It's fair to say that the GPLv3, which predates the iPhone, did not anticipate the nuances of people storing all their secrets on a tiny little computer that they keep with them at all times, including when they pass through international borders.
(As others have said, there's ways to make GPLv3 work with the iphone's security model, mainly along the lines of requiring a factory reset whenever you want to add an allowed signing key to the device.)
How does the ability to wipe the phone (and thus the data, and the code compiled and signed by Apple) and replace its signing keys with your own allow an attacker to surreptitiously install a rootkit?
The dangers of physical access to one's devices existed before mobile computing, let alone before GPLv3 or the iPhone.
Nobody could be certain if they were running a trusted version of iOS.
This problem has been solved outside of Apple's garden.
Unlike other mobile operating systems, iOS prioritizes protecting the user's privacy. The real user, not just any household member or employer who might have physical access to the device.
In your described solution, what prevents an abusive/sneaky household member from posing as the user and supplying those "user-configurable" keys without the knowledge of the real user? Nothing? That answer wouldn't be good enough for the Apple "garden" as you call it.
The function "replace keys" can have any other programmable feature attached to it. Wiping out all preexisting data, reseting the phone to factory settings, and sending a message to the original owner is all possible and would make any sneaky behavior very un-sneaky. They could even require some form of 2auth or other technique that people use to authorize themselves to banks in order to get the unit-unique key to make the TPM memory rewritable. GPLv3 don't require that installing new keys are easy, but the real owner must have a method to do it.
Apple sees the iPhone as a hardware security device. Apple wants users to be confident enough in its security that they can use their phones to authenticate financial transactions.
It's great that some phones are modifyable by their users, but I would never ever link my Android phone with my bank account.
Personally I prefer that my hardware security device are controlled and owned by me, not the company that sold the device. Devices not owned by me have an undeniable history of being abused by people who sell such devices, like the case of Lenovo.
If you want to use the history of open devices which their owners can own and control as a case against it, the opposite of company approved software has also a history of abuse. How are all those nice lock down car computers that have been acting creatively during emissions tests. How much trust have they earned, and should people trust them with their bank account for say automatic payment at gas stations?
Because that's not how security works. If you can just add your keys, an attacker could too...
I don't trust Apple to be good from now until I replace my phone. I don't trust Google to be good from now until I replace my phone. It's my phone, not Apple's and not Google's.
Err, security is about preventing attacks -- not about having evidence that they've happened.
Besides, select "foil", right click "Look up": (OS X Dictionary): prevent
So, not a native speaker, and there might still be some nuance of preventing from even being considered (avert?) in "foil", and you could be technically correct.
http://static.damnlol.com/media/5c5c06b2d9e1d4e9b66725f86dab...
The former is trivially defeated (just breaking the phone, for example, is much quicker and less involved than forcing a factory reset), and not what we were talking about.
Then the attacker installs some apps including some special ones designed to spy on the user.
Then they remove the screen lock, or set the password to something guessable or that turns up as a suggestion when Googling for "I can't get into my phone" and return the device to where the user had it last.
The naive user finds their device, gets in, and notices their data is gone. This is real harm.
Now they start using the device, and they are spied on, on an ongoing basis. This is more harm.
I'd have to say your system as described isn't working.
That's only slightly better than losing the phone itself.
> Now they start using the device, and they are spied on, on an ongoing basis. This is more harm.
This is more substantial. But if you are talking of the naive user who would not take notice of their Apple account suddenly vanishing from their device, there are easier ways for breaking in to their device without having to wipe it.
Apple's system doesn't work to secure naive users against dedicated attackers. If Apple's system has any design for security (and I agree it does), it's for users who'd notice when their data is wiped.
When you say it doesn't work against dedicated attackers, maybe you are thinking of an iPhone 6 hacked by an Israeli security company paid by the FBI? For one thing, most people don't have the resources of the FBI. And I think Apple has raised the bar significantly in the three or more generations since that device.
If you were to own an iPhone and also apply some conscious awareness to noticing what it does on your behalf to protect your security, I think you would agree it has a lot of very effective measures to protect users.
Social engineering, for one, is much easier against naive unsuspecting users than wiping their phone and hoping they wouldn't bother.
For those who truly care about their own data security though, a wiped phone is an instant siren.
----
I have used an iPhone, though only for a short while, and not long enough to get used to it. I agree it goes a great, great distance to protect users against everyone not blessed by Apple.
But then I have greater data security on my laptop and far greater freedom too, so Apple's offering doesn't seem like a good enough deal to me.
Also with a laptop the use cases generally can tolerate a bit more delay in the login process, with a few seconds being tolerable, whereas with mobile devices a login process over a second starts to get intolerable very quickly as the length of the process increases. Again this may be obvious and yet you seem oblivious to it as a consideration, as you expect a better offer, as though there are no constraints and tradeoffs, or you are unaware of them.
Mobile device designers and mobile system designers deal with this stuff every day for years on end. They know a lot about it, and have thought stuff through way more than some of us. It's super easy for you to criticize from a position of relative ignorance (not even a current iOS user...) but I'm pretty sure they are still following the mantra of trying to make stuff insanely great.
Still, you can dream of even better devices. I'm sure the bar will keep being raised. Let's hope we get there to a place where we do have both freedom and security.
> Again this may be obvious and yet you seem oblivious to it as a consideration, as you expect a better offer, as though there are no constraints and tradeoffs, or you are unaware of them.
I'm not oblivious to the tradeoffs of security. I know that if I set a long password it only makes every login that much more tedious. And that's my problem to deal with. But to have no choice, no freedom, no chance of owing your device, in the name of "security", is either unmindful or wilfully ignorant of a manufacturer.
----
You keep saying I'm not a current iOS user so I couldn't possibly see the great things iOS does. I merely doubt it could do anything beyond generally security focused OSes. For example, my current mobile OS has a separate decryption password at boot, scrambles the lock screen numeric layout, compartmentalizes my data, hooks into every way apps can request private data and lets me allow/disallow/fake it, hooks into every way apps can even run and lets me choose which to allow/disallow, and still provides me the freedom to run whatever I want and share whatever data I want with whichever app I want.
I'm not dreaming of much more, largely because I already have quite a lot.
I said no such thing. And yet you put it in quotes. This kind of behavior is for reddit, not here.
Apple does give you security; it just has to happen in a different way.
Were I an iOS device owner, I would want the ability to replace the root signing keys on any device I'd own. It'd be my device: why should Apple have the unique privilege of determining what software may run on it?