Originally Posted by
bbsstmez I am looking for fact based opinions. A friend told me iphone and I was supprised
Well my opinions are based on facts. We may however differ on the weighting given to the facts. This is what I consider when assessing the security of a system:
- The robustness of the operating system. I judge this by the number of detected faults that may lead to vulnerabilities, the number of actual vulnerabilities either responsibly disclosed or found in the wild and the speed that the OS curator is able to make patches available.
- Security of the code execution process. Does the system provide a secure trusted boot procedure, how far does the chain of trust and verification go (boot loader, OS components, Application layer)?
- Security of the echo system. How easy is it to introduce malware or fake applications into the application supply system? Is the echo system scanned by an independant software security provider?
- User input and application output trust level. What level of protection on user input is enforced? Can an application be sure that input provided is from the user? Can the user be sure that input is going only to the intended application? Can the user be sure that the output is from the application it is supposed to be from?
- Is the encryption and certificate checking implemented properly on the device.
How national intelligence and law enforcement agencies may be able to require or coerce providers into providing access to our data aside (there is very little an individual can do about this in the short term, and the situation may be not as bad as, as bad as or far worse than the Snowden leaks imply), it is still important to keep financial and personal data out of the hands of criminals, fraudsters and identity thieves.
