Well, this remember me the old days, when peoples compares Linux OS, Apple OS and Microsoft OS, with Windows all flavour, full of security holes to let Virus, Trojan Horse, Root-Kit, Backdoor and any malicious script to be install and run.
But Apple security became so popular these days, as I can read on popular Blog over the net and with reason. As the mobilEEnigma creator, my very first concern has been exactly this. How to encrypt my data in my phone? At my great surprise nothing has been develop by Apple directly in the OS to encrypt it any sensitive data!
Apple state that it’s encrypt inside the device and it’s decrypt for me automatically!
Wow…so if I can read it, anyone can read it!
Of course all of us use the auto-lock system required a PIN to unlock our device right?
Eh, probably not, why?
Because any time I want to use my Device with people around me I need to hide my gesture by turning my back to them, or hiding my device under the table! it’s not a good thing to do if you are at diner with a date!
Anyway let focus on our subject for now…
If you use mobilEEnigma you probably already read my older post and why I came to develop rapidly my own ciphering tools. But now, the thing become serious, real business man would like to use a cool Smartphone like the new iPhone.
Of course RIM with Blackberry is not that bad, they are developing some cool features too, but to be honest it’s a bit out of competition, too many people are already addict to iTunes with iTunes Store, then the iPhone become a wanted device for a doing all device.
But what about security. Carrying a device that can synch with your downloaded music from iTunes and all others stuff like Contacts, it’s a real gift, but at what price?
iPhone device got very poor security compares to Blackberry. The first comparison is the wipe method (see wired post), this can be a real issue if your iPhone as been steal from you. I insist on stealing, not a lost or misplaced devices. If someone had steal your iPhone to look at it, good chance by the time you realize that it be just too late to send the wipe command.
Because the wipe operation had to be done by you with a PC, by first login to MobileMe then issue the command. It’s a kind of race that you don’t want loose. If your devices is off network, the command will never reach your lovely device!
Compare to Blackberry, the wipe operation may be execute with the Wipe when the off network status occur, after all, it’s a Smart Phone!
No OTA (Over-the-Air-Install), at first I thought it was a missed thing, but finally I realize quickly the security issue behind OTA. But if anyone can jailbreak his iPhone for 25$, that will be the cheapest way to remove your first human security. By doing this that’s mean you want to install a new downloaded application to your device with out using the Application Store. That’s a really bad idea!
You should never do that, that exactly what happen whit your old PC, remember? Virus, Trojan, Backdoor!
Anyway, it’s seem the perfect world is not out there yet, but if you Jailbreak your iPhone, restore it, and upgrade your OS right now, and stop using free iPhone application from unknown source. Application store offer you more security, because every application are tested and reviewed by Apple personals.That doesn’t mean it can be at 100% free of malicious code, but the developer that publish his application has to be under contract with Apple, then expose his real identity. Just for that it twill stop anyone that want to develop those malicious application.
If you are a developer like me, it’s another story, you have probably one for your normal usage an some other device for testing and development!
If you’re a Blackberry user, limit yourself to doing OTA on your device specially if you don’t know the application issuer. The wipe operation on Blackberry is much more safer then iPhone or Android devices. So if you scared to death that your device can be steal, think about buying a Blackberry. So your phone will be wipe if it goes off network for some times.
About Android OS, some tools exist for remote wipe operation but they are expensive, over 20$, I never test it so far… maybe in a future post! The OTA for Android device exist and work well, less security device for sure. Android market is just too easy to get in.
To give you and idea, developer can add almost anything on android market, they just not reviewed all applications for security and bugs as Apple do! Posting an application to Android market can take less then two hours to be available and be install in device. The Apple Application Store, takes me more then a week for me!
In conclusion, these are all great devices, remember the old days, just not install and run every application as you do with your old time PCs. Reduce your risk by limiting OTA install, and beware to install any application when using a unlock iPhone .
But the principle still the same, whatever the Smartphone you use, always encrypt your sensitive data.
Do I need to write, do a Backup too!
But, all sensitive information, are already cipher right?