Groups > misc.phone.mobile.iphone > #90332

Re: Why would iOS be safer from spying than a well setup Android phone?

From	Aardvarks <aardvarks@a.b.c.com>
Newsgroups	misc.phone.mobile.iphone, comp.mobile.android
Subject	Re: Why would iOS be safer from spying than a well setup Android phone?
Date	2016-08-10 08:37 -0700
Organization	Aioe.org NNTP Server
Message-ID	<nofho1$867$1@gioia.aioe.org> (permalink)
References	(12 earlier) <e0mtstFf8g0U8@mid.individual.net> <nocvtf$l3p$1@gioia.aioe.org> <090820161421341198%nospam@nospam.invalid> <nofa4j$1re8$1@gioia.aioe.org> <nofajv$1s77$1@gioia.aioe.org>

Cross-posted to 2 groups.

Show all headers | View raw

On Wed, 10 Aug 2016 08:37:11 -0500, joe wrote:

> How do you know your browser is not returning an adid? 

You hit upon a *very important* concept, which is what I was saying when I
said iOS is a mobile garbage can on wheels filled with security holes
(almost none of which you can plug) while Android is a mobile recycling bin
on wheels filled with security holes (most of which you can plug).

To your point, the browser *is* returning a *ton* of spyware to the browser
developers (which, in my case, is usually Mozilla, Orbot, Orfox, etc.) and
in your case, it's Safari (most likely).

This spying by the browser occurs whether you're on the
far-less-customizable iOS, or on the far more customizable Android
operating system.

The difference is that if you use Mozilla Firefox (on either operating
system), the spying is well known how to easily eliminate:

For example, loading these hardened-firefox preferences will do the trick:
https://github.com/pyllyukko/user.js/
http://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/

The point is that this browser spying that you brought up occurs
independently of the operating system.

Only recently have I realized that *fear* drives most iOS users' decisions.
Apple Marketing plays iOS users like a fiddle.
Apple Marketing is like mommy telling you that closing the closet door
keeps the big blue hairy monster out.

And the iOS users believe that.

If you actually believe Safari is "safe", then google like I just did, and
you'll find that security holes open and close constantly, just like on all
the other browsers.

Here's just the first set of links from a simple Google search for Safari
security flaws (on all operating systems)...

Apple iOS 9 is out – with a *LOT* of security holes patched
https://nakedsecurity.sophos.com/2015/09/17/apple-ios-9-is-out-with-a-lot-of-security-holes-patched/

Apple fixes security vulnerabilities in Safari, OS X, iOS and Apple TV
http://www.livehacking.com/tag/safari/

Safari does not enforce any kind of access restrictions for XMLHTTPRequests
https://gist.github.com/rongarret/d8987c9cd57bd768e1de

Stop Using Safari And Update iOS To Avoid Apple's Critical 'Gotofail'
http://www.forbes.com/sites/andygreenberg/2014/02/22/stop-using-safari-and-update-ios-to-avoid-apples-critical-gotofail-security-bug/#1b0544de4fe1

PDFs that exploit iPhone, iPad zero-day available on the Web
http://www.computerworld.com/article/2510081/security0/pdfs-that-exploit-iphone--ipad-zero-day-available-on-the-web.html

Anatomy of a “goto fail” – Apple’s SSL bug explained
https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-goto-fail-apples-ssl-bug-explained-plus-an-unofficial-patch/
etc.

The point in listing those is that browser security is a cat-and-mouse game
for *all* browsers, all the time. If you think the latest patch patched all
the holes, then you're fooling yourself. New security issues arise all the
time on *all* browsers, including ones where mommy Apple has sweetly told
you the hairy blue monster can't get you if the closet door is closed.

Of course, if you are using Safari, then there *are* some user-available
privacy settings that you should be aware of, as shown below...

Increasing privacy in Safari for iOS
http://www.idownloadblog.com/2016/01/14/safari-privacy-iphone-ipad/

14 privacy and security settings every iOS user should use
http://www.computerworld.com/article/3047179/apple-ios/14-privacy-and-security-settings-every-ios-user-should-use.html

Thread

csiph-web