Hacker News Reader

Comment by peterangular | Hacker News Reader

I see you're getting downvoted (gray comment) but I'll jump aboard the unpopular opinion here:

There is exactly zero chance I'd be leaving my device with these people. Trusting your phone to strangers when you can just silence it and leave it in your pocket is a fool's errand - this whole thing is just silly. It's unnecessary risk - everything from auth, to payments, to my career is piped through this device. Leaving it with absolute strangers is leaving someone with my most significant and risk-prone tool that I own.

Sorry to be pedantic but common folks - let's use some common sense here. This is so silly.

View on HN

Chiming in to say this is not an unreasonable standpoint.

It's not that you're likely to be victimized in this particular venue. It's that you should practice good habits if your device has, or ever will have, access or exposure to information you or your company would be damaged by if stolen.

Have you ever given your car keys to a valet?

You're implying that car-theft would be equally as bad or worse than phone-theft. I'm not sure that's true for everyone. Further, stealing a car may be more difficult than stealing a phone.

This. I'd rather my vehicle was stolen vs or damaged vs getting digitally compromised. The damage someone could cause with my phone vs. stealing my car is vastly different.

How insecure is your phone that someone can digitally compromise you without knowing the passcode? If you lock a modern iPhone, even the FBI will have trouble extracting any content from it.

Hey - we're not going to see eye to eye on this one. Respectfully, I'm not going to to respond further.

Cheers.

lol, ok. Keep an eye on your phone!

For years, phone forensics firms pretty much consistently had non-public exploits that would allow compromising even locked phones. As recently as 2019, Cellebrite publicly claimed that they can attack any iPhone with up to date software: https://www.wired.com/story/cellebrite-ufed-ios-12-iphone-ha...

And those are publicly known capabilities. You should assume that potential adversaries will have more than that. Am I certain that such exploits are known for the very most recent iPhone/iOS? No. But it would still be foolish to bet on them not being known.

Also low-tech exploits, like holding the screen at an angle to the light, to see finger smudges for the unlock pattern.

Further, stealing a car may be more difficult than stealing a phone

Stealing it may be more difficult, but it's much easier to lose a phone than a car. I've never lost my car, but I've lost 2 phones (I got one of them back).

Sure, but I think it's a bad faith argument to draw a comparison between such vastly different situations. Is my car my phone? No, no it is not.

Sure, but this is a false equivalency. A car and phone are completely different issues. Cars also have “valet modes to lock things down”.

So do modern phones. A locked iPhone is more secure than most cars, in terms of the ability for anyone to break into it.

There are more types of phones than just iPhones, and there have been enough high profile incidences of zero day exploits that allow you to exfiltrate data from a locked phone to give a reasonably security conscious person pause to just hand over their phone to a stranger.

Even if you think of the people you're giving the phone to are trust worthy there's just no good goddamn reason to risk it.

Yes, but not before removing my wallet and passport and briefcase that has all my logins to my business’s internet banking written down on a sheet of paper inside.

Why is locking your phone not sufficient to secure its contents?

Obviously it would be worse if the valet started using my wallet and passport and business banking to steal from me, but it would still suck if they merely threw it all out the window.

You lost me with this analogy. Is the thief wiping the contents of your phone? This sounds like you need to improve your backup and recovery system... what if you lose your phone, or drop it in the toilet?

To be concrete, the concern isn’t that the phone check people are going to steal important data from my phone, it’s that they are going to lose my phone. I have backup and recovery systems but they are not seamless and not complete, something would probably get lost.

This was a YC event that was for YC founders from the current batch only, not just random people who like YC.

My phone is safer in my custody - it doesn't matter who I am giving it to, including YC founders/staff. Giving my phone to other people, regardless of who those people are, is an extraneous risk when compared to having it in my pocket on silent.

I'm sorry - but this is just bad personal opsec regardless of what event you're attending, or who you're rubbing elbows with. Sorry, but my opinion on this is different than yours.

So it's full of high-profile targets? Cool.

Reply on news.ycombinator.com