Hacker News Reader

How can we fix it? Easiest I can think of is wipe storage if updating without user authentication. Any better way?

Who is "we" here? Apple could do that, for sure. In the present contest, I can see why they'd want to. It would be a great move to forestall this sort of attack in future.

But "we", as in you and I, cannot easily do this. Because we can't sign stuff as Apple. But maybe it's doable.

I think this is where things are headed. I think we will soon see a new version of iOS by Apple with more stringent security (no updates without authentication or information is wiped when you force an update).

If this doesn't happen, I would highly suspect there is an NSL (or something similar) involved forbidding it.

Reply on news.ycombinator.com