Question regarding iPhone's security

[Mischka07]

Hi all,

Brand new to the Mac World, got my iPhone 3GS this past Thursday.

I've been lurking through the forums for the past couple of days, largely because I was told recently that the iPhone is the least secure of all smart phones. This came from another iPhone user, who claimed that Apple formally stated that the iPhone is not business phone and therefore should not be used as a business phone.

I asked him what "secure" meant, since it's a rather ambiguous term. He couldn't elaborate so I searched around on here. Unfortunately, I couldn't find anything solid regarding what people mean by "not as secure as...", "least secure", etc. All I gathered is that it's possible for someone to install apps on your phone without you knowing, and some people are not comfortable accessing their bank accounts on the iPhone.

My questions are:

1. Are apps downloaded from the app store by-and-large safe to use, or can they install malicious programs?
2. How comfortable are you accessing your bank account on the iPhone? If you're not, why? If you are, why?
3. Are you comfortable with your data (contacts, calendar, etc) being synced OTA with the iPhone? If not, why? If you are, why?

Thank you all who reply. I'm coming over from the Blackberry side of things, which is in all intents and purposes a business phone. I do plan on using my phone for business purposes, but if the majority of people seem to feel like their data is at risk, I don't think I'd feel comfortable keeping the iPhone beyond the 30-day mark.

 

[outphase]

1. App Store is pretty secure. Apps are approved by Apple before they go out. Apple can reject an app for something really small, so spyware-ish stuff will likely be caught.
2. I am as comfortable as I was before with other smartphones. I won't do it via public wifi.
3. I sync to Google. I'd have bigger issues if I had a problem with syncing with the iPhone.

 

[Small White Car]

I feel safer using the iPhone than most computers.

Does that mean it's 100% safe? No, of course not. But I'm MORE comfortable using my iPhone than my desktop for things like banking. And for the record, I use both my phone and my computer for stuff like that. So even though I say "it's possible" I still consider it a remote threat.

(And no, no one can install apps on your phone remotely without you knowing it.)

EDIT: And as the other poster said, sticking to cell-data and your own wifi is your best bet.

 

[aristobrat]

[*]Are apps downloaded from the app store by-and-large safe to use, or can they install malicious programs?

So far, nothing in the App Store has done anything malicious. As mentioned, Apple has a kill switch that they can use to remove the app if one is found to be bad. Developers have to sign their apps before they're submitted to Apple, so it doesn't sound too easy for someone to sneak in a rouge application anonymously.

[*]How comfortable are you accessing your bank account on the iPhone? If you're not, why? If you are, why?

If you see the "lock" icon on your web browser, then even if someone is able to sniff your data, it should be encrypted in a way that they can't unencrypt it (SSL). That's true of any device with a browser, pretty much.

If you're using someone else's WiFi and they try to do a man-in-the-middle attack on you (essentially, try to trick your browser into thinking that they are the bank), you will get a certification error in your browser. Again, true on any device with a browser. So as long as you're aware of that, I don't think public wifi is a bad thing to use for banking.

[*]Are you comfortable with your data (contacts, calendar, etc) being synced OTA with the iPhone? If not, why? If you are, why?

I guess it depends on which method you use. If you use Exchange, then iPhone syncs OTA via the same method that other Windows Mobile phones do. I'm not sure what they use for MobileMe, but I haven't seen it mentioned as an issue in any of the security blogs.

AFAIK, where the iPhone gets knocked is how it encrypts the data on the iPhone 3GSi itself. Apparently Apple did it in a fairly easy to get around way, although I thought that 3.1 changed that. It's not up to the same gov't specs as the BlackBerry, but unless Windows Mobile has done something recently that I haven't noticed, the iPhone's better than that.

 

[admo]

I often wondered about security, but then I found that I was checking my Credit card balance via Safari, I paid my at&t bill via the At&t app at my sons soccer game. I am finding the convenience of doing this outweighing any risk that may be there. If anything untoward happens due to using all this stuff out in public over 3G, I'll post so in the forums.

 

[countrydweller]

My bank/insurance company came out with an app to access my accounts, pay bills, transfer money. They are secure and very careful, I believe the app is secure, otherwise they wouldn't of allowed it in the app store.

 

[Mischka07]

Thanks for the replies everyone! I greatly appreciate them.

 

[dZp]

App Store is pretty secure. Apps are approved by Apple before they go out. Apple can reject an app for something really small, so spyware-ish stuff will likely be caught.

So I guess apps tracking the user's UDID, usage, location or even in some instances the phone number doesn't count as spyware nor does it worry you ?!

I suggest you have a good browse through the I-phone-home project site first.

 

[aristobrat]

So I guess apps tracking the user's UDID, usage, location or even in some instances the phone number doesn't count as spyware nor does it worry you ?!

Personally, it worries me no more than surfing the web with a browser that has cookies enabled.

 

[ThatsMeRight]

So I guess apps tracking the user's UDID, usage, location or even in some instances the phone number doesn't count as spyware nor does it worry you ?!

I suggest you have a good browse through the I-phone-home project site first.

So? Every site on the internet can see your browser, IP and therefor your location etc.

And with the iPhone you first have to give an app allowance before it can see your location etc.