Your iPhone knows more about you than anyone. Here’s how to lock it down in an afternoon: passcode, account, location, lock screen, radios, browser and backups. Full checklist at the end.
Your iPhone knows more about you than anyone. Here’s how to lock it down in an afternoon: passcode, account, location, lock screen, radios, browser and backups. Full checklist at the end.
likewise, i can read the news stories about the lawsuits and the corporations ignoring switches and collecting that data anyway.
also remember privacy and security are related but are two different things.
I am open to hearing evidence that iphone hardening is a myth.
again: can’t prove a negative.
you show me transmission of data can be stopped.
I didn’t make the claim that iPhone hardening is a myth, you did. I am open to you providing something to back it up, as I have not seen anything that would.
You said you can read news stories about the toggles not doing anything. May I see the news stories that show the options in iOS don’t do anything?
you made the point that it works. here’s one example i googled in 30 seconds. here’s one for apple i also found in another 10.
your turn i guess.
I want to keep it 100% with you: I did not make the point that it works. I made the point that your claim (and apologies, I’m paraphrasing here) “there is no way to believe it works unless you personally can see the code” is absurd and I will stand by that.
The first link you sent seems to be about google. You were talking about iPhones though. Are you trying to make a broader point about more than just iOS?
The mysk case referenced in your next link (nov. 2022 analysis of a mid 2021 iOS version) actually had an interesting update this year: all the wiretapping type charges got thrown out but the deceptive practices claims were allowed to proceed. It’s likely the plaintiffs will win that one since the company has significantly changed the wording around the settings controls in question in the intervening five and a half years of development.
Despite how this might seem, I’m not trying to fight you. I want to bring this back to how you initially said “ios hardening is a myth”. I really think you have a cohesive approach and argument to make but you’re not tying it all together because you think that left on their own claims like the above and the one about not being able to trust settings unless you can see the source are self evident but they’re not.
as a kind of backwater waste of time discussion spur I think that specifically the source reading line of reasoning pushes people away from security and privacy because it excludes a person who can’t analyze the source code because they are unable to effectively read it.
Normal person who can’t read code even if it were in front of them in plaintext: “well fuck me I guess”
Now it’s extremely clear to me from your replies that you feel you’re in some kind of fight or something. I don’t want that. We don’t have to keep talking if this is stressing you out and it’s not a win or a loss.
then we are arguing different things. i’m not exactly saying having the source code is the only way to assure a device is private. i’m arguing an US company known to take part in the PRISM program and involved in the currently openly fascist admin using the surveillance to hunt people cannot be trusted at all. i can sound oppositional sometimes but i’m not arguing in bad faith at all.
also “reading the source code” is something done in community, not individually. this is a very important distinction. i don’t know the linux kernel is safe because it goes right over my head, but there are plenty of well intentioned eyes on it that do in our community.
iphone hardening is to me like installing proprietary antivirus software on windows. you are not any safer at all, and the impression of safety and the dropping of our guards that it causes is detrimental for real safety. we shouldn’t be wasting time thinking about ineffective half measures, we should want to be safe.
I don’t think you’re arguing in bad faith or being oppositional at all and I think it’s good you care about this stuff. I care about it too.
TBH I kinda get the impression you have a bit more of an idealist take on things than I do.
PRISM is not something companies or individuals choose to comply with. The NSA demands data under color of law (section 702!) with disputes mediated in secret courts run by judges handpicked for those roles.
Avoiding the possibility of data collection through the cloud service vector doesn’t protect the user because every telecommunications company I am aware of is known to have complied with fisa demands, most germane to our topic: Verizon very famously. So even if a user isn’t using any cloud service that handles their data, their data still gets handled by telecom companies doing the exact same bulk collection of encrypted transmissions for processing at a later date.
No American can escape PRISM without completely leaving all telecommunications behind no matter the manufacturer of their computer or the programmer of its operating system and software.
I use Linux everyday and have as a main os for a long time.
The Linux kernel is not safe. In the past year there have been high cvss bugs and vulnerabilities discovered which were present for decades (yes, with an “s”). There are first party accounts of direct infiltration attempts and evidence of covert ones with varying degrees of success from nothing to long con winners like lz.
All operating systems have bugs and vulnerabilities which impact their security and safety.
From a laypersons perspective even assuming they are familiar with the concept of open source, how can they be expected to put their trust in a community that can’t even keep itself safe?
Remember that interactions between a person and some company are mediated by law. If Google or Apple screws them over there’s at least the pretense of some recompense. If your average user gets hit by a deserialization error in Linux they can’t come back on kernel.org, they’re just flapping in the breeze!
I do not use proprietary antivirus on windows and generally point people away from it except for some unique situations.
You are mistaken about proprietary antivirus on windows. While recently there has been a big effort to kick them out of ring0, they do actually perform a task with measurable degrees of completeness using real techniques for securing code execution and user data. You might think as I do for my own purposes that they’re not doing you any good but no matter how much we both might hate norton, it is doing something.
Specifically for many users third party antivirus is a trusted secure process they can rely on when they have no baseline of trust for the operating system.
The above is not gibberish. Many people fundamentally do not trust windows and cannot make a clear determination how to proceed when some dialogue box pops up (think uac of olde). You and I hate the bright orange, yellow and red windows of third party antivirus but they’re using those colors to make them clearly stand out from the os’ warnings.
We may see an intermediary between us and links in our emails as a waste of time but for a lot of people the process of clicking only the links with the big green checkmark next to them (indicating the destination has been vetted by the third party antivirus and isn’t malicious) is one that keeps them safe.
Could that be accomplished with retraining? Yes but no one is doing it and generally retraining efforts in organizations don’t actually do a good job and leave users feeling confident enough.
Ios hardening is effective and is not a half measure unless evaluated against a bar for security that excludes using public telecommunications networks.