1

Historically Apple never shows up at CES, and this year they put up the following ad close to the convention center:

Apple privacy ad at CES 2019

There is always this argument that Apple has better privacy policies in it's devices (which implies better cryptography in it's hardware and softwares) than Google and other tech companies.

The Apple privacy website mentioned in the ad only contains corporate statements for regular users, that are vague and do not provide information in what really makes the iPhone secure.

Is this only a marketing strategy or there are technical differences that make the iPhone more secure (when it comes to data privacy) than Android phones?

PS: I'm not asking for "which one to buy", or opinions on which is more secure. I want to know if there are technical evidences of these claims.

  • I googled "iphone vs android privacy" and got a LOT of hits with technical details. Including: tomsguide.com/us/android-privacy-vs-iphone,news-27856.html – schroeder Jan 6 at 20:39
  • The Vanderbilt paper mentioned in this article is really good, the other hits are not technical at all, only tech journalism. – Filipe dos Santos Jan 6 at 20:50
  • I did a random selection of 3 from the top 10 hits and they all got into the technicals. Mostly legal and policy technicals, but technicals nonetheless. – schroeder Jan 6 at 20:54
  • I would suggest clarifying the question. There is a confusing conflation of privacy and security. While related in several ways, they are distinct concepts. One example: better privacy policies do not imply better cryptography (though Apple's security is also respected). – pseudon Jan 7 at 17:58
3

Apple has an extensive description of the security features in iOS devices in a white paper titled iOS Security Guide. (There's also a similar, shorter macOS Security Overview if you're curious about their computers.)

Some of the key points made in this document are that:

  • iOS verifies the authenticity of the operating system during the boot and update process, ensuring that the operating system has not been tampered with.

  • User data stored on iOS devices is encrypted using keys which are both specific to the device and to the user's passcode.

  • Application review and signing processes, as well as application sandboxing, make it difficult for malicious applications to be installed on a device, and prevent applications from accessing data in unauthorized ways.

I'm not aware of an analogous document describing Android's security features. Some of the security features of iOS depend on hardware capabilities of the Apple SoC (in particular, for data encryption) which may not be available on some Android devices.

  • 1
    The closest Android document might be source.android.com/security/reports/…, but it’s important to remember that these security features don’t have to be (and in many cases aren’t) implemented or configured by the device manufacturers (Samsung, HTC, etc). – Steve Jan 7 at 22:02
2

The largest factor in phone security is the ability for the vendor to own the hardware to software soup to nuts. This is technically available for Android and iOS since Android is a fairly open source software and iOS is built to spec on hardware defined by the same company. So why the giant AD for CES?

As pointed out in the comments and other answers, Apple has done a great job presenting themselves as the most secure platform. The encrypt a lot of their phone data. They don't sell your data. They hardly track anything at all in fact. They also have the capability of building physical security controls to prevent the exploitation of their software (see GreyKey).

Meanwhile, many android developers have taken a different approach to the phone. Many companies have chosen to sell the best features or lowest cost devices they can to saturate the market and earn their pretty penny. Especially on lower cost devices, of which Android is majority, you can bet your life on manufacturers skipping corners especially in way of security testing and hardening. It's not that they couldn't, it's that they don't for cost or profit reasons.

Going beyond the generalized statements, there are security focused android devices as well. Google has been one of the leading developers of user identity management and security, working to build into their products physical security controls just like Apple has. HTC recently developed a phone that has a security enclave to protect cryptocurrency wallets and prevent wallet theft.

In the end, it really is more publicity/marketing than hard facts. Android CAN do everything iOS can do; the real question is if ZTE/Huawei/Samsung/LG/MOTO and others are willing to step up to the same bar of both physical and software security. And in my humble opinion, most probably wont.

  • 1
    I'm not sure if all these statements are true. After going through the Vanderbilt paper mentioned by @schroeder, it seems Android as an OS has flaws that allow developers to access private data more easily, most (if not all) of these flaws cannot be exploited in iOS. Google's own standard services/products within Android seems to collect a lot more private data than similar Apple services/products in iOS. – Filipe dos Santos Jan 6 at 23:05
  • Hey Filipe, I think this falls into the grey area of what open source allows developers to do. If Google (as a phone manufacturer) or any other service wanted to, they could provide the necessary code changes to protect data within the operating system. Whether leveraging hardware TEEs or TPMs, many things could be implemented. I cannot deny that most wont go through this effort through and as a result, I generally agree with your sentiment. Still doesn't mean Android CAN'T be secure, just that is ISN'T. – Connor Peoples Jan 6 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.