Apple had big security news yesterday, announcing that iOS 16 will introduce a new iPhone Lockdown Mode designed to protect users from even the most sophisticated cyber attacks like those carried out by NSO’s Pegasus spyware.
Apple says that the mode offers an “extreme” level of security that will be needed only by the tiny percentage of people who might be targeted by state-sponsored attacks. But it’s been argued that although most of us will never use it, we may still benefit from it …
iPhone Lockdown Mode
Apple announced the feature yesterday, saying that it will be included in a subsequent beta of iOS 16.
- Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled.
- Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.
- Apple services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent the initiator a call or request.
- FaceTime: Incoming FaceTime calls from people you have not previously called are blocked.
- Shared Albums: Shared albums will be removed from the Photos app, and new Shared albums invitations will be blocked.
- Wired connections with a computer or accessory are blocked when iPhone is locked.
- Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.
The iPhone maker warned that the functionality of iPhones in lockdown mode would be substantially impacted, and that’s one of the reasons that ArsTechnica argues it will have two broader benefits.
Educates people about security
The extreme level of protection offered by Lockdown Mode is way more than any normal user would ever want or need, but the site’s Dan Goodwin says that by warning of the limitations, Apple is educating people about the trade-offs involved.
It’s useful that Apple is upfront about the extra friction Lockdown adds to the user experience because it underscores what every security professional or hobbyist knows: Security always results in a trade-off with usability […]
No security snake oil here. If you want better security, learn to do without the services that pose the biggest threat. John Scott-Railton, a Citizen Lab researcher who knows a thing or two about counseling victims of NSO spyware, said Lockdown mode provides one of the first effective courses for vulnerable individuals to follow short of turning off their devices altogether.
The inevitable discussion arising from such an extreme form of protection is also likely to highlight options more useful to ordinary iPhone users, like Safety Check.
Governments in particular like to pretend that there is no privacy downside to measures designed to help detect terrorist communication, or child sexual abuse materials – and that’s absolutely not the case. We saw the latest example of this only yesterday.
A proposed new CSAM law in the UK could force all messaging companies to use the type of client-side scanning approach that Apple planned to launch to detect child sexual abuse material (CSAM) on iPhones.
An amendment to the Online Safety Bill has been put forward that would require tech companies to identify and remove CSAM, even in end-to-end encrypted private messages.
The more people who are aware of the trade-offs, the better they will be able to make informed decisions.
Might in future offer more targeted protections
Right now, Lockdown Mode is either on or off, and Apple gets to decide what it does. But the iPhone maker has promised to refine the feature over time, and Goodwin argues that this might include more granular control.
If Apple will allow users to disable unsolicited messages from unknown people, why can’t it provide an option to disable built-in microphone, camera, GPS, or cellular capabilities?
With that level of control, users could adjust the protections to suit their own needs. For example, we might decide that the risk of being overheard in a meeting is our current concern, so we might switch off the microphones but leave everything else functional.
I can definitely see the benefits of a Lockdown Modes section of Settings, with toggles for individual security features – what about you? Please share your thoughts in the comments.
Photo: Jason Dent/Unsplash
FTC: We use income earning auto affiliate links. More.
Comments