[Uptrenda]

It's a nice idea, but I wouldn't design any system on the assumption that a TPM needs to stay secure for the system to be safe. There's been so many exploits. We can consider the iphone as an R & D platform for doing blackbox computations. In that nothing is allowed to run that Apple doesn't want. Protecting that is apples bread and butter and they care about it enough to value critical exploits in the millions. Yet people still find them all the time. I feel like if a company that invests millions in the concept can't make it secure then the concept probably isn't that great.

[Gigachad]

The iPhone is actually working really well. There has never been a widespread malware attack on the iphone. Only highly targeted attacks on individuals. And Apple even has an answer for this as well with Lockdown mode which renders all of those previous exploits impossible.

There's also Memory Integrity Enforcement on the iPhone 17 chips which makes all memory exploits detectable by the OS so it can trigger a reboot and report the bug to Apple.

And even when exploits are found, the boot chain attestation means rebooting your iphone always clears out any malware that made it past normal sandboxing. Particularly at risk individuals should enable lockdown mode and periodically reboot.

[Uptrenda]

there are private exploits built into devices like Cellebrite that the police have access to. The system isn't as infallible as you think. Would not be surprised if the NSA and various hacking groups have stockpiles, too.

[Gigachad]

The iPhone has two main security systems to counter this, one being lockdown mode which disables USB data while the device is locked, and the other is the iPhone will reboot itself if it hasn't been unlocked for long enough. This puts the device in Before First Unlock state where the encryption keys are wiped from memory. This means no software bug can unlock the device because the encryption keys are derived from the users password.

The main attack left is brute forcing the lock screen password and bypassing the cooldown timer. This seems to be the method most used for getting access to phones. This is defeated by having an actual text password rather than the 6 digit password.

So yes they have advanced hacking tech, but the iphone security is remarkably effective and as a user there are a couple of simple measures that make it pretty much unbreakable.

If you believe you are at risk of having your phone taken and plugged in to a Cellebrite like device, enable Lockdown Mode, set a good password and if possible hit the power button 5 times to disable face id.

[realusername]

> There has never been a widespread malware attack on the iphone

I had a calendar malware that I had to remove from my sister's iphone just last year.

There's been also (and still exists) fake apps pushed with appstore ads, not sure if you count this or not.

[bdangubic]

your sister’s calendar does not really qualify as “widespread malware attack” :)

and neither do thousands of “fake apps” that no one installs

[realusername]

I don't think that you can find a definition of malware that those won't fit in.

The calendar malware pushes garbage ad notification in loops on the iphone and is triggered without user intent.

And then it's not just "fake apps" but apps designed to steal your credentials appearing at the top of the appstore.

[Gigachad]

By malware I meant something that broke the sandbox and gained deep access to the system. Ad ware and slop is a problem and I guess could count under the malware umbrella but it’s much less worrying than an exploit being able to read data from other apps.

[AnthonyMouse]

Now explain how any of that requires remote attestation.

[Gigachad]

The parent comment isn’t about remote attestation. It was a claim that since the iPhone isn’t bulletproof then all security must be pointless.

When the reality is the iPhone is actually quite a good example that great security is possible with enough investment.

[AnthonyMouse]

> It was a claim that since the iPhone isn’t bulletproof then all security must be pointless.

Nobody was ever claiming that. The claim is that because it isn't bulletproof, remote attestation is pointless, since it has a different failure mode where once keys can be extracted the attacker can't be deprived of them, so there is no way to return the installed base of existing devices to a state of being able to trust their attestations.

[strstr]

(I’ll bite and try to steelman) How does a typical user verify that they are running the intended secure software?

[AnthonyMouse]

The best way to do it would make all persistent storage in the device modular so that the storage device can be attached to a device that isn't booting from it which can thereby verify its contents.

Notice also that remote attestation doesn't enable that. The device can never do that itself since if it was compromised it would just display "attestation passed" on the screen without actually doing it.

[klausa]

By that metric we should just pack it all up and call it a day on computing in general; because even despite literal trillions of dollars being spent on it, we still haven't found a way to make it secure.

[Uptrenda]

You can make software secure though since it can be patched. How do you patch hardware if it has design flaws? The whole claim behind these hardware cages is they can't be accessed from outside the cage, period. So IMO, seeing multiple failings of this sort kind of makes me not want to trust it.

[gmueckl]

Not all computing that is useful must also be absolutely secure. Maybe we just have overextended the use of computers into areas where using them generates too much risk? If so, where is the boundary?