People who understand cybersecurity hygiene use iPhones for obvious reasons

Those cybersecurity experts are using GrapheneOS and certainly not an iPhone where they can't even check if all is going well...

I’ve worked with a few people from NCC Group, Matasano, security staff at Airbnb and OpenAI, all carry and recommend iPhones for security footing. Depending on threat model, “lockdown mode” on iOS has a lot of what is useful in Grapheme like turning off built in connectivity services & disabling JIT and other code paths in the webview.

To each their own, I certainly would not recommend an iPhone in this scenario, especially even more at a top tech company.

The reasons are very not obvious to me. Could you elaborate?

iPhone security is very good, better than, say, your desktop even though you don't carry your desktop everywhere you go. (Some Android security is also very good, depends on the hardware though.)

There is no other ecosystem that will provide easy E2EE in the cloud, that’s reason enough for the vast majority of users who are just sick of breaches because of pure sysadmin incompetence.

There are plenty of examples in every Apple service or even their accessories (i.e. wireless keyboard encryption). FaceTime is hardened from even theoretical attacks that could probably only be performed by 5 eyes like transcribing E2EE calls based on bandwidth use (FaceTime has built mitigations around this attack vector).

It would seem that integrating a backdoor funnel to OpenAI is a bit of a security issue to those who care about such things.

Yay, we can all train corporate models for free involuntarily.

I guess it's time to check out Lineage OS and Postmarket OS. It was always a matter of time.

No one is going to train an AI on random user generated data. The data is going to be horrible and it’s going to be full of PII that’s too risky to expose.

People who understand cybersecurity who are not operating within a US-allied country use ... I don't know what to be honest. What to do in such a situation, where Apple is a US-based company obligated by law to comply with requests from three letter agencies and Android is a buggy mess which probably is backdoored by every major power?

Your threat model shouldn't be about three letter agencies unless you're running a terrorist group. It should be about porn spammers or something.

Do you mean that US is the measure of justice and goodness in the world and anyone who opposes her is a terrorist? I don't mean to detract the conversation but this is really victim blaming. There are valid situations where the US DoD is a threat.

Your username reminded me of Julian Assange, for a second I mixed them up.

No, I assume if you're working for a foreign military then you wouldn't be posting about it on here.

I assume if I was working for a foreign power I'd already know the answer to my original question... unless there's no good answer.

I can assure you that if you’re doing AI research, glowies likely spy on you, but it’s the “good” kind of spying where you might get a job offer some day instead of the kind where they Guantanamo bay you…

Unless of course you are not based in a US-allied country, as stated very explicitly in my comment.

Ah the neverending American centricism on this site.

Sorry to break it to you but you cannot hide from the US government if you use modern hardware or connect to the internet in any way.

How likely is it that seemingly well-intentioned companies/open source projects like Mullvad, Wireguard, Qubes OS, Monero etc. are infiltrated by the US government?

Or are you talking about the presence of Intel ME and the like in modern hardware?

I’m talking about the simple fact that Five Eyes have so many resources put together that you will never hide forever, unless you are willing to drastically change your life.

The good news is you are not important enough for them to care about you unless you are an Iranian general with nuclear access or some shit. Even these ransomware groups aren’t even on the radar of the people who are actually being targeted, I’m talking about stopping the yakuza trying to sell nukes to terrorists level of threat.

I appreciate you, and thanks for the "You're not that important" reminder for the average reader of this comment. However I must state I personally really am in need of an answer. Hypothetically, what if I am that important? What if I am not yet a target but think there's a decent chance that I will be targeted by nation-states, the most capable being US one day? You seem pretty knowledgeable. In the age of ML-assisted mass data scanning and ISP data collection & correlation, what would the lifestyle changes I must undergo to remain truly pseudonymous on the internet look like?

I feel that way, have an iPhone.

Yea, same.

I have literally no desire to hack and fuck around with my personal cell phone, doing so would take away time from the hacking I actually want to do.

One option you can't hack on, the other you can but don't have to at all. Why choose the former? Are you so sure you'll never want to do anything on your phone that's unapproved by your corporate overlords?

How does an iPhone contribute to censorship?