Hacker News Reader

Comment by chatmasta | Hacker News Reader

Have you ever given your car keys to a valet?

Yes, but not before removing my wallet and passport and briefcase that has all my logins to my business’s internet banking written down on a sheet of paper inside.

Why is locking your phone not sufficient to secure its contents?

Obviously it would be worse if the valet started using my wallet and passport and business banking to steal from me, but it would still suck if they merely threw it all out the window.

You lost me with this analogy. Is the thief wiping the contents of your phone? This sounds like you need to improve your backup and recovery system... what if you lose your phone, or drop it in the toilet?

To be concrete, the concern isn’t that the phone check people are going to steal important data from my phone, it’s that they are going to lose my phone. I have backup and recovery systems but they are not seamless and not complete, something would probably get lost.

You're implying that car-theft would be equally as bad or worse than phone-theft. I'm not sure that's true for everyone. Further, stealing a car may be more difficult than stealing a phone.

This. I'd rather my vehicle was stolen vs or damaged vs getting digitally compromised. The damage someone could cause with my phone vs. stealing my car is vastly different.

How insecure is your phone that someone can digitally compromise you without knowing the passcode? If you lock a modern iPhone, even the FBI will have trouble extracting any content from it.

Hey - we're not going to see eye to eye on this one. Respectfully, I'm not going to to respond further.

Cheers.

lol, ok. Keep an eye on your phone!

For years, phone forensics firms pretty much consistently had non-public exploits that would allow compromising even locked phones. As recently as 2019, Cellebrite publicly claimed that they can attack any iPhone with up to date software: https://www.wired.com/story/cellebrite-ufed-ios-12-iphone-ha...

And those are publicly known capabilities. You should assume that potential adversaries will have more than that. Am I certain that such exploits are known for the very most recent iPhone/iOS? No. But it would still be foolish to bet on them not being known.

Also low-tech exploits, like holding the screen at an angle to the light, to see finger smudges for the unlock pattern.

Further, stealing a car may be more difficult than stealing a phone

Stealing it may be more difficult, but it's much easier to lose a phone than a car. I've never lost my car, but I've lost 2 phones (I got one of them back).

Sure, but I think it's a bad faith argument to draw a comparison between such vastly different situations. Is my car my phone? No, no it is not.

Sure, but this is a false equivalency. A car and phone are completely different issues. Cars also have “valet modes to lock things down”.

So do modern phones. A locked iPhone is more secure than most cars, in terms of the ability for anyone to break into it.

There are more types of phones than just iPhones, and there have been enough high profile incidences of zero day exploits that allow you to exfiltrate data from a locked phone to give a reasonably security conscious person pause to just hand over their phone to a stranger.

Even if you think of the people you're giving the phone to are trust worthy there's just no good goddamn reason to risk it.

Reply on news.ycombinator.com