EFF: iOS 11’s misleading “off-ish” Bluetooth, Wi-Fi setting bad for user security

Electronic Frontier Foundation blog:

Turning off your Bluetooth and Wi-Fi radios when you’re not using them is good security practice (not to mention good for your battery usage). When you consider Bluetooth’s known vulnerabilities, it’s especially important to make sure your Bluetooth and Wi-Fi settings are doing what you want them to. The iPhone’s newest operating system, however, makes it harder for users to control these settings.

We’ve discussed the Control Center controls and icons in this Loop post.

In a nutshell, when you tap the WiFi or Bluetooth icons in Control Center, you’ll drop/restore the current connection, but without turning off the respective radio. And that’s the EFF’s complaint.

Instead, what actually happens in iOS 11 when you toggle your quick settings to “off” is that the phone will disconnect from Wi-Fi networks and some devices, but remain on for Apple services. Location Services is still enabled, Apple devices (like Apple Watch and Pencil) stay connected, and services such as Handoff and Instant Hotspot stay on.

All true.

Apple’s UI fails to even attempt to communicate these exceptions to its users.

A small point, but I disagree with this. Once you see the difference between the off icon state and the disconnected state, it’s clear what’s going on. There’s also helper text, like “Disconnected from XXX”, where XXX is your WiFi network name.

The more important issue:

It gets even worse. When you toggle these settings in the Control Center to what is best described as”off-ish,” they don’t stay that way. The Wi-Fi will turn back full-on if you drive or walk to a new location. And both Wi-Fi and Bluetooth will turn back on at 5:00 AM. This is not clearly explained to users, nor left to them to choose, which makes security-aware users vulnerable as well.

The only way to turn off the Wi-Fi and Bluetooth radios is to enable Airplane Mode or navigate into Settings and go to the Wi-Fi and Bluetooth sections.

My two cents? Make the controls default to the safest possible behavior, then expose settings that allow me to go to a more relaxed, less secure state for a specific benefit (battery savings, better communications, etc.)

UPDATE: As pointed out by my unrelated name-sharer and Loop reader Jason Mark, Airplane Mode does not impact the WiFi or Bluetooth radios, as EFF claims. An easy mistake, but worth clarifying. Give this a try on your iOS 11 device.



8 thoughts on “EFF: iOS 11’s misleading “off-ish” Bluetooth, Wi-Fi setting bad for user security”

  1. The “right” UI in my opinion would be to allow a force press to shut it off completely, with the normal ‘tap’ the current behavior.

    You can always go to the Settings to turn off the radios, but I agree that it is misleading as it exists in 11.0…

  2. I think the most interesting thing is that when you use Control Center to toggle Bluetooth it will drop connections to devices like the headphones/AirPods, but it doesn’t drop the connection to an Apple Watch. So it’s not even killing all BT connections.

    It really does seem like a missed 3D Touch opportunity to not give the option to fully disable these from Control Center.

  3. Something else I’ve noticed, probably not in the same bucket but tangential: before iOS 11, if your bluetooth radio was on but you were not paired to anything, it showed up gray. When it was paired, it showed up fully black (or white, depending on the background). In iOS 11, there IS no gray setting. I cannot tell at a glance, without going into the Settings app, whether I am connected to a device. This was something I did all the time, due to a poor bluetooth connection in my car. Now I must rely on the car’s feedback, which isn’t very good.

  4. Well, that all swings back around to this complaint. The gray Bluetooth icon is gone, and now the Bluetooth icon just doesn’t appear at all in the status bar if you’re not connected to anything.

    If you’re connected to a Bluetooth device, the BT icon shows up in status bar. If you’re not connected, there’s no icon in the status bar. However, the radios are still turned “on” just not connected to anything.

    That’s the whole complaint. And I understand why Apple made this change. I would say a good majority of users were turning off all these radios thinking leaving them on (even if they weren’t connected to any BT devices) kills battery life. When it really doesn’t. You’re only just disabling key parts of the iOS user experience like Handoff.

    So I get why Apple did it. But it probably could have been implemented a little better.

  5. That’s actually not what I see: I see a bluetooth icon at ALL times if the radio is on (just not gray). If I go into the bluetooth settings, I may see devices AVAILABLE, but none connected.

    For example, if I toggle BT off and on in control center, that should kick me off any devices I’m connected to. But the instant I toggle it back on, it immediately comes back.

    If what you’re describing is correct (and it makes more sense than what I see on my phone), then it’s my phone that is at issue and not the expected operation of iOS. Still, I miss the gray indicator.

    EDIT: BTW I’m one of those fools that would turn off BT and Wifi if I knew I wasn’t going to need them, to save battery. It’s a relief to know that that’s not really worth doing, now I don’t have to think about it. The functionality where Wifi turns back on (fully) when you change location DID make sense to me, since every once in a while I would forget to turn it back on.

  6. agreed. the point of this toggle is to disable third party devices (like for fear of outside scanners) but allow your watch to still work.

  7. How can you evade third party scanners but still allow wirelessly connected devices to work?

  8. Yes. I forgot to turn it on several times and ended up over my bandwidth limit on my cell service at the beginning of the month. First world problem aside, I was pretty annoyed at that and myself…

Leave a Reply

Your email address will not be published. Required fields are marked *