Hacker News

Good call-out, and it's also nice to see that Apple tried to speak accurately here.

Oh geez. Legal did not give them the go ahead to make the unqualified statement: “We are not aware of any successful spyware attacks” they had to explicitly qualify it with “mercenary”.

Isn't that assumed? Obviously Apple can't check every iPhone owner to see if they have been hacked now or in the past

Yeah, another country to add to the "never visit until a sane government appears" list... -.-

One would hope there would be some sanitization of attachments to prevent this.

I also wish there was a regular option in iOS Messages to disable link previews.

I know you're not being serious, but for anyone who may not realize that, it does more than disabling attachments. Lockdown Mode's "optional, extreme" protection substantially changes the experience of using your device. https://support.apple.com/en-us/105120

Lockdown mode could be life or death for some users. Adding toggles and partial states increases complexity and risk.

You’re supposed to enable it if you’re important enough to potentially be the target of an attack. Political dissidents, journalists, government officials, HNWIs with a bunch of cryptocurrency and so on should probably have it on always.

You’re welcome to turn it on even if you’re not in one of these groups, just accept that it increases the friction of using your phone in a bunch of little ways.

I’ve been using it for more than a year.

Parts of it are pretty inconvenient, like with iMessage and FaceTime not working normally, but aside from that it’s not noticeable for my use case.

Despite the inconveniences, unless animated emmojis are important to you I don’t know why you wouldn’t enable it given how strong its protections are.

Every day users? Probably not many. It forcibly disables lots of nice-to-have features.

But users who need a highly secure phone? It’s entirely possible to use the phone without media embeds in iMessage, or shared photo albums, or websites loading in 900 fonts. It’s a trade off likely worth making in some situations.

I’ve used it on my personal iPhone since the feature was released. The impact to my life has been minor. I can’t share some thing with my wife in the health app and my son can’t SharePlay with me in the car while I use CarPlay.

I turned it on, out of curiosity, and the impact is minimal, for me.

I was using it till the 26 upgrade on my iOS 13 Mini. Became very sluggish and unusable that I had to disable it. It clearly isn't tested well.

I turn it on when I travel overseas, and have considered turning it on when I’m near border regions in America.

It’s mostly that I don’t want to be that guy that leaks my company’s secrets.

Which is exactly what they said:

> “We are not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device,” Apple spokesperson Sarah O’Rourke told TechCrunch on Friday.

Which is infinitely better than the cases we know about without the feature enabled.

Completely off topic. I went solo hiking in Azerbaijan in August of 2022, heading towards some hilltop castle thing I saw on Google Maps. Along the way I met some locals who invited me to join them. We got to the castle around midday and I was preparing to walk back to my car alone, and they all strongly advised against it. They said it was dangerous and invited me to go camping with them, which was pretty fun as they gave me my own tent, food, etc. While at the campground, one guy pulled out his phone to show me pictures of the local wildlife, including a big ol' brown bear. I was too stupid to think about what might eat me out in the woods alone, as I lacked the instinct to check for man-eating predators having grown up in an area where I didn't need to worry about such things.

Anyway, now I think about bears before solo hiking.

This is a case where bear attacks have happened, and this specific audience includes some rather delicious salmon. If salmon stop getting eaten by bears after the bear patrol is started, it's more reasonable to make that connection.

No amount of hardware/software hardening will save you if you delete "with spyware" and replace it with "with social engineering". If there have been cases of people being hacked through social engineering, it would be dishonest to make a blanket statement "nobody's been hacked", but it doesn't detract from the effectiveness of the technical measures.

You won't see that anywhere without their usual procedure of redefining the problem definition.

Sorry but you still need to be wary of state actors and the handing over of data to authorities, which is a far simpler approach than breaking security boundaries. The hacking statement is pure marketing.

A state actor will just kidnap your kids or throw your wife out a window.

His personal gmail was hacked, how does Apple protect your personal gmail from this? We don't even know how they hacked it. Could be password reuse.