4 ms·

Same here - but I would like more info on the subject to allow for a qualified decision. iPhones are very expensive. Isn't basically all your data, everything

Same here - but I would like more info on the subject to allow for a qualified decision. iPhones are very expensive. Isn't basically all your data, everything you type being sent to Apple?

new299 9y ago
I can find no reference to this, and I've not heard anything about this happening in the past. Issues with iOS include: * iCloud not encrypting data securely serverside (i.e. they can potentially get at the data). You can avoid this by not using iCloud. * They have Ads in app, and now in the Appstore directly. Potentially this changes the dynamic, between user/advertiser in a negative way. There are probably other issues... but I'm not currently aware of them. Overall it still seems like the best option from a privacy perspective.
- rodorgas 9y ago
  I don't think first item is true especially if you have 2-step verification enabled. They explicit say that if you lose your auth token, they can't do nothing. When I didn't used 2-step, I forgot my password, called them and they reset it for me (I had to confirm my identity providing them a code sent to my mac).
  - new299 9y ago
    I think "can't" is "wont" in this case. Apple law enforcement guidelines state: "All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centers." and "iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari browsing history and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centres. iCloud content, as it exists in the subscriber’s account, may be provided in response to a search warrant issued upon a showing of probable cause." So in short, Apple retains encryption keys for much of the data (including iOS backups), and will provide decrypted data to US law enforcement on request. https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...
- skierscott 9y ago
  iCloud security overview: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - new299 9y ago
    Hmm that page is pretty unclear. Because while it says the data is encrypted serverside. What it doesn't say is which data is encrypted with a key that Apple has access to. Much of the data listed as encrypted on server is available to US law enforcement under warrant. It would be nice, to have an option available where data is encrypted on server, with your key. But that would mean you couldn't recover your data if you lost your key of course (and I think Apple consider that a poor user experience, or are under pressure not to do that...).
toasterlovin 9y ago
No. And when data is send to Apple, they go to great lengths to A) anonymize it, and B) not store it.
- awj 9y ago
  or C) (at least in regards to unlocking devices) encrypt it so even they can't retrieve it.
princekolt 9y ago
Not really. https://www.apple.com/privacy/ https://www.apple.com/privacy/
MandieD 9y ago
As I'm a small phone fan (the Samsung Alpha was a bit too big!), the iPhone SE will definitely be my next one. It has the guts of the 6s, and is 519 EUR with 128GB storage, which is far less than the slightly-too-big 6s (or other 4.7" successors)
- mxuribe 9y ago
  I'm glad to hear that I'm not the only small phone fan. My new job is asking me to get a new/other phone for work purposes...and while I've always been a fan of android (not especially religious fan, simply a mild fan)...any recent phones which have decent functionality are immense in size. The only phone that I find that is a great balance of size and functionality seems to be the iphone SE. That fact alone was putting me on the fence as to whether i would stay with android - for this new/other work phone - or if I'd take the plunge to the apple side. Well, now reading this privacy piece, i'm leaning a bit more to the apple side. And, it is nice to hear that there are other folks out there who like small phones...i mean, i certainly don't want to walk around with a phone nearly the size of a freakin' tablet! :-)
  - stardek 9y ago
    If you haven't already you might want to look into Sony phones, they've made good smaller phones in the past. I don't know if they've got anything new out but I've got an Xperia Z5 Compact and it has always been quite capable of doing whatever I want it to do.
hellbanner 9y ago
Searching phone and on computer ("Spotlight") BY DEFAULT sends that data to Apple and third parties https://www.macrumors.com/2014/10/20/apple-spotlight-suggestions-privacy-statement/ https://www.macrumors.com/2014/10/20/apple-spotlight-suggest... see also http://bgr.com/2015/04/01/iphone-location-tracking-map/ http://bgr.com/2015/04/01/iphone-location-tracking-map/ I recommend don't trust Apple. It's not your code, it's not your hardware.
- karlshea 9y ago
  > Searching phone and on computer ("Spotlight") BY DEFAULT sends that data to Apple and third parties So turn off Spotlight Suggestions? Obviously if you're searching the web there will be traffic to the search engines. > http://bgr.com/2015/04/01/iphone-location-tracking-map/ http://bgr.com/2015/04/01/iphone-location-tracking-map/ Frequent Locations is on-device only.
  - hellbanner 9y ago
    My point was that Spotlight search is on by default, that's what I took issue with. It may be on-device only but it's not clear to the end-user that it's happening at all. No visible setting to disable it and vulnerable to malware.
_jal 9y ago
> Isn't basically all your data, everything you type being sent to Apple? No. And I have looked. Apple is very up front about the features that do and don't talk to the mothership. It has been a while, but I recall that as you go through the setup process, there's always info available telling you when they'll see your info, and more info online. But it tends to be pretty obvious - Apple has slurped up sensitive data before[1], but it did look like an accident, they fixed it, and were forthcoming about what happened. They're very clear that security related stuff (Secure Enclave - the thumbprint/faceprint data) never leaves the device. Things I know that talk back: - App store (obviously, and they care about analytics) - News app (ditto, it is basically a thin web browser) - iCloud (ditto, clearly, and pay attention to the various modes for encryption: IIRC, you need 2FA enabled for the encryption key to not be recoverable on their end. But you should double check for yourself, I don't use iCloud, so I haven't paid attention.) And looking at my phone on my local net with Wireshark, I also see some chatter that looks like things saving config information, similar to what you see on a Mac. I'm guessing this is them just not being careful - they want everyone backing up to iCloud, and even though I don't, various daemons keep nattering. I block all that stuff when on wifi (both Mac and iOS), with zero problems. On iOS, you mainly need to be concerned with third-party apps. Some of them build in shady libraries for adtech shitheads, do stupid things with analytic/instrumentation libs, etc. The ecosystem seems less bad than Android, at least. As close to a bottom line as I can come: turn off cloud backup and the syncing crap, use 2FA, don't download sketchy free games that ship your data to some guy in Romania, and you're leaking significantly less than on Android. Take more precautions (a content filter/ad blocker more aggressive than the defaults, disable wifi and bluetooth to avoid snoops along wherever you go, run your own mail/calendaring, etc.) and you're in pretty good shape, relatively speaking, and depending on your threat model. [1] IIRC, location data was being logged such that it ended up being sent back in crash reports.
mi100hael 9y ago
It's 100% opt-in. Yes, you can have all of your photos, notes, bookmarks, etc. synced to iCloud in which case Apple can see the data and provide it to 3rd parties either knowingly (law enforcement agencies) or unknowingly (the fappening). However, you can turn all of the syncing off and none of that data ever leaves your phone and it stays encrypted using your device passcode. Other than the lack of automatic syncing to other Apple devices, there's not really any loss in usability if you disable iCloud.
- dpkonofa 9y ago
  That is not true. iCloud Backups are encrypted using the device's PIN. The only data that Apple would be able to provide is SMS data because that is not encrypted when it's sent and it's not encrypted when it's backed up.
  - mi100hael 9y ago
    I didn't say anything about backups because I'm not sure of their current state, but last I saw they are encrypted at rest with keys Apple controls, same as nearly all the rest of your data. Apple's website would indicate that's still the case as well. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - dpkonofa 9y ago
      How do you figure that that's what their website indicates? The site you linked says that backups are encrypted in transit and on the server and they specifically say that the encryption is end-to-end so "only you can access your information, and only on devices where you’re signed in to iCloud. No one else, not even Apple, can access end-to-end encrypted information." That's quoted right from the page you posted.
      - draebek 9y ago
        If you carefully read the sentence before your quote, it says, "For certain sensitive information, Apple uses end-to-end encryption." (Emphasis added.) Then scroll down to the "End-to-end encrypted data" section where it lists the data that is actually end-to-end encrypted. iCloud Backups are not listed there. AFAIK iCloud backups are not end-to-end encrypted. I believe this past February Tim Cook, or someone else at Apple, was indicating that they were working on changing that. (It was coming up because everyone was wishing the San Bernardino shooter's phone had been backing up to iCloud, so they wouldn't need to get in the phone, they could just access the iCloud backups—IIRC.)
criddell 9y ago
If you factor in resale value, iPhones aren't as expensive as they might appear.

Same here - but I would like more info on the subject to allow for a qualified decision. iPhones are very expensive. Isn't basically all your data, everything you type being sent to Apple?

new299 9y ago

I can find no reference to this, and I've not heard anything about this happening in the past. Issues with iOS include: * iCloud not encrypting data securely serverside (i.e. they can potentially get at the data). You can avoid this by not using iCloud. * They have Ads in app, and now in the Appstore directly. Potentially this changes the dynamic, between user/advertiser in a negative way. There are probably other issues... but I'm not currently aware of them. Overall it still seems like the best option from a privacy perspective.

rodorgas 9y ago
I don't think first item is true especially if you have 2-step verification enabled. They explicit say that if you lose your auth token, they can't do nothing. When I didn't used 2-step, I forgot my password, called them and they reset it for me (I had to confirm my identity providing them a code sent to my mac).
- new299 9y ago
  I think "can't" is "wont" in this case. Apple law enforcement guidelines state: "All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centers." and "iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari browsing history and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centres. iCloud content, as it exists in the subscriber’s account, may be provided in response to a search warrant issued upon a showing of probable cause." So in short, Apple retains encryption keys for much of the data (including iOS backups), and will provide decrypted data to US law enforcement on request. https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...
skierscott 9y ago
iCloud security overview: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- new299 9y ago
  Hmm that page is pretty unclear. Because while it says the data is encrypted serverside. What it doesn't say is which data is encrypted with a key that Apple has access to. Much of the data listed as encrypted on server is available to US law enforcement under warrant. It would be nice, to have an option available where data is encrypted on server, with your key. But that would mean you couldn't recover your data if you lost your key of course (and I think Apple consider that a poor user experience, or are under pressure not to do that...).

toasterlovin 9y ago

No. And when data is send to Apple, they go to great lengths to A) anonymize it, and B) not store it.

awj 9y ago
or C) (at least in regards to unlocking devices) encrypt it so even they can't retrieve it.

princekolt 9y ago

Not really. https://www.apple.com/privacy/ https://www.apple.com/privacy/

MandieD 9y ago

As I'm a small phone fan (the Samsung Alpha was a bit too big!), the iPhone SE will definitely be my next one. It has the guts of the 6s, and is 519 EUR with 128GB storage, which is far less than the slightly-too-big 6s (or other 4.7" successors)

mxuribe 9y ago
I'm glad to hear that I'm not the only small phone fan. My new job is asking me to get a new/other phone for work purposes...and while I've always been a fan of android (not especially religious fan, simply a mild fan)...any recent phones which have decent functionality are immense in size. The only phone that I find that is a great balance of size and functionality seems to be the iphone SE. That fact alone was putting me on the fence as to whether i would stay with android - for this new/other work phone - or if I'd take the plunge to the apple side. Well, now reading this privacy piece, i'm leaning a bit more to the apple side. And, it is nice to hear that there are other folks out there who like small phones...i mean, i certainly don't want to walk around with a phone nearly the size of a freakin' tablet! :-)
- stardek 9y ago
  If you haven't already you might want to look into Sony phones, they've made good smaller phones in the past. I don't know if they've got anything new out but I've got an Xperia Z5 Compact and it has always been quite capable of doing whatever I want it to do.

hellbanner 9y ago

Searching phone and on computer ("Spotlight") BY DEFAULT sends that data to Apple and third parties https://www.macrumors.com/2014/10/20/apple-spotlight-suggestions-privacy-statement/ https://www.macrumors.com/2014/10/20/apple-spotlight-suggest... see also http://bgr.com/2015/04/01/iphone-location-tracking-map/ http://bgr.com/2015/04/01/iphone-location-tracking-map/ I recommend don't trust Apple. It's not your code, it's not your hardware.

karlshea 9y ago
> Searching phone and on computer ("Spotlight") BY DEFAULT sends that data to Apple and third parties So turn off Spotlight Suggestions? Obviously if you're searching the web there will be traffic to the search engines. > http://bgr.com/2015/04/01/iphone-location-tracking-map/ http://bgr.com/2015/04/01/iphone-location-tracking-map/ Frequent Locations is on-device only.
- hellbanner 9y ago
  My point was that Spotlight search is on by default, that's what I took issue with. It may be on-device only but it's not clear to the end-user that it's happening at all. No visible setting to disable it and vulnerable to malware.

_jal 9y ago

> Isn't basically all your data, everything you type being sent to Apple? No. And I have looked. Apple is very up front about the features that do and don't talk to the mothership. It has been a while, but I recall that as you go through the setup process, there's always info available telling you when they'll see your info, and more info online. But it tends to be pretty obvious - Apple has slurped up sensitive data before[1], but it did look like an accident, they fixed it, and were forthcoming about what happened. They're very clear that security related stuff (Secure Enclave - the thumbprint/faceprint data) never leaves the device. Things I know that talk back: - App store (obviously, and they care about analytics) - News app (ditto, it is basically a thin web browser) - iCloud (ditto, clearly, and pay attention to the various modes for encryption: IIRC, you need 2FA enabled for the encryption key to not be recoverable on their end. But you should double check for yourself, I don't use iCloud, so I haven't paid attention.) And looking at my phone on my local net with Wireshark, I also see some chatter that looks like things saving config information, similar to what you see on a Mac. I'm guessing this is them just not being careful - they want everyone backing up to iCloud, and even though I don't, various daemons keep nattering. I block all that stuff when on wifi (both Mac and iOS), with zero problems. On iOS, you mainly need to be concerned with third-party apps. Some of them build in shady libraries for adtech shitheads, do stupid things with analytic/instrumentation libs, etc. The ecosystem seems less bad than Android, at least. As close to a bottom line as I can come: turn off cloud backup and the syncing crap, use 2FA, don't download sketchy free games that ship your data to some guy in Romania, and you're leaking significantly less than on Android. Take more precautions (a content filter/ad blocker more aggressive than the defaults, disable wifi and bluetooth to avoid snoops along wherever you go, run your own mail/calendaring, etc.) and you're in pretty good shape, relatively speaking, and depending on your threat model. [1] IIRC, location data was being logged such that it ended up being sent back in crash reports.

mi100hael 9y ago

It's 100% opt-in. Yes, you can have all of your photos, notes, bookmarks, etc. synced to iCloud in which case Apple can see the data and provide it to 3rd parties either knowingly (law enforcement agencies) or unknowingly (the fappening). However, you can turn all of the syncing off and none of that data ever leaves your phone and it stays encrypted using your device passcode. Other than the lack of automatic syncing to other Apple devices, there's not really any loss in usability if you disable iCloud.

dpkonofa 9y ago
That is not true. iCloud Backups are encrypted using the device's PIN. The only data that Apple would be able to provide is SMS data because that is not encrypted when it's sent and it's not encrypted when it's backed up.
- mi100hael 9y ago
  I didn't say anything about backups because I'm not sure of their current state, but last I saw they are encrypted at rest with keys Apple controls, same as nearly all the rest of your data. Apple's website would indicate that's still the case as well. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - dpkonofa 9y ago
    How do you figure that that's what their website indicates? The site you linked says that backups are encrypted in transit and on the server and they specifically say that the encryption is end-to-end so "only you can access your information, and only on devices where you’re signed in to iCloud. No one else, not even Apple, can access end-to-end encrypted information." That's quoted right from the page you posted.
    - draebek 9y ago
      If you carefully read the sentence before your quote, it says, "For certain sensitive information, Apple uses end-to-end encryption." (Emphasis added.) Then scroll down to the "End-to-end encrypted data" section where it lists the data that is actually end-to-end encrypted. iCloud Backups are not listed there. AFAIK iCloud backups are not end-to-end encrypted. I believe this past February Tim Cook, or someone else at Apple, was indicating that they were working on changing that. (It was coming up because everyone was wishing the San Bernardino shooter's phone had been backing up to iCloud, so they wouldn't need to get in the phone, they could just access the iCloud backups—IIRC.)

criddell 9y ago

If you factor in resale value, iPhones aren't as expensive as they might appear.