Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #70520 > unrolled thread

Old crypto weakness in current OS X, iOS, (and Android ...)

Back to article view | Back to comp.sys.mac.system

Contents

  Old crypto weakness in current OS X, iOS, (and Android ...) Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-03-05 11:28 -0500
    Re: Old crypto weakness in current OS X, iOS, (and Android ...) Bert <bert@iphouse.com> - 2015-03-05 16:37 +0000
      Re: Old crypto weakness in current OS X, iOS, (and Android ...) Alan Baker <alangbaker@telus.net> - 2015-03-05 09:39 -0800
        Re: Old crypto weakness in current OS X, iOS, (and Android ...) Barry Margolin <barmar@alum.mit.edu> - 2015-03-05 13:07 -0500
          Re: Old crypto weakness in current OS X, iOS, (and Android ...) Alan Baker <alangbaker@telus.net> - 2015-03-05 10:52 -0800
        Re: Old crypto weakness in current OS X, iOS, (and Android ...) Michelle Steiner <michelle@michelle.org> - 2015-03-05 11:44 -0700
          Re: Old crypto weakness in current OS X, iOS, (and Android ...) tmo1138 <tmo1138@tmo1138.com> - 2015-03-06 02:05 +0000
        Re: Old crypto weakness in current OS X, iOS, (and Android ...) Bert <bert@iphouse.com> - 2015-03-06 21:41 +0000
          Re: Old crypto weakness in current OS X, iOS, (and Android ...) nospam <nospam@nospam.invalid> - 2015-03-06 16:57 -0500
            Re: Old crypto weakness in current OS X, iOS, (and Android ...) Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-03-06 17:18 -0500
              Re: Old crypto weakness in current OS X, iOS, (and Android ...) nospam <nospam@nospam.invalid> - 2015-03-06 17:21 -0500
                Re: Old crypto weakness in current OS X, iOS, (and Android ...) Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-03-06 17:29 -0500
                  Re: Old crypto weakness in current OS X, iOS, (and Android ...) nospam <nospam@nospam.invalid> - 2015-03-06 17:46 -0500
                Re: Old crypto weakness in current OS X, iOS, (and Android ...) Bert <bert@iphouse.com> - 2015-03-07 15:23 +0000
              Re: Old crypto weakness in current OS X, iOS, (and Android ...) dempson@actrix.gen.nz (David Empson) - 2015-03-07 12:08 +1300
                Re: Old crypto weakness in current OS X, iOS, (and Android ...) Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-03-06 18:11 -0500
              Re: Old crypto weakness in current OS X, iOS, (and Android ...) Alan Baker <alangbaker@telus.net> - 2015-03-06 17:51 -0800
            Re: Old crypto weakness in current OS X, iOS, (and Android ...) Kevin McMurtrie <mcmurtrie@pixelmemory.us> - 2015-03-06 20:14 -0800
          Re: Old crypto weakness in current OS X, iOS, (and Android ...) Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-06 23:14 +0000
            Re: Old crypto weakness in current OS X, iOS, (and Android ...) nospam <nospam@nospam.invalid> - 2015-03-06 18:20 -0500
          Re: Old crypto weakness in current OS X, iOS, (and Android ...) Michelle Steiner <michelle@michelle.org> - 2015-03-06 17:37 -0700
    Re: Old crypto weakness in current OS X, iOS, (and Android ...) Fred Moore <fmoore@gcfn.org> - 2015-03-05 12:22 -0500
    Re: Old crypto weakness in current OS X, iOS, (and Android ...) billy@MIX.COM - 2015-03-05 19:31 +0000

Page 1 of 2  [1] 2  Next page →

#70520 — Old crypto weakness in current OS X, iOS, (and Android ...)

QUOTE (From NYT)
A government policy that forbade the export of products with strong 
encryption in the 1990s has years later left users of devices like 
Android and Apple phones vulnerable to hackers when they visit one-third 
of all websites, including whitehouse.gov and nsa.gov.

Researchers last month discovered millions of devices and websites were 
using an outdated encryption key to secure their communications. The 
weak key resulted from a Clinton administration mandate that software 
and hardware makers use weak cryptography in products exported outside 
the United States.
END QUOTE

QUOTE
Apple said on Wednesday it would patch the vulnerability through 
software updates for its mobile operating system, iOS, and its Macintosh 
operating system, OS X, next week. Google said it had developed a patch 
to protect Android connections to websites and provided the patch to 
Android manufacturers. BlackBerry and Amazon, whose products are also 
affected by the flaw, did not immediately respond to requests for comment.
ENDQUOTE

http://www.nytimes.com/2015/03/05/business/outdated-encryption-leaves-phones-vulnerable-to-hackers.html?ref=technology&_r=0
or http://tinyurl.com/ppjnbye

-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [next] | [standalone]

#70521

In news:rOydnd9T_f3WGWXJnZ2dnUU7-bmdnZ2d@giganews.com Alan Browne
<alan.browne@FreelunchVideotron.ca> wrote: 

> Google said it had developed a patch to protect Android connections to
> websites and provided the patch to Android manufacturers.

Unless your phone is less than 6 months old, you'll probably never get
this fix. And even then, your chances are slim.

-- 
bert@iphouse.com	St. Paul, MN

[toc] | [prev] | [next] | [standalone]

#70528

On 2015-03-05 16:37:00 +0000, Bert said:

> In news:rOydnd9T_f3WGWXJnZ2dnUU7-bmdnZ2d@giganews.com Alan Browne
> <alan.browne@FreelunchVideotron.ca> wrote:
> 
>> Google said it had developed a patch to protect Android connections to
>> websites and provided the patch to Android manufacturers.
> 
> Unless your phone is less than 6 months old, you'll probably never get
> this fix. And even then, your chances are slim.

Correction:

"Unless your phone is less than 6 months old and NOT an iPhone, you'll..."

[toc] | [prev] | [next] | [standalone]

#70531

In article <mda4cd$v89$1@news.datemas.de>,
 Alan Baker <alangbaker@telus.net> wrote:

> On 2015-03-05 16:37:00 +0000, Bert said:
> 
> > In news:rOydnd9T_f3WGWXJnZ2dnUU7-bmdnZ2d@giganews.com Alan Browne
> > <alan.browne@FreelunchVideotron.ca> wrote:
> > 
> >> Google said it had developed a patch to protect Android connections to
> >> websites and provided the patch to Android manufacturers.
> > 
> > Unless your phone is less than 6 months old, you'll probably never get
> > this fix. And even then, your chances are slim.
> 
> Correction:
> 
> "Unless your phone is less than 6 months old and NOT an iPhone, you'll..."

Since he only quoted the part about Android, I thought that it was 
implied that he was only referring to Android phones, not iOS phones.

-- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

[toc] | [prev] | [next] | [standalone]

#70537

On 2015-03-05 18:07:33 +0000, Barry Margolin said:

> In article <mda4cd$v89$1@news.datemas.de>,
>  Alan Baker <alangbaker@telus.net> wrote:
> 
>> On 2015-03-05 16:37:00 +0000, Bert said:
>> 
>>> In news:rOydnd9T_f3WGWXJnZ2dnUU7-bmdnZ2d@giganews.com Alan Browne
>>> <alan.browne@FreelunchVideotron.ca> wrote:
>>> 
>>>> Google said it had developed a patch to protect Android connections to
>>>> websites and provided the patch to Android manufacturers.
>>> 
>>> Unless your phone is less than 6 months old, you'll probably never get
>>> this fix. And even then, your chances are slim.
>> 
>> Correction:
>> 
>> "Unless your phone is less than 6 months old and NOT an iPhone, you'll..."
> 
> Since he only quoted the part about Android, I thought that it was
> implied that he was only referring to Android phones, not iOS phones.

I THINK you're right... ...but I thought it was better made explicit.

:-)

[toc] | [prev] | [next] | [standalone]

#70534

In article <mda4cd$v89$1@news.datemas.de>, Alan Baker
<alangbaker@telus.net> wrote:

> On 2015-03-05 16:37:00 +0000, Bert said:
> 
> > In news:rOydnd9T_f3WGWXJnZ2dnUU7-bmdnZ2d@giganews.com Alan Browne
> > <alan.browne@FreelunchVideotron.ca> wrote:
> > 
> >> Google said it had developed a patch to protect Android connections to
> >> websites and provided the patch to Android manufacturers.
> > 
> > Unless your phone is less than 6 months old, you'll probably never get
> > this fix. And even then, your chances are slim.
> 
> Correction:
> 
> "Unless your phone is less than 6 months old and NOT an iPhone, you'll..."
> 
Well, if it is an iPhone, then it definitely won't get that Android
patch.

[toc] | [prev] | [next] | [standalone]

#70559

On 2015-03-05, Michelle Steiner <michelle@michelle.org> wrote:
> Well, if it is an iPhone, then it definitely won't get that Android
> patch.

Thanks goodness for that..! :)

-- 
HOW YOU CAN TELL THAT IT'S GOING TO BE A ROTTEN DAY:
	#1040 Your income tax refund cheque bounces.

[toc] | [prev] | [next] | [standalone]

#70578

In news:mda4cd$v89$1@news.datemas.de Alan Baker <alangbaker@telus.net>
wrote: 

> On 2015-03-05 16:37:00 +0000, Bert said:
> 
>> In news:rOydnd9T_f3WGWXJnZ2dnUU7-bmdnZ2d@giganews.com Alan Browne
>> <alan.browne@FreelunchVideotron.ca> wrote:
>> 
>>> Google said it had developed a patch to protect Android connections
>>> to websites and provided the patch to Android manufacturers.
>> 
>> Unless your phone is less than 6 months old, you'll probably never
>> get this fix. And even then, your chances are slim.
> 
> Correction:
> 
> "Unless your phone is less than 6 months old and NOT an iPhone,
> you'll..." 

Well, I was talking about Google and its pet Android, but just how long
DOES Apple keep providing updates to its phones? 

I have an old iPod Touch (3rd gen, I think) that hasn't seen an update
in quite a while, but it's not in the same league as a phone. 

-- 
bert@iphouse.com	St. Paul, MN

[toc] | [prev] | [next] | [standalone]

#70580

In article <XnsA455DCBF57888VeebleFetzer@127.0.0.1>, Bert
<bert@iphouse.com> wrote:

> >>> Google said it had developed a patch to protect Android connections
> >>> to websites and provided the patch to Android manufacturers.
> >> 
> >> Unless your phone is less than 6 months old, you'll probably never
> >> get this fix. And even then, your chances are slim.
> > 
> > Correction:
> > 
> > "Unless your phone is less than 6 months old and NOT an iPhone,
> > you'll..." 
> 
> Well, I was talking about Google and its pet Android, but just how long
> DOES Apple keep providing updates to its phones? 

typically 3 years. the iphone 4 shipped with ios 4 and can be updated
to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.

> I have an old iPod Touch (3rd gen, I think) that hasn't seen an update
> in quite a while, but it's not in the same league as a phone.

it's also 5 years old.

android updates can stop as soon as a year, sometimes even less.

[toc] | [prev] | [next] | [standalone]

#70581

On 2015.03.06 16:57 , nospam wrote:
> In article <XnsA455DCBF57888VeebleFetzer@127.0.0.1>, Bert
> <bert@iphouse.com> wrote:
>
>>>>> Google said it had developed a patch to protect Android connections
>>>>> to websites and provided the patch to Android manufacturers.
>>>>
>>>> Unless your phone is less than 6 months old, you'll probably never
>>>> get this fix. And even then, your chances are slim.
>>>
>>> Correction:
>>>
>>> "Unless your phone is less than 6 months old and NOT an iPhone,
>>> you'll..."
>>
>> Well, I was talking about Google and its pet Android, but just how long
>> DOES Apple keep providing updates to its phones?
>
> typically 3 years. the iphone 4 shipped with ios 4 and can be updated
> to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.

Are Apple likely to go further back for a security update?


-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#70582

In article <ivSdnfyteZgyumfJnZ2dnUU7-cednZ2d@giganews.com>, Alan Browne
<alan.browne@FreelunchVideotron.ca> wrote:

> >> Well, I was talking about Google and its pet Android, but just how long
> >> DOES Apple keep providing updates to its phones?
> >
> > typically 3 years. the iphone 4 shipped with ios 4 and can be updated
> > to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.
> 
> Are Apple likely to go further back for a security update?

unlikely, since they would need to release a whole new release.

people generally upgrade their phones every 2-3 years, so dropping
support at 3 years is not a big deal. there aren't enough people still
using those older phones to justify doing it.

[toc] | [prev] | [next] | [standalone]

#70583

On 2015.03.06 17:21 , nospam wrote:
> In article <ivSdnfyteZgyumfJnZ2dnUU7-cednZ2d@giganews.com>, Alan Browne
> <alan.browne@FreelunchVideotron.ca> wrote:
>
>>>> Well, I was talking about Google and its pet Android, but just how long
>>>> DOES Apple keep providing updates to its phones?
>>>
>>> typically 3 years. the iphone 4 shipped with ios 4 and can be updated
>>> to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.
>>
>> Are Apple likely to go further back for a security update?
>
> unlikely, since they would need to release a whole new release.
>
> people generally upgrade their phones every 2-3 years, so dropping
> support at 3 years is not a big deal. there aren't enough people still
> using those older phones to justify doing it.

I kept my iPhone 4 for over 4 years (tried for 5).

My target for the iPhone 6 is also 5 years.  As it has a larger display 
and runs wicked fast, I should get there.  Also bought it at the 
beginning of its cycle (unlike the 4 that I bought near the end).

-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#70584

In article <GrydnakUmuHbt2fJnZ2dnUU7-QWdnZ2d@giganews.com>, Alan Browne
<alan.browne@FreelunchVideotron.ca> wrote:

> >>>> Well, I was talking about Google and its pet Android, but just how long
> >>>> DOES Apple keep providing updates to its phones?
> >>>
> >>> typically 3 years. the iphone 4 shipped with ios 4 and can be updated
> >>> to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.
> >>
> >> Are Apple likely to go further back for a security update?
> >
> > unlikely, since they would need to release a whole new release.
> >
> > people generally upgrade their phones every 2-3 years, so dropping
> > support at 3 years is not a big deal. there aren't enough people still
> > using those older phones to justify doing it.
> 
> I kept my iPhone 4 for over 4 years (tried for 5).

apple isn't going to release an update just for you.

apple knows how many are still in use. 

> My target for the iPhone 6 is also 5 years.  As it has a larger display 
> and runs wicked fast, I should get there.  Also bought it at the 
> beginning of its cycle (unlike the 4 that I bought near the end).

good luck on that.

[toc] | [prev] | [next] | [standalone]

#70607

In news:060320151721453291%nospam@nospam.invalid nospam
<nospam@nospam.invalid> wrote: 

> people generally upgrade their phones every 2-3 years, so dropping
> support at 3 years is not a big deal. 

My wife still uses a Motorola V3. Of course, she uses it for voice calls
and nothing else. 

-- 
bert@iphouse.com	St. Paul, MN

[toc] | [prev] | [next] | [standalone]

#70587

Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:

> On 2015.03.06 16:57 , nospam wrote:
> > In article <XnsA455DCBF57888VeebleFetzer@127.0.0.1>, Bert
> > <bert@iphouse.com> wrote:
> >
> >>>>> Google said it had developed a patch to protect Android connections
> >>>>> to websites and provided the patch to Android manufacturers.
> >>>>
> >>>> Unless your phone is less than 6 months old, you'll probably never
> >>>> get this fix. And even then, your chances are slim.
> >>>
> >>> Correction:
> >>>
> >>> "Unless your phone is less than 6 months old and NOT an iPhone,
> >>> you'll..."
> >>
> >> Well, I was talking about Google and its pet Android, but just how long
> >> DOES Apple keep providing updates to its phones?
> >
> > typically 3 years. the iphone 4 shipped with ios 4 and can be updated
> > to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.
> 
> Are Apple likely to go further back for a security update?

They have done at least once before. iOS 6.1.6 was a security update
released in February 2014, a few months after iOS 7 was introduced. It
was only available for models which were unable to upgrade to iOS 7:
iPhone 3GS and 4th gen iPod Touch.

https://support.apple.com/en-us/HT202920

Timing is similar, so it is possible that Apple could release an iOS 7
update to fix this issue for the iPhone 4, but I doubt any older devices
would get an update. The question is whether they think the issue is
serious enough to justify the effort, relative to the current usage
level of the iPhone 4.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#70588

On 2015.03.06 18:08 , David Empson wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>
>> On 2015.03.06 16:57 , nospam wrote:
>>> In article <XnsA455DCBF57888VeebleFetzer@127.0.0.1>, Bert
>>> <bert@iphouse.com> wrote:
>>>
>>>>>>> Google said it had developed a patch to protect Android connections
>>>>>>> to websites and provided the patch to Android manufacturers.
>>>>>>
>>>>>> Unless your phone is less than 6 months old, you'll probably never
>>>>>> get this fix. And even then, your chances are slim.
>>>>>
>>>>> Correction:
>>>>>
>>>>> "Unless your phone is less than 6 months old and NOT an iPhone,
>>>>> you'll..."
>>>>
>>>> Well, I was talking about Google and its pet Android, but just how long
>>>> DOES Apple keep providing updates to its phones?
>>>
>>> typically 3 years. the iphone 4 shipped with ios 4 and can be updated
>>> to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.
>>
>> Are Apple likely to go further back for a security update?
>
> They have done at least once before. iOS 6.1.6 was a security update
> released in February 2014, a few months after iOS 7 was introduced. It
> was only available for models which were unable to upgrade to iOS 7:
> iPhone 3GS and 4th gen iPod Touch.
>
> https://support.apple.com/en-us/HT202920
>
> Timing is similar, so it is possible that Apple could release an iOS 7
> update to fix this issue for the iPhone 4, but I doubt any older devices
> would get an update. The question is whether they think the issue is
> serious enough to justify the effort, relative to the current usage
> level of the iPhone 4.

Thanks David.


-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#70594

On 2015-03-06 22:18:23 +0000, Alan Browne said:

> On 2015.03.06 16:57 , nospam wrote:
>> In article <XnsA455DCBF57888VeebleFetzer@127.0.0.1>, Bert
>> <bert@iphouse.com> wrote:
>> 
>>>>>> Google said it had developed a patch to protect Android connections
>>>>>> to websites and provided the patch to Android manufacturers.
>>>>> 
>>>>> Unless your phone is less than 6 months old, you'll probably never
>>>>> get this fix. And even then, your chances are slim.
>>>> 
>>>> Correction:
>>>> 
>>>> "Unless your phone is less than 6 months old and NOT an iPhone,
>>>> you'll..."
>>> 
>>> Well, I was talking about Google and its pet Android, but just how long
>>> DOES Apple keep providing updates to its phones?
>> 
>> typically 3 years. the iphone 4 shipped with ios 4 and can be updated
>> to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.
> 
> Are Apple likely to go further back for a security update?

As a data point, consider that the last update to iOS 6 was on Feb 21, 2014.

<https://support.apple.com/en-us/HT202920>

But that means that on that date, they were still producing security 
updates for a phone that was first released nearly 5 years before 
(alright 56 months, not 60).

<http://en.wikipedia.org/wiki/IPhone_3GS>

[toc] | [prev] | [next] | [standalone]

#70600

In article <060320151657114880%nospam@nospam.invalid>,
 nospam <nospam@nospam.invalid> wrote:

> In article <XnsA455DCBF57888VeebleFetzer@127.0.0.1>, Bert
> <bert@iphouse.com> wrote:
> 
> > >>> Google said it had developed a patch to protect Android connections
> > >>> to websites and provided the patch to Android manufacturers.
> > >> 
> > >> Unless your phone is less than 6 months old, you'll probably never
> > >> get this fix. And even then, your chances are slim.
> > > 
> > > Correction:
> > > 
> > > "Unless your phone is less than 6 months old and NOT an iPhone,
> > > you'll..." 
> > 
> > Well, I was talking about Google and its pet Android, but just how long
> > DOES Apple keep providing updates to its phones? 
> 
> typically 3 years. the iphone 4 shipped with ios 4 and can be updated
> to ios 7. the iphone 4s shipped with ios 5 and can be updated to ios 8.
> 
> > I have an old iPod Touch (3rd gen, I think) that hasn't seen an update
> > in quite a while, but it's not in the same league as a phone.
> 
> it's also 5 years old.
> 
> android updates can stop as soon as a year, sometimes even less.

"Android" isn't a source of software updates.

Telcos drop phone support as soon a newer model is announced, without 
ever allowing 3rd party updates.  Phone manufacturers support their 
phones for few years and usually allow the OS to be replaced.  Open 
source ROMs keep going on for as long as anyone is willing to patch and 
compile them.

-- 
I will not see posts from astraweb, theremailer, dizum, or google
because they host Usenet flooders.

[toc] | [prev] | [next] | [standalone]

#70590

Okay, so one time? In band camp? Bert <bert@iphouse.com> was all, like:
> In news:mda4cd$v89$1@news.datemas.de Alan Baker <alangbaker@telus.net>
> wrote: 

>> On 2015-03-05 16:37:00 +0000, Bert said:
>> 
>>> In news:rOydnd9T_f3WGWXJnZ2dnUU7-bmdnZ2d@giganews.com Alan Browne
>>> <alan.browne@FreelunchVideotron.ca> wrote:
>>> 
>>>> Google said it had developed a patch to protect Android connections
>>>> to websites and provided the patch to Android manufacturers.
>>> 
>>> Unless your phone is less than 6 months old, you'll probably never
>>> get this fix. And even then, your chances are slim.
>> 
>> Correction:
>> 
>> "Unless your phone is less than 6 months old and NOT an iPhone,
>> you'll..." 

> Well, I was talking about Google and its pet Android, but just how long
> DOES Apple keep providing updates to its phones? 

The 4S, 5, 5S, and 6/6+ are all supported under iOS 8, which represents 4 years.

> I have an old iPod Touch (3rd gen, I think) that hasn't seen an update
> in quite a while, but it's not in the same league as a phone. 

A 3rd gen iPod Touch is equiv to a iPhone 3? 3GS?

-- 
http://2blog.kreme.com
Gehm's Corollary to Clarke's law: Any technology distinguishable from
magic is insufficiently advanced.

[toc] | [prev] | [next] | [standalone]

#70592

In article <slrnmfkd82.160n.g.kreme@kreme.eternal-september.org>, Lewis
<g.kreme@gmail.com.dontsendmecopies> wrote:

> > I have an old iPod Touch (3rd gen, I think) that hasn't seen an update
> > in quite a while, but it's not in the same league as a phone. 
> 
> A 3rd gen iPod Touch is equiv to a iPhone 3? 3GS?

3gs

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.sys.mac.system

csiph-web