News for hackers. Stuff that matters.
Re:iOS 11 Security [pdf] by tptacek on Saturday January 13, 2018 @03:04PM (#16141062)
I don't understand where that is coming from. What parts of the iOS security model involve blind trust in Apple, apart from the firmware update process?

The data you're supposing they might sell to the Chinese in the future is mostly stuff they go out of their way not to collect in the first place.

Re:iOS 11 Security [pdf] by fauigerzigerk on Saturday January 13, 2018 @03:25PM (#16141173)
This is clearly coming from an "if it's not open source it can't be secure" angle.
Re:iOS 11 Security [pdf] by lisper on Saturday January 13, 2018 @03:28PM (#16141196)
I'm not insisting on open source (though I do prefer that all else being equal). But I would like my computing infrastructure to be independently auditable.
Re:iOS 11 Security [pdf] by lisper on Saturday January 13, 2018 @03:27PM (#16141185)
My real concern is not that Apple will one day announce that they will change their business model to be more like Google bwahahaha, it is that they will either be, or have already been, infiltrated by foreign government agents (most likely Chinese) who will advance to positions of authority inside the company and use that authority to insert back doors surreptitiously. The other plausible scenario is that Apple management will decide to put patriotism or national security concerns ahead of commerce and decide to cooperate with the U.S. government to insert a back door. I think it's not unreasonable for someone to assign Bayesian priors to these events that are greater than zero. The problem is that there is no way to obtain any data to update that prior.

What makes this attack plausible is that it's relatively easy to mount (for the Chinese government) with a potentially huge payout (by their quality metric). It's hard for me to imagine that they haven't tried, and once you get to that realization, it's only slightly harder to imagine that they haven't succeeded.

Re:iOS 11 Security [pdf] by fauigerzigerk on Saturday January 13, 2018 @03:49PM (#16141320)
You have to do more than insert a backdoor. You have to keep it secret as well, and that is almost impossible to do.