Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the likelihood of running malware on the device is much lower. And even if malware is running on the device, I assume it wouldn't have the same capabilities that desktop malware does, such as keylogging.

Furthermore, iOS Safari doesn't support plugins that would enable a man-in-the-browser attack. This means that drive-by malware installation through common vectors such as Java, Flash, and Adobe Reader should be impossible. It presents a user interface that clearly indicates whether or not a connection is secure, and that user interface cannot be overridden by the site being displayed.


  • iPhone has not been jailbroken.
  • The password is typed with the onscreen keyboard.

Extra credit

  • Does use of a password manager (like 1Password) improve or reduce security?
  • If this is considered off-topic, just read "online commerce" as "line of business application". Basically, I want to know whether iOS is really a trusted platform for web apps.
    – Nic
    Feb 2, 2013 at 6:11
  • Found a very similar question: security.stackexchange.com/questions/23855/…
    – Nic
    Feb 2, 2013 at 16:37
  • The answer to this related question points out some vulnerabilities of mobile browsers. security.stackexchange.com/q/290/1092
    – Nic
    Feb 5, 2013 at 21:35
  • This depends on the software and how it handles the cache files. There have been many cases on ALL the mobile platforms where the cache user data was not secured despite the author of the web application thinking it was.
    – Ramhound
    Feb 6, 2013 at 13:01

4 Answers 4


If you are using an IOS mobile device, your device is subject to many attacks such as

  • Juice jacking
  • A web browser that doesn't show HTTPS status clearly (iPhone)
  • A web browser that doesn't show the URL... enabling phishing (iPhone)
  • Web browsers that don't support additional SSL/TLS validation software such as Convergence

If you must use a mobile device, I'd suggest using a dedicated application, as this post suggests. In addition, the application itself may also validate the HTTPS certificate key (preventing MITM attacks) or even better it may use mutual auth TLS

(The following is similar to @Rory's answer:)

The ideal solution, is to reformat your PC, and install a virtual OS for games, testing, etc. Then use the standard PC for all your banking needs. Since the VM can't access your PC (hopefully you configured it so) then you're safe from any phishing or other attack.*

* Exception


The Apple walled garden model and iOS security model are very good for protecting the host but web applications require more than host security.

The iOS-ification of Mac OS X has brought the option of allowing only signed and vetted apps from the Appstore and the mandatory use of sandboxing from March 2012 on.

Windows 8 is slowly following the same model by making the tablet version (Windows RT) only run code from the Windows Store by default. But the platform is still young and fragile.

Apple Appstore security:

  • $99 joining fee.
  • Checks your identity and uses crime enforcement.
  • Content review and static analysis.
  • Code is signed and cannot be modified.
  • Cost to exploit is very high.
  • Very few malware applications slip through.

Apple iOS security:

  • It takes 6 months to write an exploit.
  • App review is a risk for months of work on an exploit.
  • iOS exploits are written by few groups.
  • Apple patches fast.
  • Code signing is employed, memory pages are signed at runtime and like DEP it protects against injecting code.
  • iOS Seatbelt sandbox is very good.
  • Charlie Miller injected new code at runtime by finding a vulnerability and got banned from the Appstore then the vulnerability was patched in 4 days.
  • Few malicious use of vulnerabilities found.

Securing the host is not enough and you can't rely on Apple to help the user BE secure. A secure host pushes attackers to attack the next weakest spots such as communication and the user where Apple can only nudge the user into being secure. There are other issues for online commerce:

  • Weak passwords or lacking account protections against reset and intercept.
  • Security awareness for things such as fake SSL certificates or phishing websites.
  • Vulnerabilities in commercial websites that require user interaction, such as XSS, CSRF and Clickjacking.

One of the aspects not touched on yet in other answers is that mobile security is still relatively young, and by comparison with mature operating systems it is more difficult to gain assurance over the security functionality implemented.

So currently it is simpler to be more secure on a desktop OS- the tools are well known, the attack types are well known, and implementing layers of security is much more straightforward to the end user.

I still wouldn't use an ios or Android app for online banking, but do use a VM on my desktop machine as I can control it and wipe it after use.

  • 1
    If you use the host for regular browsing, there is a risk of contracting malware that could monitor the VM. A safer approach is to use a VM for each kind of browsing, and don't use the host OS at all.
    – Nic
    Feb 2, 2013 at 16:25
  • Nic- that's exactly what I said...
    – Rory Alsop
    Feb 2, 2013 at 21:38


  1. iOS itself is not necessarily more secure than jailbreaked version. However, consider that for jailbreak to be possible iOS must have at least one security exploit by nature.
  2. Once installed, many security exploits are often corrected by jailbreak developers. However, you may be unable to review and/or understand the jailbreak itself, or any patches that promise to fix exploits. Therefore, it may not be possible to trust the jailbreak at all.
  3. When typing your password on screen, each key is "magnified" or enlarged on touch by the native iOS keyboard. Someone, or something (like a security camera), may be watching over your shoulder to steal your password.
  4. Proper security is not only just securing the client, but the entire communication chain and all devices associated with it. For example, if you are not communicating over HTTPS, the information could be stolen in transit. If your password is not store securely (such as a bad developer who saves passwords in plaintext), your password could also be leaked if a database is ever compromised.

About password selection itself: There are a number of discussions online, and available here at security.stackexchange.com. I've found (and I love) this: XKCD #936: Short complex password, or long dictionary passphrase?

  • 3
    A Jailbroken IOS allows for unsigned code to be run. It essentially gives the user the ability to negate the restrictions imposed by apple. Additionally, to jailbreak IOS you often need to be tethered to the PC and actively manipulating the device. It would be difficult to jailbreak a device without noticing it happens as it would reboot your phone several times in the process. I'm not aware of Jailbreaking fixing security issues with IOS that apple has not patched. I'd like a link for that source. The only virus that's been released for IOS was due to default root pwd in jailbroken phones.
    – NULLZ
    Feb 2, 2013 at 10:57
  • @D3C4FF I think you're not well informed. There is some stranges storys (urban legends?) about forensic viruses able to delegate your phone to police (and strong hackers)...There is some parts: en.wikipedia.org/wiki/History_of_iOS_jailbreaking Feb 2, 2013 at 11:05
  • 1
    "The first iPhone worm, iKee, appeared in early November 2009, created by 21-year-old Australian student Ashley Towns of Wollongong. He told Australian media that he created the worm to raise awareness of security issues: jailbreaking allows users to install a SSH service, which those users can leave in the default unsecure state." Source: The wiki link above... The second point you make "Once installed, many security failures will be corrected" is wrong based on that alone. And yes, i'm familiar with private 0-days for IOS used by Law enforcement. Jailbreaking does NOT secure your IOS Device!
    – NULLZ
    Feb 7, 2013 at 2:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .