News for hackers. Stuff that matters.
[deleted]
Re:iPhone Privacy by mechanical_fish on Saturday December 05, 2009 @09:58AM (#978108)
It's important not to ignore the context of this "discovery": to become a trojan on non-jailbroken iPhones, an app must get into and remain in the Apple Store.

Has nobody else figured out the other reason why Apple bothers to have an official store with officially-registered developers? Apart from the "big piles of retail cash" angle?

It's because of this. Apple doesn't need to treat every application running on the phone like Hannibal Lecter, locking it inside some kind of padded sandbox with steel walls and redundant alarm systems and then (in a small but significant number of cases) watching it escape anyway. Instead Apple relies on a simple dynamic:

If you write an application that steals user data for nefarious purposes,

...and anyone at all reports it to Apple, today or in the future... [1]

... your app disappears from the App Store; a window pops up on every user's phone telling them to uninstall the app because it is a dangerous security breach, and (incidentally) that the developers are bad people who cannot be trusted; the developers are blacklisted forever and ever; and an enormous lawsuit gets filed against the developers -- who, because they had to register with Apple just to get an app accepted, have a business address to which that lawsuit can be delivered.

That's not considering the possible criminal proceedings. The cops will also not have a problem finding an iPhone developer, because distributors of non-jailbroken apps cannot be anonymous.

I'm guessing this is going to be a pretty effective deterrant. It seems to have worked well so far.

Of course, the usual problem will apply: To what extent will users voluntarily relinquish their personal information without realizing what can be deduced from it? In a world where Facebook asks you for your email password so it can riffle through your Inbox, this is a serious concern.

---

[1] Obviously it's best if the review catches security holes and TOS violations before the app is launched, but that won't happen in general. And it doesn't need to.