HN Explorer

Ask HN: How to make iOS more private and secure?

58 points by auslegung ↗ HN
I’m looking for suggestions beyond the basic “use a password instead of a pin”, “use 2fa”, don’t connect to public WiFi”. I think I’ve got my iPhone setup pretty well, but I suspect I’m missing more than just a few things. Any suggestion is appreciated, I’m willing to at least try it.

51 comments

[ 3.8 ms ] story [ 126 ms ] thread
mooreed
I am not sure I fully understand your question. Perhaps restate some of your goals more concretely?

Or link to a longer form post?

For me, I can’t tell if you are looking for some architectural patterns you hope apple will adopt?

Or for a discussion about DuckDuckGo, DNS over https, and VPN usage, Firefox focus, etc?

Thorrez
I think it's fairly clear auslegung is asking about the second. Mentioning "my iPhone" and "Any suggestion is appreciated, I’m willing to at least try it." doesn't indicate that auslegung wants to make changes to how iOS is architected.
mooreed
Fair points. Good feedback. I was clearly “feeling grand” upon first reading it.
evanrelf
Off the top of my head:

- Change your DNS resolver to something you trust

- Use a paid VPN service (bonus points if it disables your internet when it's not connected to the VPN)

- Enable erasing data after several failed password attempts

- Disable notification previews on the lockscreen / when locked

- Disable Siri, control center, widgets, etc. on the lockscreen / when locked

- Disable Touch/Face ID when entering a risky location (airport, etc.)

- Disable location services, camera, microphone, etc. for every app you can

- Disable sending analytics to Apple and app developers

- Use a privacy conscious search engine (DuckDuckGo, StartPage)

- Install a good content blocker (1Blocker)

- Don't use apps like Facebook that violate your privacy

That's all I can think of for now.

mandeepj
> - Disable Touch/Face ID when entering a risky location (airport, etc.)

Is it going to be a manual disable?

geofft
You can trigger Emergency SOS (aka "cop mode" - either to call them or to avoid them, tbh) by pressing the power button five times on iPhone 7 and below or holding side button + a volume button on iPhone 8 and up. Dismiss the prompt to call 911, and then your phone will be in a state where Touch ID / Face ID is disabled until you successfully use your passcode again.

It appears Wallet still works so you should still be able to get to boarding passes without unlocking the device.

sa1
Disabling iMessage and JavaScript in Safari would also help, given the recent Project Zero exploits we’ve seen.
Gaelan
Disabling iMessage means texts go unencrypted. I'd say that for 99.9% of threat models, keeping it on is the right move.
raverbashing
VPNs are debatable. While it's true they're a better solution for open WiFi networks, remember you're simply changing who has access to your connection data

It's not so clear VPN providers, even paid ones have your best interests in mind

For higher levels of security, it would be better the VPN was controlled by yourself

remarkEon
Any recommendations for a VPN for mobile? Willing and able to set something up myself.
judge2020
> (bonus points if it disables your internet when it's not connected to the VPN)

I believe that, unless the VPN specifically disables it, you can go to any VPN in settings-> VPN and enable "connect on demand" - the system will only send data if the VPN reports it's active. Apps can also request connect-on-demand themselves.

godelmachine
I tried using many content blockers (free ones) but not even a single one of them was able to prevent YouTube ads from playing.

Have you any suggestions here?

dawnerd
None of them are going to stop YouTube ads, that’s just not how the built in content blocker works. You might be able to with pinhole but setting that up on mobile is a world of fun...
godelmachine
May I ask whats meant by "pinhole" here?

Thanks

jamesponddotco
I am guessing he meant Pi-hole [1], a DNS blackhole for advertisement. You use it as your DNS server on iOS and it will block ads on any application.

There are also people running public instances around the web, like me [2], so you don’t have to install and manage your own.

You could also go with AdGuard DNS [3] or nextdns [4].

[1] https://pi-hole.net/

[2] E-mail me at root@jamespond.co for beta access

[3] https://adguard.com/en/adguard-dns/overview.html

[4] https://nextdns.io/

frio
1Blocker X is brilliant. Use the YouTube website, not the app; content blocking only works inside Safari afaict (for instance, Firefox on iOS doesn't seem to benefit from the content blocker).
godelmachine
Thanks for this suggestion but I am looking for a free one :)
frio
So was I; in the end I had to cave as nothing was particularly good, sadly.
SHAKEDECADE
Use Adblock from futuremind. It cost less than a beer. It set’s up a local dns vpn so you can still use a VPN like nordvpn. You can then block any type IP or set up complex rules. I’ve been able to block youtube ads and all the other stuff on their page. I only see the video I go to. The only limiting thing is a 5000 url/ip limit and that I have to open up and restart the App once a day usually.

Also under experimental settings for safari, only enable

  disable web SQL

  block top level redirects from third party sites
and

  swap processes on cross site navigation
godelmachine
Thanks for sharing all the details.

Its quite cheap as compared to others, agreed, but I would like to still see if there are good free Adblockers.

Scarbutt
- Change your DNS resolver to something you trust

Does that mean setting up your own DNS server that resolves directly to the root servers?

yoz-y
> Disable sending analytics to Apple and app developers

While this makes obvious sense, iOS is pretty good and forcing logs to be anonymised. Also one can only log string literals so the developer can’t just leak sensitive data there.

This being said, I wonder if Apple can capture somebody making a function that would loop over some string and log it letter by letter.

skinnymuch
If you don’t use Safari will content blocker like your suggestion really matter?
kkbaxter
Change the name of your iPhone. The default name may include your actual name, which can be seen in more places than you'd think.

Wipe/reset your iPhone every now and then. There is residual data left on the phone from app/data deletion (left over databases even). A factory reset will clear this, OS updates can help as well. The "Other" section of your iPhone storage is dangerous.

Make sure the emergency feature to disable TouchID/FaceID is enabled. When turned on it kills biometrics until you put in your (hopefully unique and complex) password. Otherwise, biometrics is safer.

Don't add any mail accounts to the native iOS mail app.

Ensure that access to USB accessories while the phone is locked is turned off.

Work only on LTE and your own private Wi-Fi (your job will have very complex monitoring tools like FireEye). Disable cellular data on any apps that you won't actively be using.

Backup your iPhone to a secure location when travelling, wipe your phone and then re-build your phone using the backup upon arrival. Destroy the backup after.

Don't open any shady URLs and make sure you always update iOS. Turn on auto-update.

Security is critical on iOS as some apps have the ability to log you in or restore a session without any sort of credential check. This is despite the fact that unique device identifiers are not supposed to be used by devs.

Protect yourselves!

geofft
> Don't add any mail accounts to the native iOS mail app.

Woah, I haven't heard this advice before—is the argument that the native mail app is less sandboxed than an App Store app? If so that makes a lot of sense (especially given P0's recent exploit chain involving an IMAP client vulnerability), sigh.

kkbaxter
MDM related APIs change so often I just tell people to assume that all the native apps are less sandboxed.

Another thing you can do is to download apps using one Apple ID, then login again to the App Store with a different Apple ID.

The tricky thing about iOS is things are always changing, so precautions that might seem fruitless today may be critical tomorrow.

geofft
I'm not sure I follow - what potential changes would this defend against?
zakki
>> Backup your iPhone to a secure location when travelling, wipe your phone and then re-build your phone using the backup upon arrival. Destroy the backup after.

Do you think better it’s is better to have an interim account after reset the phone and before rebuild the phone with the backup?

jakebasile
> Security is critical on iOS as some apps have the ability to log you in or restore a session without any sort of credential check. This is despite the fact that unique device identifiers are not supposed to be used by devs.

I've noticed this before. How is that possible?

eecc
OAuth2 token authentication?
[deleted]
(comment deleted)
chatmasta
Some apps with persistent "anonymous" logins save an identifier to the keychain and sync it with iCloud so that it persists between installations and across devices.
walterbell
If you have a Mac, use Apple Configurator to set iOS device-wide MDM/security policies, some of which cannot be set using the on-device Settings app.
praveenweb
I use AdGuard Pro in combination with StevenBlack/hosts [0] and a custom DNS. This is used for system wide (not just Safari) ads/tracker blocking. Adding custom filters as and when required.

- [0] https://github.com/StevenBlack/hosts

skinnymuch
Any reason for this over Weblock?
SHAKEDECADE
I like weblock (I believe were talking about the same by Futuremind) but I prefer their other app Adblock (I posted a small quib about it ~15 replies up from this reply). You can also, if you want; copy the PAC weblock sets up for you, host it yourself on github and then set it up as your own proxy for whatever wifi you connect to.
skinnymuch
Ah okay cool! I accidentally bought both. And wasn’t sure which to return. I’ll return Weblock then.

The pac self hosting feature seems cool too.

I’m just using nextdns now though so won’t be actively using any future mind apps for now. But good to know

thornjm
Persistent malware is more expensive and has higher risk of compromise, and so it is used sparingly. A regular restart is a surprisingly good defence technique on an iPhone.
thornjm
Avoid any low quality website willing to sell redirection or iframe based online advertising (e.g. online television, pornography websites). These can be a vector for exploitation attempts.