Hacker News Reader

Comment by kgermino | Hacker News Reader

This seems like a positive change, or at least a non-issue. It’s not a big deal to ask developers to check a “I know what I’m doing” box.

However, I’m not sure how big of an attack vector they’re closing here. I’m thinking of two channels:

1. Drive by installs when someone uses a public charger or another person’s computer to charge while using their phone

2. Users being guided to install malicious apps themselves under the guise of fake support or similar setups.

These just don’t seem like major problems to me. (1) could probably work if you were targeting an individual, but it doesn’t seem like this is the weak link. For (2) I can’t imagine anyone who goes to the trouble of installing xcode and deploying to their device wouldn’t be willing to just check that box too.

View on HN

2) is basically going to be attempted on nearly every single kid with an iOS device (see "free fortnite skins / robux just follow these instructions and paste these in, also turn off firewall and av")

(1) is already a non-issue because the device would ask you whether you "trust this computer" and then your passcode to proceed. Xcode won't even see it before you go through this prompt.

FWIW Android does a similar thing with USB debugging enabled, just without the extra step with the passcode.

A massive percentage of users will mindlessly say Trust and enter their passcode. Virtually no one will accidentally go into settings and enable Developer Mode

They will do so when plugging into a charger?

(I don't oppose there being developer mode, I'm just adding that there are extra steps)

I have had iOS tell me I needed to "unlock the phone to enable accessories" (or something to that effect) when plugging in the charger that came in the box with the phone.

This has usually been when the lightning port has been fouled by pocket lint or the cord has started going bad, but I bet it happens often enough to desensitize users (especially for people using off-brand cords) that it has been identified as a possible attack vector, and developer mode is the solution.

No, the alert you see is different from the "unlock the phone to enable accessories" notification. That goes away (and your phone starts charging) as soon as you unlock your phone. The "trust this computer" is an alert that only shows up after you unlock your phone, and it looks like this: https://media.idownloadblog.com/wp-content/uploads/2018/02/i...

I’m not saying anyone would do that intentionally. But I think it’s well established that most people’s reaction to modals is to close them and get back to what they are doing rather than read and consider them.

After that, iOS users are sometimes prompted to enter their passcode on an unlocked device for things like updates. A user who doesn’t understand their phone (very common) or is distracted and has something they’re trying to do (basically everyone) could easily say “whatever, yes, trust this charger” then “ugh again!? Here’s my passcode” without even thinking about it.

Of the 9 family members I’m thinking of who use iPhones: 3 know enough not to do that, 4 know that “Don’t Trust” is probably the right answer but could be caught if they weren’t thinking about it, 2 would have no idea and it’s 50/50 which button they hit.

The passcode would never stop either of the last 2.

> But I think it’s well established that most people’s reaction to modals is to close them and get back to what they are doing rather than read and consider them.

And this is why I consider modals "out of nowhere" to be the worst UX sin out there. And iOS is chock-full of these things. Low battery? In-your-face alert. System update? In-your-face alert, and then sneaky "enter passcode to install overnight" crap. Something about your Apple ID that you couldn't care less about? In-your-face alert. Plugged something in? In-your-face alert. No SIM card? In-your-face alert. An app failed to download? In-your-face alert.

It would've been much better if it was a notification. You'd only look for it if you know it should be there, for example when your computer doesn't see your phone.

Along with #1, could it also make it more difficult for attacks on devices where the attacker has physical access?

I don’t think so… I’m not sure, but it doesn’t look like this adds anything beyond knowing the passcode (already required in my understanding) if you have time alone with the device.

#2 is probably the single biggest attack vector on these platforms

Reply on news.ycombinator.com