Your iPhone knows more about you than anyone. Here’s how to lock it down in an afternoon: passcode, account, location, lock screen, radios, browser and backups. Full checklist at the end.
Your iPhone knows more about you than anyone. Here’s how to lock it down in an afternoon: passcode, account, location, lock screen, radios, browser and backups. Full checklist at the end.
then we are arguing different things. i’m not exactly saying having the source code is the only way to assure a device is private. i’m arguing an US company known to take part in the PRISM program and involved in the currently openly fascist admin using the surveillance to hunt people cannot be trusted at all. i can sound oppositional sometimes but i’m not arguing in bad faith at all.
also “reading the source code” is something done in community, not individually. this is a very important distinction. i don’t know the linux kernel is safe because it goes right over my head, but there are plenty of well intentioned eyes on it that do in our community.
iphone hardening is to me like installing proprietary antivirus software on windows. you are not any safer at all, and the impression of safety and the dropping of our guards that it causes is detrimental for real safety. we shouldn’t be wasting time thinking about ineffective half measures, we should want to be safe.
I don’t think you’re arguing in bad faith or being oppositional at all and I think it’s good you care about this stuff. I care about it too.
TBH I kinda get the impression you have a bit more of an idealist take on things than I do.
PRISM is not something companies or individuals choose to comply with. The NSA demands data under color of law (section 702!) with disputes mediated in secret courts run by judges handpicked for those roles.
Avoiding the possibility of data collection through the cloud service vector doesn’t protect the user because every telecommunications company I am aware of is known to have complied with fisa demands, most germane to our topic: Verizon very famously. So even if a user isn’t using any cloud service that handles their data, their data still gets handled by telecom companies doing the exact same bulk collection of encrypted transmissions for processing at a later date.
No American can escape PRISM without completely leaving all telecommunications behind no matter the manufacturer of their computer or the programmer of its operating system and software.
I use Linux everyday and have as a main os for a long time.
The Linux kernel is not safe. In the past year there have been high cvss bugs and vulnerabilities discovered which were present for decades (yes, with an “s”). There are first party accounts of direct infiltration attempts and evidence of covert ones with varying degrees of success from nothing to long con winners like lz.
All operating systems have bugs and vulnerabilities which impact their security and safety.
From a laypersons perspective even assuming they are familiar with the concept of open source, how can they be expected to put their trust in a community that can’t even keep itself safe?
Remember that interactions between a person and some company are mediated by law. If Google or Apple screws them over there’s at least the pretense of some recompense. If your average user gets hit by a deserialization error in Linux they can’t come back on kernel.org, they’re just flapping in the breeze!
I do not use proprietary antivirus on windows and generally point people away from it except for some unique situations.
You are mistaken about proprietary antivirus on windows. While recently there has been a big effort to kick them out of ring0, they do actually perform a task with measurable degrees of completeness using real techniques for securing code execution and user data. You might think as I do for my own purposes that they’re not doing you any good but no matter how much we both might hate norton, it is doing something.
Specifically for many users third party antivirus is a trusted secure process they can rely on when they have no baseline of trust for the operating system.
The above is not gibberish. Many people fundamentally do not trust windows and cannot make a clear determination how to proceed when some dialogue box pops up (think uac of olde). You and I hate the bright orange, yellow and red windows of third party antivirus but they’re using those colors to make them clearly stand out from the os’ warnings.
We may see an intermediary between us and links in our emails as a waste of time but for a lot of people the process of clicking only the links with the big green checkmark next to them (indicating the destination has been vetted by the third party antivirus and isn’t malicious) is one that keeps them safe.
Could that be accomplished with retraining? Yes but no one is doing it and generally retraining efforts in organizations don’t actually do a good job and leave users feeling confident enough.
Ios hardening is effective and is not a half measure unless evaluated against a bar for security that excludes using public telecommunications networks.