iphone - protection of data?

usignuolo

i have been thinking about getting an iphone and our local paper reports a series of thefts from users by thieves on mountain bikes snatching them. So I have been looking at security options which i assume include registration of phone details with contract supplier, password protection and tracking software should I be unlucky to lose it or have itstolen.

So I was a bit concerned to find this on line (on NBC USA) in a discussion about security protection of mobile phones. Is it correct, is it really impossible to make iphone contents secure?

"....passwords stored on an iPhone — whether the device itself is password-protected or not —can be detected using a process that takes barely more than six minutes to complete.

The first step in the method is to jailbreak the device — which basically means circumventing some iPhone security measures and installing software not authorized by Apple. This can be accomplished using one of many freely available software tools and allows for the installation of an SSH server — which in turn allows for access to the device's password management system, better known as the keychain.

At this point there's a tricky step in which hackers face a keychain database which is encrypted with a key that can't be extracted from the iPhone. The solution? Use the key from software within the device.

Ta da! A few clicks later the iPhone will happily share its stored secrets. MS Exchange accounts, LDAP accounts (Lightweight Directory Access Protocol that allows for access to all sorts of directories, generally for corporate use), voicemail, VPN passwords, WiFi passwords and some app passwords are all easily viewed.

So what can you do? Not very much. There doesn't appear to be any preventative measures you can take to keep your data safe. All you can do is rush to change your passwords the instant you notice your iPhone is missing. "

DUTR

usignuolo wrote: »

i have been thinking about getting an iphone and our local paper reports a series of thefts from users by thieves on mountain bikes snatching them. So I have been looking at security options which i assume include registration of phone details with contract supplier, password protection and tracking software should I be unlucky to lose it or have itstolen.

So I was a bit concerned to find this on line (on NBC USA) in a discussion about security protection of mobile phones. Is it correct, is it really impossible to make iphone contents secure?

"....passwords stored on an iPhone — whether the device itself is password-protected or not —can be detected using a process that takes barely more than six minutes to complete.

The first step in the method is to jailbreak the device — which basically means circumventing some iPhone security measures and installing software not authorized by Apple. This can be accomplished using one of many freely available software tools and allows for the installation of an SSH server — which in turn allows for access to the device's password management system, better known as the keychain.

At this point there's a tricky step in which hackers face a keychain database which is encrypted with a key that can't be extracted from the iPhone. The solution? Use the key from software within the device.

Ta da! A few clicks later the iPhone will happily share its stored secrets. MS Exchange accounts, LDAP accounts (Lightweight Directory Access Protocol that allows for access to all sorts of directories, generally for corporate use), voicemail, VPN passwords, WiFi passwords and some app passwords are all easily viewed.

So what can you do? Not very much. There doesn't appear to be any preventative measures you can take to keep your data safe. All you can do is rush to change your passwords the instant you notice your iPhone is missing. "

Seems the best protection is not to parade the device then , a few months back I found a 3gs, managed to locate the owner and left it at a place for her to collect, she didn't seem happy at having to collect it, even though it was only 9 tube stops away.
I didn't even need to bypass the security to assist tracing the owner.