Hacker News Reader

Comment by coldtea | Hacker News Reader

>You trust open source apps on desktop all the time

The desktop has the luxury to afford not being as secure as your phone, which serves as a 2FA device, a digital wallet, something that can record your voice and location, and your main means of everyday communication.

Side-loading would just mean every person getting nagged or strong-armed to side-load alls kind of apps (from official stuff from major companies wanting to avoid Apple's pay-cut, to all kinds of shady BS), with average Joes and Janes getting their phone smashed with malware, spyware and such.

The app store review doesn't have to be perfect or catch all. It just needs to be better than no review, and it does fare majorly better than Android (e.g. studies showing the latter gets 90% of the mobile malware).

The app store process and notarization also means apps can be revoked.

View on HN

> The desktop has the luxury to afford not being as secure as your phone

I don't understand this argument at all. I have everything on my desktop (laptop). Tax forms, credit card statements, bank statements, financial info, photos of all kinds, emails, ssh keys, etc., going back many many years.

> It just needs to be better than no review

It's not clear that this is true. I think that the existence of app review makes unwary consumers overconfident about the crapp store, and then they get scammed. That's how these scam apps exist and make money. The App Store is honeypot, a scammer's paradise. It's a lot easier to get yourself highly ranked in App Store search than it is to find people to scam on the open internet. But Apple tells consumers that the App Store is safe, which is a lie.

> it does fare majorly better than Android

The lesser of two evils is still evil.

> The app store process and notarization also means apps can be revoked.

Notarization is sideloading.

>I don't understand this argument at all. I have everything on my desktop (laptop). Tax forms, credit card statements, bank statements, financial info, photos of all kinds, emails, ssh keys, etc., going back many many years.

Too bad. You shouldn't. Or maybe you should, but most people shouldn't.

Their desktop are horrible security wise, they have no expertise to secure them, and they don't even have backups for losing data.

Those people (and many more, who don't even need or have a laptop/PC) still have a mobile phone.

>The lesser of two evils is still evil.

That would only matter if life wasn't all about tradeoffs towards the lesser evil all the time, and if "perfect" was practical.

> Too bad. You shouldn't. Or maybe you should, but most people shouldn't.

Where are you supposed to keep them? iOS devices don't even give you direct access to the file system, and they tend to have a lot less storage space than desktops.

Not to mention, it's a lot easier to do actual work on your desktop, with a large screen, keyboard, and mouse/trackpad. What do you think people use Macs for, gaming? ;-)

> they don't even have backups for losing data.

This is a very weird statement. Desktops have more backup options than a locked down iPhone. Indeed, I backup my iPhone to my Mac. Try backing up your Mac to an iPhone. ;-)

And both Mac and iPhone have iCloud, if you want to use that.

> Those people (and many more, who don't even need or have a laptop/PC) still have a mobile phone.

So?

The people who want locked down phones aren't even rational at this point. They aren't more secure. They just want to "feel" like they are more secure even when they aren't. They just wanna be coddled into a false sense of security. It's just constant pointless circular arguments. No amount of reassurance or claims of proof will help them out of the Stockholm syndrome.

For example I've never encountered someone personally or professionally that has ever had their android phone hacked. But if you talk to an iPhone fan you'd think that you'd get hacked within 5 minutes. It would be funny if it wasn't actually just sad.

>Where are you supposed to keep them? iOS devices don't even give you direct access to the file system, and they tend to have a lot less storage space than desktops. Not to mention, it's a lot easier to do actual work on your desktop, with a large screen, keyboard, and mouse/trackpad. What do you think people use Macs for, gaming? ;-)

Not having an ideal place to keep them is true, and that the desktop is more convenient for many classes of work is also true.

But they don't change the point I'm making. The point is that keeping sensitive data on the average person's computer, on the state that those are (loaded with all kinds of crap programs, clicking on whatever shady links, frequently duped for the most BS malware and spyware, and so on), is a bad idea.

Most average Joes, would be safer to keep, say their CC info, on a locked down phone than on their laptop.

>This is a very weird statement. Desktops have more backup options than a locked down iPhone.

Not so weird considering that for phones an internet backup comes as a one-click built-in operation on by default for many things, whereas for computers those options all require user activity, third party peripherals or accounts, and so on. Most people don't have a backup of their desktop/laptop. So this is again not what about is the ultimate possibilities, but what is the norm.

> The point is that keeping sensitive data on the average person's computer, on the state that those are (loaded with all kinds of crap programs, clicking on whatever shady links, frequently duped for the most BS malware and spyware, and so on), is a bad idea.

This is fearmongering exaggeration.

In any case, no, the point you made, which I responded to, was "The desktop has the luxury to afford not being as secure as your phone". But it doesn't have such a supposedly luxury, because a lot of people in fact do what you claim (absurdly) they shouldn't: store sensitive information on their desktop.

> Not so weird considering that for phones an internet backup comes as a one-click built-in operation on by default for many things, whereas for computers those options all require user activity, third party peripherals or accounts, and so on.

For better or worse, Apple pushes iCloud by default on Mac just as much as on iPhone, so there's no difference.

>This is fearmongering exaggeration.

And this is where we disagree. Ask anyone working on desktop computer support, and you'll be surprised.

>In any case, no, the point you made, which I responded to, was "The desktop has the luxury to afford not being as secure as your phone".

That's an additional point I've made. You know, comments can have more than one. And I also stand by that comment: the phone is more tied to one's identity, often used as proof of identity for many services, and has access to more sensitive data and function than the desktop (from personal pictures, to a person's every voice conversation - which a compromised phone can eavesdrop-, and their every movement, plus, nowadays the best part of their social media use and chats).

Heck, the phone, via PIN and the like, is also used to verify a user on the desktop, for increasingly more services.

Your comment makes me incredibly angry. You bring up the point that people put important information on their phones, ‘lapcat points out that people use their computers for the exact same things, and you have the audacity to tell him that people shouldn’t be doing this? There’s a lot that can be done to help improve the security story on both phones and desktop computers but if your position stems from “people should not be using computers to do computer things” you are divorced from reality and should seriously reconsider any views you’ve built on top of that premise.

Or maybe you should consider alternative viewpoints and the point they're making. Also try not getting what the other person says wrong, complete with misquoting.

I never said “people should not be using computers to do computer things”.

I said that people shouldn't be storing sensitive data on their computers. And there's even more nuance to it, that you've also missed: first, that we're talking about the average person, and the state of their average laptop, vs their phone.

So not as in that people shouldn't do that all things being ideal, but as in that it is a bad security situation for most people, and for most average people worse than their locked-down phones.

If you think the average laptop (mac or not) is more secure than the average iOS device, you're mistaken.

> I never said “people should not be using computers to do computer things”.

> I said that people shouldn't be storing sensitive data on their computers.

https://knowyourmeme.com/memes/theyre-the-same-picture

I'd still like to see you explain what you meant by "The app store process and notarization also means apps can be revoked", because it sounds like you don't even have a correct technical understanding of the situation.

>https://knowyourmeme.com/memes/theyre-the-same-picture

A great reminder that memes don't make for good arguments.

It's also funny how you missed the whole context, even despite further detailed explanation.

>I'd still like to see you explain what you meant by "The app store process and notarization also means apps can be revoked", because it sounds like you don't even have a correct technical understanding of the situation.

It means that arbitrary sideloading can't be revoked, whereas app store apps and notarized apps (not the same set, though the latter is a subset of the former) can.

Sideloaded apps bypass the app store, but you still need a central entity that has the notarization control/ability to revoke. And of course notarized software is still checked by that entity (e.g. Apple for notarized macOS apps).

> Sideloaded apps bypass the app store, but you still need a central entity that has the notarization control/ability to revoke. And of course notarized software is still checked by that entity (e.g. Apple for notarized macOS apps).

And this is precisely what people are calling for on iOS, to make it more like the Mac. It's assumed that Apple would require Developer ID and notarization for sideloaded iOS apps. Thus, sideloaded apps could be revoked just as easily as App Store apps.

I really don't get the argument that desktops don't need to be secure. I have my password manager (yes it is encrypted, but can be bypassed by a keylogger) and my ssh private keys on my desktop.

They should, but that train has left the station. At least phones have more accepted security than the "anything goes" that are desktops.

Reply on news.ycombinator.com