5 ms·

Sounds like a mistake rather than some nefarious data collection strategy. Apple doesn't rely on advertising revenue like Google or Facebook so in the past the

by neotek 10y ago

Sounds like a mistake rather than some nefarious data collection strategy. Apple doesn't rely on advertising revenue like Google or Facebook so in the past they've been much more likely to avoid collecting data whenever it could get in the way of their self-professed privacy narrative.

kartickv 10y ago
Storing data on Apple's cloud services is a privacy risk given their inability to keep it secure. We had the celebrity iCloud hack, caused at least in part by Apple not using 2FA for iCloud logins. And now this privacy failure. Storing your data on a cloud service that isn't competent is a privacy risk. And a reliability risk, as I found out last year when my albums on iCloud Photos disappeared. Not the photos themselves, just the albums in which I organised them, but organising data can take a lot of time, and any data loss is unacceptable. They weren't in trash. Apple's "self-professed privacy narrative" is partly right, but partly marketing, and partly disingenous, as if collecting data has no other purpose than advertising: https://dcurt.is/privacy-vs-user-experience https://dcurt.is/privacy-vs-user-experience To be clear, I'm not taking a black-and-white view; it's partly right, partly wrong. BTW, The Verge wasn't clear — was the forensics firm getting data from an iDevice or Mac's local storage, or across the Internet from iCloud servers?
- izacus 10y ago
  Apples approach to security is nicely summarized by the fact, that you're not allowed to use 2FA for iCloud at all on a Mac if you don't own an iPhone.
  - simonh 10y ago
    Both two step authentication and two factor authentication can be set up to use text message or phone call verification to an arbitrary phone number.
    - izacus 10y ago
      According to this: https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915 a "trusted device" is only an Apple device, phone calls are for backup when you lose them. Even after that it's significant inconvenience in comparison to any other vendor using a standardized OTP approach working with any application that implements the standard. It's one of the little ways how Apple makes not owning an iOS device inconvenient for mac users.
      - simonh 10y ago
        I believe Apple prefers that people use a trusted device as from their point of view this is more secure as they can verify the entire communications loop so they view this as a fallback option, but you certainly can use non-Apple devices to authenticate. They also don't appear to throw up any roadblocks to doing so.
        mcintyre1994 10y ago
        Isn't the fallback only SMS/phone? That seems like a roadblock compared to say Google Authenticator.
      - madeofpalk 10y ago
        It's extremely confusing, but Apple has two types of multple-factor authentication solutions in use. The 'legacy' (my phrasing, only because it was the first implemented) MFA is SMS-based, and thus has not dependency on iPhones. There's a newer (about a year or two old by this point) solution which has a 'richer user experience' and depends on having other Macs or iPhones to receive the MFA authentication dialogs.
        glhaynes 10y ago
        The newer solution ("Two-factor authentication") also allows non-Apple phones to receive a code on their "trusted phone number". From the support page linked in a nearby comment: What if I don’t have access to a trusted device or didn't receive a verification code? If you're signing in and don’t have a trusted device handy that can display verification codes, you can have a code sent to your trusted phone number via text or a phone call instead. Click Didn't Get a Code on the sign in screen and choose to send a code to your trusted phone number. You can also get a code directly from Settings on a trusted device.
  - 9935c101ab17a66 10y ago
    This statement appears to be false based on a few quick googles and apple support documents. Citation?
  - AlphaSite 10y ago
    Actually the new 2FA method they introduced somewhat recently does allow this.
  - blauditore 10y ago
    Also, you're forced to use silly old password reset questions (from a predefined list). I just recently had to do this for my dev account (not Apple user otherwise) and was mildly shocked. There were no questions people knowing me couldn't answer with moderate research effort...
- Anechoic 10y ago
  We had the celebrity iCloud hack, caused at least in part by Apple not using 2FA for iCloud logins. iCloud has offered 2 step authentication since 2013 [0]. From what I can tell, the celeb hack happened a few weeks before the public release in mid-2014. [0] https://9to5mac.com/2013/03/21/apple-beefs-up-icloud-apple-id-security-with-two-step-verification/ https://9to5mac.com/2013/03/21/apple-beefs-up-icloud-apple-i...
onion2k 10y ago
Apple's iAd advertising network only closed down a few months ago. They still have searchads for their apps stores and iTunes. Advertising isn't a big part of their business, but they do have good reason to collect data for targeting.

by neotek 10y ago

kartickv 10y ago

Storing data on Apple's cloud services is a privacy risk given their inability to keep it secure. We had the celebrity iCloud hack, caused at least in part by Apple not using 2FA for iCloud logins. And now this privacy failure. Storing your data on a cloud service that isn't competent is a privacy risk. And a reliability risk, as I found out last year when my albums on iCloud Photos disappeared. Not the photos themselves, just the albums in which I organised them, but organising data can take a lot of time, and any data loss is unacceptable. They weren't in trash. Apple's "self-professed privacy narrative" is partly right, but partly marketing, and partly disingenous, as if collecting data has no other purpose than advertising: https://dcurt.is/privacy-vs-user-experience https://dcurt.is/privacy-vs-user-experience To be clear, I'm not taking a black-and-white view; it's partly right, partly wrong. BTW, The Verge wasn't clear — was the forensics firm getting data from an iDevice or Mac's local storage, or across the Internet from iCloud servers?

izacus 10y ago
Apples approach to security is nicely summarized by the fact, that you're not allowed to use 2FA for iCloud at all on a Mac if you don't own an iPhone.
- simonh 10y ago
  Both two step authentication and two factor authentication can be set up to use text message or phone call verification to an arbitrary phone number.
  - izacus 10y ago
    According to this: https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915 a "trusted device" is only an Apple device, phone calls are for backup when you lose them. Even after that it's significant inconvenience in comparison to any other vendor using a standardized OTP approach working with any application that implements the standard. It's one of the little ways how Apple makes not owning an iOS device inconvenient for mac users.
    - simonh 10y ago
      I believe Apple prefers that people use a trusted device as from their point of view this is more secure as they can verify the entire communications loop so they view this as a fallback option, but you certainly can use non-Apple devices to authenticate. They also don't appear to throw up any roadblocks to doing so.
      - mcintyre1994 10y ago
        Isn't the fallback only SMS/phone? That seems like a roadblock compared to say Google Authenticator.
    - madeofpalk 10y ago
      It's extremely confusing, but Apple has two types of multple-factor authentication solutions in use. The 'legacy' (my phrasing, only because it was the first implemented) MFA is SMS-based, and thus has not dependency on iPhones. There's a newer (about a year or two old by this point) solution which has a 'richer user experience' and depends on having other Macs or iPhones to receive the MFA authentication dialogs.
      - glhaynes 10y ago
        The newer solution ("Two-factor authentication") also allows non-Apple phones to receive a code on their "trusted phone number". From the support page linked in a nearby comment: What if I don’t have access to a trusted device or didn't receive a verification code? If you're signing in and don’t have a trusted device handy that can display verification codes, you can have a code sent to your trusted phone number via text or a phone call instead. Click Didn't Get a Code on the sign in screen and choose to send a code to your trusted phone number. You can also get a code directly from Settings on a trusted device.
- 9935c101ab17a66 10y ago
  This statement appears to be false based on a few quick googles and apple support documents. Citation?
- AlphaSite 10y ago
  Actually the new 2FA method they introduced somewhat recently does allow this.
- blauditore 10y ago
  Also, you're forced to use silly old password reset questions (from a predefined list). I just recently had to do this for my dev account (not Apple user otherwise) and was mildly shocked. There were no questions people knowing me couldn't answer with moderate research effort...
Anechoic 10y ago
We had the celebrity iCloud hack, caused at least in part by Apple not using 2FA for iCloud logins. iCloud has offered 2 step authentication since 2013 [0]. From what I can tell, the celeb hack happened a few weeks before the public release in mid-2014. [0] https://9to5mac.com/2013/03/21/apple-beefs-up-icloud-apple-id-security-with-two-step-verification/ https://9to5mac.com/2013/03/21/apple-beefs-up-icloud-apple-i...

onion2k 10y ago

Apple's iAd advertising network only closed down a few months ago. They still have searchads for their apps stores and iTunes. Advertising isn't a big part of their business, but they do have good reason to collect data for targeting.