Hacker News Reader

Comment by kelnos | Hacker News Reader

I have mixed feelings about this.

Lockdown Mode basically cripples the phone, feature-wise. It's not quite to the point where I'd (even hyperbolically) say "why don't you just get an old dumb phone instead", but still...

The right thing to do would be to redesign the system from the bottom up to actually be secure in the face of vulnerabilities in any of these features that get disabled because they can be dangerous for people. (And maybe Apple is working on this behind the scenes, which will take them years to complete.)

But, agreed: let's not let perfect be the enemy of the good. It's better to have this option than to not have it, even though it likely creates a super restricted user experience that probably isn't particularly pleasant to use.

View on HN

> Lockdown Mode basically cripples the phone, feature-wise. It's not quite to the point where I'd (even hyperbolically) say "why don't you just get an old dumb phone instead", but still...

The problem is that phones (of the "dumb"/"feature" variety) are running OSes that don't have nearly the security attention or hardware features related to them as iOS devices.

I carry a KaiOS feature phone as my personal phone (when I remember it). Apple pissed me off enough with the CSAM stuff that I wanted to experiment with alternatives, and I've done so. However, I don't pretend KaiOS is particular "hard" against attackers - it's almost certainly not. But neither does it have much of an attack surface. It doesn't even try to render emoji, they're just black rectangles. And neither does it try to, say, render weird old Xerox image formats.

I would trust an iOS device with "most of the complex attack surfaces turned off" far more than I'd trust a KaiOS or stripped Android device. You get all the hardware protections, regular OS updates, a bug bounty program focused on this mode, and the smaller attack surface window of Lockdown.

I'm incredibly excited by it, because it turns off all the stuff I don't want in a phone anyway.

Unfortunately, "crickets on CSAM" is a problem too. If they say they're not going to ship that ill conceived feature, I might move back to iOS. If not, well... I'll probably play with Lockdown mode for a week or two and then go back to the Flip.

If you opt out of/disable iCloud iPhoto Library then CSAM isn't active right? - It applies to iMessages only because iMessages integrates to iPhoto Library.

Again, the CSAM "scandal" was actually an improvement of what the other online photo services do (constantly scan your entire library of photos with no controls in place). Just the improvement involved on-device scanning that folks seem allergic to. But you can opt-out, so still better than KaiOS.

The claim is that if you opt out, it's disabled, yes. However, I object, fundamentally, to the entire concept of using my device to check my content for your legal requirements.

If I store content on your server, yes, absolutely, you can use your resources to check the stuff I've stored for what you define as badness.

But Apple's system is using my device to scan for their definition of badness. If they'd then said, "And this allows us to do iCloud E2EE," well, OK, this is a discussion to have. Except they didn't and haven't. It is, as designed, "I use my device to scan stuff for you, and then you can still scan it."

And as a direct result, the EU is now pushing for "badness scanning" in all sorts of E2EE channels, to include searching for "grooming" in text chats. "But Apple said they could do it! Why can't you do the same thing?" is a valid argument from a politician's point of view.

KaiOS doesn't have anything in the way of photo uploading in the first place.

But the scanning is only applied to photos being stored in the cloud. What difference does it make which piece of metal is doing the actual scanning if the practical result is the same?

This is overblown hyperbole, it disables a few features a lot of people have never even heard of.

Disabling the JIT compiler makes the browser a bit slower. It does not cripple it.

Disabling profiles, debugging and MDM? These are not useful unless you’re in ‘enterprise’ or a developer.

Can’t send documents or links through iMessage? Use another service or copy and paste the links you actually want to open.

Really a tiny price to pay for the added security.

Yea I am a developer but when you put it like that I would consider getting a phone for debugging and adding lockdown to my personal phone. I’m not Jeff Bezos nor do I intend to be but at least I would like to support this and see what the experience looks like.

Yup, there is little downside to supporting this concept as it should inevitably move others to adopt similar functionality. It isn’t the perfect solution or likely even the best idea in the room but the biggest player just made a big move in the consumer’s favor. It does coincide with a big privacy push that will keep their market share up so not really benevolence.

Same, I'm planning on running this on a spare iPhone, looking into whether I'd be OK running it on my daily carry phone.

I consider myself "recreationally paranoid", I enjoy locking my stuff down for fun, not because I ever think anyone's gonna burn an NSO zero day to get into my stuff.

I agree, this mode seems like something most people could manage without difficulty. Amusingly, my (non-Apple) system is much more locked down than this and isn't exactly unusuable IMO, although some things might be harder to manage on a phone.

Microsoft did some tests for Edgium's "Super Duper Secure Mode" and found that disabling JIT improves real world performance more often than it makes it worse (and usually makes no difference):

https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

Diabling JIT makes it possible to enable some additional exploit mitigation methods. A follow up article mentioned that few people who tried it noticed a difference:

https://microsoftedge.github.io/edgevr/posts/Introducing-Enh...

"It is worth mentioning that when we originally had this idea, we doubted our Microsoft Edge peers would even consider it. We quietly made changes to our browser without explicitly telling them the specifics and then asked them weeks later to see if they noticed the change. They would always say no, and only then would we inform them that we disabled the JIT. After surprising multiple developers in Microsoft Edge, we got the support needed to try this experiment. One can’t help but wonder what other well established assumptions about users and the web we should reconsider."

"Disabling profiles, debugging and MDM?"

I'm not really going to argue this but, just in case it is interesting for you and others to learn:

I use profiles/configurator on my kids' iphones ...

Note that this doesn’t disable MDM entirely: it disables adding new MDM profiles after its enabled (I’d hope there’s a “do you trust the existing one with your life?” prompt…) which seems like a reasonable compromise for preventing spear phishing to install new profiles.

> The right thing to do would be to redesign the system from the bottom up to actually be secure in the face of vulnerabilities

i understand the impulse to immediately question if this might solve security, but it just won’t. there are some classes of known vulnerabilities which it may mitigate, but at best it would be a temporary security solution.

security is hard.

we also need to remember that we would, with almost 100% certainty reintroduce long forgotten about mitigations that someone silently did years ago but they didn’t make a big deal over. or even mitigations which were made a big deal of, but they were a decade ago therefor long forgotten about.

we have a tendency to think those who built complex systems before us were unenlightened, or lazy, or primitive. this often really isn’t the case.

anyone who has worked on large projects will inevitably learn the hard way that scale adds incredible fractal depths of complexities that we can’t dream of until it slaps us in the face. so we put out that fire, do not-nearly-enough-documenting on why or what caused it so future people might avoid the same mistake, and then we continue running up the hill.

security is hard.

and of course sometimes a from-scratch-rebuild might make sense but we’d be looking at years and years of relearning mistakes which were previously learned and corrected for.

security is hard.

I'm not so sure. They _could_ start from scratch, building the same feature set but paying extra attention to security in every possible aspect of design, do you now have a system guaranteed to be free of malware? Never. We are talking nation state actors here. Doing that would ignore the really great (if merely suggested) admittance that apple is making here: reducing the attack surface is the only way to mitigate the unknown unknowns of software security.

Another reason "from scratch" is just crazy talk: If they start from scratch it means literally redoing all the libraries. The thought of apple redoing parsers for PDF, JPEG, BMP, PNG, XML, etc, doesn't really invoke confidence for me. They probably create more bugs than the working library has. Unless they do it in rust but even then some bugs inevitably remain.

Lol may as well use a dumb phone because to redesign it from ground up and have the same features would end back square one

Reply on news.ycombinator.com