds like I am being snarky, but I am serious. In some cities or areas, it is not possible to have nice stuff around. Couldn't have a nice car in my old neighborhood. The old beater I had was scratched, hit and broken into multiple times. I didn't care too much, as it was already scratched and beat up anyway. If it was a nice new car, I would have been upset, but I would have never gotten a nicer car living in that part of town.

As for phone, I broke my old flip phone some years ago, by sitting on it. And I was upset about it obviously, it was a nice model then. I was student, bought it by saving for a while. Didn't have insurance and so on. And since then realized that it didn't make any sense for me to buy these expensive toys if they can easily be lost, stolen, broken _if_ it causes me so much anguish when happens. So since then I've bought used, or lower end smart phones (last one is a Moto G for $170 from 3-4 years ago) so that if it gets, broken, stolen, lost I wouldn't be too upset about it, just inconvinienced some, and would just go and buy another one. Kind of like buying another pair of pants or socks.

I one day if I win the lottery, maybe I'll be able to buy $500-$600 iPhones like that too. But today If I had one, and cracked or lost, I would be quite upset.

I am saying this because I've seen people sign contracts to buy these phones (which is basically getting a loan), buying insurance for them and so on, and all I am think "it sounds like you can't afford it". Can't obviously tell them that in person, but's that the idea.

Re: Securing a travel iPhone

#83

Post by b15h0p »

About turning off iCloud backup: You say that messages are being stored unencrypted. That may be true as we do not know what happens on Apple servers. But this is about securing the phone for traveling i.e. you would have to worry about the transport. And I would strongly guess that backup traffic would happen with http, probably with pinned certificates.

Re: Securing a travel iPhone

#84

Post by rdtsc »

jxcl wrote: post #32
ThatGeoGuy wrote: post #11

Earlier quoted context omitted.

Keep in mind this is strictly relevant to US jurisdiction. In Canada, I recall that you can be compelled by a court to give up a password, or be held in contempt. That being said, something like TouchID is irrelevant if the password is going to be forced out of you anyways.

This makes sense if you tell them that you know the password and refuse to give it, but what if you claim not to remember the password? Or claim never to have known it? What burden of proof is required then in order to be held in contempt?

They won't believe and lock you up until you remember?

Contempt of court can basically be "get into jail indefinitely" card.

From the wiki: "The civil sanction for contempt (which is typically incarceration in the custody of the sheriff or similar court officer) is limited in its imposition for so long as the disobedience to the court's order continues: once the party complies with the court's order, the sanction is lifted."

It seems a judge can "choose" not to believe you. Whether they truly don't or not is another problem, but officially they can claim so. I am not sure if it takes another superior judge to get someone out of jail in that case or ... or just wait for the original judge to retire...

Re: Securing a travel iPhone

#85

Post by smartbit »

What I miss in this article in using MDM to harden an iOS devices in the first place. Eg. you can prevent the ability to make backups [0] diminishing that as a route to exfiltrate information. Secondly an always-on VPN [1] to a fixed IP address prevents network information leakage from the moment the device is turned on the first time. A quick search resulted in these two links but I didn't hit a comprehensive guide, other than Apples MDM docs, combining this travel guide combined with iOS MDM hardening.

[0] https://community.rapid7.com/community/infosec/blog/2015/11/...

[1] http://www.howtogeek.com/218851/how-to-enable-always-on-vpn-...

Re: Securing a travel iPhone

#86

Post by quesera »

dogma1138 wrote: post #67
nxzero wrote: post #53

Earlier quoted context omitted.

Where was the power coming from if the battery was removed? Only device that I'm aware that's able to do this is designed for this application.

It's very old phones, with external antennas the power came from the same place that the power came from to say power the LED in the aftermarket NOKIA antennas that would light up when you are getting a call or a text - wireless power. The phone had enough leakage to modulate the return signal sufficiently to be detected, it would not be the same thing as tracking a phone via its normal cellular signal it would just…

I don't believe this.

Those aftermarket lighty-uppy things work by sensing your phone's response burst, which is a much stronger signal, being driven by the phone's battery, and radiated from the very nearby antenna.

I do believe that you can induce a signal in a powered-off phone that can be detected nearby (several feet), by virtue of the tuned antenna if nothing else. I'm skeptical of the claim that a normal arbitrarily-distant cell transmission could do so. Regardless, I do not believe the induced signal could be detected back at the cell tower.

This would be wireless power. Not possible, at the levels and ranges asserted.

Re: Securing a travel iPhone

#87

Post by mehrdada »

A key step missing is to set up the iOS device as Supervised in Apple Configurator and prevent pairing with non-Configurator hosts. Additionally, you can install your own non-removable profile via Configurator on the device disabling a bunch of privacy-damaging features there.

Re: Securing a travel iPhone

#90

Post by watson »

mahyarm wrote: post #78
newman314 wrote: post #61

Earlier quoted context omitted.

I'd avoid using TouchID to unlock your phone for legal reasons. Once the phone is unlocked, you can use TouchID as the phone is already open and you would not gain/lose anything from using TouchID in that scenario. But until the courts rule that you cannot be compelled to TouchID unlock your phone like a PIN, I think that is the safer route to take for now.

If you expect you can reliably turn off your phone (7 seconds) before you get in a search situation, then use a full password instead of a numeric pin, then touch ID is a great balance of convenience and security. TouchID also prevents shoulder surfing of your code. It's all about the threat model.

Correct me if I'm wrong, but isn't it also possible to just use one of your fingers that you didn't register with touch ID for 5 or so consecutive unlock attempts and it will have the same effect as rebooting your phone?
Post reply on HN