News for hackers. Stuff that matters.
Re:iOS 11 Security [pdf] by lisper on Saturday January 13, 2018 @03:13PM (#16141116)
I actually think the most likely scenario is for Apple to be infiltrated by agents of the Chinese government. I have no idea how likely this is because I have no idea what Apple's internal controls are like. But I'm pretty sure that someone who knew what they were doing could slip a back door into OS X if they had write-access to the source tree, and that they could do this in a way that even if it were noticed would provide them with plausible deniability that it was just a careless bug. I'm also pretty sure that the Chinese government could cultivate an agent who was indistinguishable from a highly qualified software engineer that Apple would not hesitate to hire. Such a person might even be a U.S. citizen.

I also think it's possible that Apple could sneak a back door into the OS in cooperation with the U.S. government while maintaining an overt posture of defending their user's privacy. Yes, this would be risky, but if Apple management put patriotism or national security above commerce (which is not a completely unreasonable thing for them to do) they might decide to take such a risk.

Re:iOS 11 Security [pdf] by josho on Saturday January 13, 2018 @06:05PM (#16141886)
> it's possible that Apple could sneak a back door into the OS

Apple has gone to great lengths to make both devices secure and policies. You are awfully critical, so I really want to understand what is the expected behavior that you'd like to see?

Open source the security libraries? But if you don't trust Apple not to backdoor then what's stopping them from putting the backdoor in the kernel? At some point we must trust something.

Re:iOS 11 Security [pdf] by lisper on Saturday January 13, 2018 @06:20PM (#16141932)
> Open source the security libraries?

That would help a lot.

> But if you don't trust Apple not to backdoor then what's stopping them from putting the backdoor in the kernel?

At the moment, nothing. That's kind of my point.

> At some point we must trust something.

Yes, that's true, but the more I can poke around under the hood (or hire someone to do it for me) the warmer and fuzzier I feel.

Re:iOS 11 Security [pdf] by frutiger on Saturday January 13, 2018 @03:29PM (#16141201)
So as a regular user, golerka's biggest concern should be that the Chinese government is going to steal their credit card number/look through some of their private pictures/create a profile on them because Apple's employee background checks might not be thorough enough?
Re:iOS 11 Security [pdf] by lisper on Saturday January 13, 2018 @03:45PM (#16141290)
No, Golerka's biggest concern should be that some independent researcher or Romanian hacker will discover the back door, and they will use it to steal money directly out of their bank or brokerage accounts.

In other words: I think that the odds are >0 that there is a systemic weakness in Apple's security, either accidental (like the meltdown and spectre issues almost certainly are) or deliberately introduced by a mole, or by Apple's management in service of some higher cause. I think that the odds are further >0 that this weakness could be discovered by a malicious party, and that will end up leading to major problems, not all of which will necessarily be immediately obvious.

Re:iOS 11 Security [pdf] by frutiger on Monday January 15, 2018 @12:41AM (#16148730)
> In other words: I think that the odds are >0 that there is a systemic weakness in Apple's security

I think the odds are >0 that I will get a straight flush in my next hand at poker. Unfortunately, while true, this is not a valuable observation.