Journalist’s phone hacked: all he had to do was visit any website

Re:Journalist’s phone hacked: all he had to do was visit any... by greggman3 on Tuesday June 23, 2020 @11:09PM (#23623574)

Too bad I can't run a different browser engine on iOS. In a monoculture everyone is exposed to the same vulnerabilities. If we had 3 or 4 browser engines running on iOS then the odds of a specific vulnerability affecting a single user go down.

Further, there is competition for having the most secure browser. it's not controversial to say the 12 years ago IE, Firefox and Safari were pretty bad at security and Chrome in 2008 pushed them all to up their game.

Apple's stance on browser engines is at best claiming security by obscurity. Either apps are sandboxed or they aren't. If they are then it would be safe to run any browser engine. If they aren't then having only one means users have no choice when that one fails.

[ Parent | on HN ]

Re:Journalist’s phone hacked: all he had to do was visit any... by willyt on Wednesday June 24, 2020 @03:36AM (#23625180)

It doesn’t protect you from vulnerabilities in things like, say the code in the system API which paints video frames to the screen, which is where a lot of these vulns seem to be. It wouldn’t have been 2008, didn’t safari and chrome mostly share WebKit for quite a long time anyway?

[ Parent | on HN ]

Re:Journalist’s phone hacked: all he had to do was visit any... by greggman3 on Thursday June 25, 2020 @12:24AM (#23636891)

They shared WebKit in 2008, but Chrome ran WebKit in its own process with no permissions and Safari did not, one of the reasons why Chrome was so much more secure. Glad I had the option to run Chrome and secure my browsing. I don't have that option on iOS. No team is allowed to even try to make things more secure.

[ Parent | on HN ]

Re:Journalist’s phone hacked: all he had to do was visit any... by gbrown on Tuesday June 23, 2020 @11:34PM (#23623743)

Plus, no ublock origin for Safari.

[ Parent | on HN ]