UH-OH! iOS Has Serious Security Flaws

You are mistaken. It's only an opt-out for four stat providers. It has no protection for what apps can do.

 

What other device do you have that's openly leaking your name, phone number, address, current location, your address book, and your keylog?

Not your PC, not your feature phone, not your xbox, etc. This is a uniquely serious situation. People are carrying with them at all times a tracking device thats globally connected. And a keylogger. We need to be aware and concerned about the security of such a device. Only then can Apple be influenced to close some of the holes. I just want the iPhone to be the best it can be, and that requires bringing to light the dirty bits so they can be cleaned up.

If you have no problem with anyone knowing your every move, then you should at least care about the privacy of the other people in your address book. They haven't consented to you giving out their personal info.

My reason for bringing this topic to this particular forum is because as early adopters we are the prime target for any such attack. This is not about a virus or Trojan or worm or rootkit: this is stuff in the public APIs.

I do my banking on my iPhone... but now I know anyone case easily see my password. So what do I do now? Go back to using my desktop? I do 90% of my computing on the iPhone these days.

How can you expect any large companies to start switching to iPhones for their employees when there are no safeguards against stealing corporate information? That alone should be a major worry for Apple since they need the business market to defeat Rim, etc.

Why is it that I can do this?

Code:

NSDictionary *defaults = [NSUserDefaults standardUserDefaults];
NSString *phone = [defaults valueForKey:@"SBFormattedPhoneNumber"];

What reason is there for Apple to give me the power to get that info so easily? How many Apps need your phone number? Skype? Why not AT LEAST show a confirmation prompt like with location?

Or why can I do this?

Code:

NSMutableSet *set = [NSMutableSet set];
NSString *dir = @"/var/mobile/Library/Keyboard/";
NSArray *dirContents = [[NSFileManager defaultManager] contentsOfDirectoryAtPath:dir error:&error];

for(NSString *filePath in dirContents) {
  if (![filePath hasSuffix:@".dat"]) continue;
  NSArray *a = [self wordsInDictionaryCacheFileAtPath:[dir stringByAppendingPathComponent:filePath]];
  if (!a) continue;
  [set addObjectsFromArray:a];
}

NSArray *words = [[set allObjects] sortedArrayUsingSelector:@selector(caseInsensitiveCompare:)];
// words now holds a sorted list of your keyboard cache contents!

Shouldn't the System forbid Apps from reading the keyboard cache? What business is it of theirs? Shouldn't there at least be some kind of warning, like "XXX wants to access your Keyboard History, allow it?

I fail to see how this is "a joke" or whatever lame comment some people drop by to delight us with.

 

I guess my original reply was deleted by a mod.

Your PC's data is protected from the outside world by a number of factors not present on the iPhone, such as hardware firewalls and traffic management software (eg. LittleSnitch). Unless you catch a virus or similar, or get rooted, you are relatively safe.

You also know when typing in your web browser that the SSL encryption is protecting your passwords. You can check your tasklist to see if there is a keylogger running. You are protected by default. With iOS, there is no protection (of certain things), so you are not protected by default (or ever).

As you can see, there is a significant distinction.

Furthermore, Apple provides developers with the tools and instructions to retrieve your private information in publicy available APIs. Anyone can make and submit a malicious app, hiding inside a game, and reach millions of targets. For $99 USD.

On PCs it takes a hacker or someone with specialized knowledge to create software that circumvents protection. So not only is your data pretty well protected, it also takes a rather skilled individual to get at it, so the odds are very low.