12 ms·

Apple in China: who holds the keys?

215 points by auslander 9y ago

TaylorAlexander 9y ago
Quick question: if a user is under camera based surveillance and they type in their PIN, does that allow someone holding their data to decrypt it? Because apparently China is putting cameras everywhere, and it stands to reason they could have a module that monitors for PIN entry and records it. Even at my workplace in the US I try to avoid entering my PIN near security cameras.
- lathiat 9y ago
  The answer to this used to be no, but iOS 11 made a number of changes that I don't fully understand yet; I think the answer is still no unless you have the device then you may be able to get an iCloud reset token.. but don't take my word for it. (at that point they already have your device though eh?) As a side note I think people vastly underestimate how easy it is to capture you typing your password on a phone screen.. especially when you put it in the context of complaining about minor security implications of TouchID or FaceID. I would suggest it's typically much easier to watch you typing a password than to clone your TouchID .
  - spacehome 9y ago
    In the US, though, TouchID and FaceID are liabilities because the police can compel you to provide your fingerprint and face.
    - extrapickles 9y ago
      There are some protections against exactly this. If its been more than 48hrs since you last unlocked the phone or you turned off the phone, it will require your password again.
      - Trundle 9y ago
        Or just use the wrong finger a couple of times.
      - fiatpandas 9y ago
        You can also discretely disable Face ID by holding down power and a volume button.
        akarambir 9y ago
        I am curious if android has the ability to quickly disable fingerprint unlock if you are in adversarial situation. So it only asks for passcode.
        EwanToo 9y ago
        If you reboot the phone then it’ll only accept the PIN to unlock, at least on newer versions.
  - auslander 9y ago
    Snowden hides under towel to type passwords :)) https://youtu.be/4EgTXEn15ls?t=37m31s https://youtu.be/4EgTXEn15ls?t=37m31s
    - jacquesm 9y ago
      I could not help but notice the dissonance between Laura Poitras arriving at 'Newark Liberty International Airport' and how she was treated there. For small values of Liberty I guess. It's simply harassment, the kind that I would have expected in former Eastern Germany, Poland, Russia or any other state like that.
      - mindslight 9y ago
        Furthermore, clicking the above link actually displays a message saying the video is not available for viewing in the US...
        jacquesm 9y ago
        That's odd, it works for me.
        mindslight 9y ago
        Sorry. I edited to add that it's based on country - information control (and its associated ambiguity) being another quality of totalitarianism.
        deleted 9y ago
        [deleted]
        lern_too_spel 9y ago
        It clearly says it's blocked by the Weinstein Company, who owns the US rights.
        9y ago
- fiatpandas 9y ago
  Was curious about this as well. It would be a huge oversight if the encrypted blobs could be decrypted with a 4 - 6 digit pin. Couldn’t it be brute forced? My amateur understanding is the pin unlocks a hardware “safe” on the device which contains the actual decryption key, requiring physicAl access to the device even if the pin was caught on security cam.
- ssdd 9y ago
  Your concern is unnecessary. Real issue is that PIN lock is not secure enough in first place. Even if Chinese or US government doesn't have the PIN they can still decrypt a phone given the abundance of computing power they posses.
- Yizahi 9y ago
  According to this (1) since iOS 11 update PIN code is now a single point of failure, if know PIN and have access to device (or probably Apple made data dump on Chinese servers) you can have everything. (1) https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-rise-and-fall-of-ios-security/ https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-r...
bradenb 9y ago
Maybe I'm off-base, but I feel like at this point the question of "who can see my data if it's stored in China?" is a bit silly. I--for one--will just always assume that any data stored in China might as well be public.
- puzzle 9y ago
  Well, not public, but eventually accessible by those holding the guns and running the prisons. Which is still not great.
  - tluyben2 9y ago
    I get into many discussions like this; not sure where you are from but educated Americans I talk to do not accept their data being read by anyone except the gov in cases of terrorism. That means, in practice, the gov can read your data. What is the difference in China? Do you want all data or no data or some data and how is some data defined exactly? If this is not black and white the definitions are going to be painful and biased and how to enforce proper use?
    - mattnewton 9y ago
      Many Americans (but probably not the majority) don’t accept that their data is going to be read in cases of terrorism. It’s why Apple refused to backdoor their phone for the government in a case of terrorism. Narrow warrants granted by a seperate branch of government in broad daylight is very different from this. And it’s why we need to fight to restore that norm in America. I don’t buy that terrorism is such an exceptional case that we ought to bend due process out of shape.
      - Feniks 9y ago
        What little protection remains is a relic of the seventies. An interesting time in America. A time of strong resentment against the government after Vietnam and Nixon. There was a really powerful TRUE left wing in Washinton that had power. Ofcourse even back then they never extended FISA to non US citizens. Nobody legislates the CIA.
natch 9y ago
What I want to know is if I send an iMessage to someone who is, unbeknownst to me, living in or visiting China, does that mean my private information is now going to be shared with the Chinese government without my knowledge? I get that we have “no” or very little privacy now. But I’m wondering if Apple is making it clear to users in the US that their private messages may be siphoned off and exploited by governments of countries they have never been to.
- dfee 9y ago
  Well, which is it? Do you want to know the answer to your question, or do you already have the answer as suggested by your claim?
  - natch 9y ago
    Well there's a contradiction. On the one hand, if I send a message to China (including unknowingly) it sounds like it would end up as part of a conversation stored on servers in China. On the other hand, Apple has a reputation as a company that cares about and protects user privacy. There's a contradiction, is all I know.
- stevefeinstein 9y ago
  Top of article: > Beginning on February 28th, all users who have specified China as their country/region will have their iCloud data transferred to the GCBD cloud services operator in Guizhou, China. So living, most likely yes. Visiting then presumably no. But who really knows?
  - natch 9y ago
    I'm not wondering about those people, though. I'm wondering about the people who correspond with them.
threeseed 9y ago
Something that doesn't get enough attention. iCloud Keychain stores the passwords, SSH keys, client side certificates etc for third party sites. That means that sites like Facebook, Google etc would be compromised on the biggest scale in history if Apple were to hand over encryption keys to the Chinese government. Not to mention the national security implications e.g. my work VPN credentials are in iCloud Keychain. There is no way Apple would be stupid enough to allow this situation to persist without informing users unless they maintained the keys and it was a moot point. Otherwise they are inviting themselves up for all sorts of legal issues. Not to mention people who travel to China for holiday/work purposes.
- AceJohnny2 9y ago
  > Not to mention people who travel to China for holiday/work purposes. Like a lot of Apple employees themselves, considering so much of the manufacturing is there. I would love to be a fly on the wall of their infosec team.
  - threeseed 9y ago
    Exactly. And I worked at Apple and it's not like we were given special phones with enhanced security. It's just a standard VPN to log on to internal sites. And of course the problem with keychains like this is that surely amongst one of your previous accounts is the password you used for your VPN and/or work email.
    - puzzle 9y ago
      Interesting. Google treated remote access from China or employees based in China differently even before Aurora: http://fortune.com/2011/04/15/inside-googles-china-misfortune/ http://fortune.com/2011/04/15/inside-googles-china-misfortun... Maybe in ten years or more someone (Farris?) will describe the details behind the scenes about the cat-and-mouse, the unexplained outages, etc.
      - elefanten 9y ago
IBM 9y ago
Apple's statements to the press about this have repeatedly said [1]: >Apple has strong data privacy and security protections in place and no backdoors will be created into any of our systems. iMessage is end-to-end encrypted and has never been blocked in China, while services like WhatsApp are [2]. During the FBI brouhaha, the national security establishment water holders started writing op-eds on blogs like Lawfare suggesting that Apple was being hypocritical in opposing the FBI, alleging that they had already given the jewels away to China [3]. The DoJ basically parroted this in their filings to the court, accusing Apple of this outright (whether or not the op-eds were co-ordinated with the DoJ is unclear). Fortunately, this led to Apple responding to these accusations in their own filings to the court [4], including this declaration from Craig Federighi under threat of perjury [5]: >5. Apple uses the same security protocols everywhere in the world. >6. Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device. >7. It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. >I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Assuming Craig Federighi didn't perjure himself, why has China seemingly made an exception for Apple when it comes to iMessage (or iOS or iCloud)? The answer is that Apple is the only tech company that actually has leverage with the CPC in (indirectly) employing millions of workers in China. People have criticized Apple for taking down the NYT's app or VPN apps in the App Store in China and for not resisting it, but Apple is rightly picking their battles to protect the crown jewels. [1] https://9to5mac.com/2018/01/10/apple-will-begin-storing-chinese-customer-icloud-data-at-new-china-data-center-from-next-month/ https://9to5mac.com/2018/01/10/apple-will-begin-storing-chin... [2] https://www.nytimes.com/2017/09/25/business/china-whatsapp-blocked.html https://www.nytimes.com/2017/09/25/business/china-whatsapp-b... [3] https://www.lawfareblog.com/deposing-tim-cook https://www.lawfareblog.com/deposing-tim-cook [4] https://assets.documentcloud.org/documents/2762131/C-D-Cal-16-Cm-00010-Dckt-000177-000-Filed-2016.pdf https://assets.documentcloud.org/documents/2762131/C-D-Cal-1... [5] https://www.documentcloud.org/documents/2762118-Federighi-Decl-Executed.html#document/p1 https://www.documentcloud.org/documents/2762118-Federighi-De...
xoa 9y ago
I think the core issue uniting all of these recent concerns about Apple and China (or any other country) is how critical structural incentives and capabilities are when it comes to individual free, privacy, and security, and in turn the fundamental danger of centralization. I've seen a lot of criticism towards companies for "folding" to oppressive regimes or orders, comparisons to people or organizations being party to atrocities in the past, etc., but I think those often miss the point. It is generally unreasonable to expect companies to directly oppose powerful governments. By design they are not in fact governments themselves, mostly for better (though maybe rarely for worse). Conflicting laws and norms between sovereign polities can be directly opposed, and there is rarely a bright line for "worth giving up everything for." In general, I don't think it's that fruitful to expect humans not to be humans. So it's a lot better if they just plain don't have the power (or at least not total power) in the first place. It's just like in infosec in general: the most secure information is the information that you don't ever have, you cannot be hacked for it or leak it. That's the only surefire way to avoid not merely abuse but even pressure for abuse, and it's here that I think Apple has made a big blunder even vs the rest of the tech industry. Yes the cloud is a big deal nowadays, but Apple's business model is uniquely well suited to supporting full non-cloud distributed usage models in addition as a differentiator from where so many other offerings have gone. It's fine if Apple has their own iCloud and App Store as the core principle source, but if they simply gave individual users and organizations the full and ungated ability to replicate that (in features if not breadth) locally then Apple could simply wash their hands of some of this without hassle (it could even let them get pickier elsewhere since there'd be a separate release valve). Apple used to be great at this too, back in OS X 10.5/10.6 at least Mac OS X Server had a lot of interesting potential. Easy full mirrors of Software Update, Network Homes and NetBoot/NetInstall were awesome, etc. It's not hard to imagine them having gone further that route, and it's too bad they've kind of half-assed gone the other way despite being weaker at network services then their competitors anyway. Legislatively from an American perspective this would also be the right way to try to fight back against authoritarian regimes: require American tech companies by law to offer decentralized options for owners of devices, like side-loading. If that's available then it would make the job of authoritarians significantly more challenging.
stevefeinstein 9y ago
Apple would have us believe that they're the privacy company. They're doing a good job with that marketing message. But what's more secure? How do Google, and Amazon compare? Do I have to run my own servers? Do I have not run servers? Do I have to keep a hardened device on my person at all time? What about backups?
deleted 9y ago
[deleted]
John_KZ 9y ago
The Chinese government is right to require all of it's citizens data to be stored in domestic datacenters. The danger of the Chinese government accessing your data is 1) Non-existent if you didn't declare you're Chinese 2) Not any different than the danger of the US government accessing your data By the way, since so many of you feel so strongly about your data being stored abroad, don't you think the Chinese should feel the same? Why should they trust their data to a foreign government?
- abtinf 9y ago
  > The Chinese government is right to require all of it's citizens data to be stored in domestic datacenters. "The only proper purpose of a government is to protect man’s rights, which means: to protect him from physical violence. A proper government is only a policeman, acting as an agent of man’s self-defense, and, as such, may resort to force only against those who start the use of force. The only proper functions of a government are: the police, to protect you from criminals; the army, to protect you from foreign invaders; and the courts, to protect your property and contracts from breach or fraud by others, to settle disputes by rational rules, according to objective law. But a government that initiates the employment of force against men who had forced no one, the employment of armed compulsion against disarmed victims, is a nightmare infernal machine designed to annihilate morality: such a government reverses its only moral purpose and switches from the role of protector to the role of man’s deadliest enemy, from the role of policeman to the role of a criminal vested with the right to the wielding of violence against victims deprived of the right of self-defense. Such a government substitutes for morality the following rule of social conduct: you may do whatever you please to your neighbor, provided your gang is bigger than his." - from "For the New Intellectual" https://www.amazon.com/New-Intellectual-Philosophy-Anniversary-Signet/dp/0451163087 https://www.amazon.com/New-Intellectual-Philosophy-Anniversa...
  - Nomentatus 9y ago
    No sewers? I like sewers.
- wmf 9y ago
  Some people take the position that it's better for the US government to have access to Chinese people's data than for the Chinese government to have access their data because the US government is better (e.g. more due process).
omeid2 9y ago
Y in X: who holds the keys? The alphabet agencies in X. Where Y is any corporation, and X any nation. At this point, I believe any assumption otherwise is naive.
abalone 9y ago
> Where Apple provides overwhelming detail about their best security systems (file encryption, iOS, iMessage), they provide distressingly little technical detail about the weaker links like iCloud encryption. Sounds like the author missed Apple's BlackHat 2016 talk. It goes into lots of technical detail on Cloud Key Vault.[1] Well worth watching -- and a very cool implementation of a secure backup system designed for "adversarial clouds". It's pretty cool how it retains end-to-end encryption of your keychain while also backing it up to untrusted clouds. Basically it employs Hardware Security Modules that limit recovery attempts to 10 tries before destroying the data, thus protecting against backend brute forcing and allowing you to use your relatively weak device passcode to encrypt the backup. And here's the kicker -- they put the HSM firmware signing keys in a blender so even an adversarial government can't force them to modify them. Update: I guess he did watch the video (he previously wrote a whole post on it). So I'm not sure what he thinks is missing, or maybe I misunderstood and he's only complaining about non-keychain data encryption. [1] https://www.youtube.com/watch?v=BLGFriOKz6U&feature=youtu.be&t=25m43s https://www.youtube.com/watch?v=BLGFriOKz6U&feature=youtu.be...
- JoachimSchipper 9y ago
  The author, in fact, has specifically written an article on the talk you mention: https://blog.cryptographyengineering.com/2016/08/13/is-apples-cloud-key-vault-crypto/ https://blog.cryptographyengineering.com/2016/08/13/is-apple.... Matthew Green is a capable cryptographer who engages with the wider security community and practical encryption a lot (e.g. https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-apple-imessage/); https://blog.cryptographyengineering.com/2016/03/21/attack-o... if you're interested in this kind of thing, I'd recommend following him more closely (e.g. on Twitter.)
- Buge 9y ago
  This is covered in the blog post: >With one major exception — iCloud Keychain, which I’ll discuss below — iCloud fails the mud puddle test. That’s because most Apple files are not end-to-end encrypted. The blog post is saying that iCloud backups are not protect from Apple, except keychain backups. So your files, messages, etc are not protected from Apple. And the video you posted seems to only be about keychain backups.
Cw67NTN8F 9y ago
So if China demands the key, Apple will pull out of China? https://www.cnbc.com/2017/11/02/apple-china-revenue-up.html https://www.cnbc.com/2017/11/02/apple-china-revenue-up.html ~$10 Billion last quarter of 2017
juanmirocks 9y ago
Call me a cynic, but I bet China has it all. One way or another.
motohagiography 9y ago
I interpret that there is an implication in what is described in the article that, when you set the region on your apple device, you get region specific iCloud keys provisioned to it. If that were the case, there is no reason why you couldn't provision from to an HSM domain that hadn't had its keys shredded. The implied architecture is there is a secure element on the phone with a unique key provisioned to it during manufacture - likely one that is derived from one of the HSM keys at Apple. However, since Apple cannot produce this individual device key themselves to do 3rd party device decryption, they must generate keys randomly in SE hardware on the device, using the user PIN as a derivation component - and somehow use SE firmware to set a fuse on the number of PIN tries. I don't know specifically how Apple does this, but the list of secure/viable approaches is short. (edit: unnecessary if they shred hsm keys.) I don't doubt Apple's integrity on this, given the heat they have taken over it in the west. But an "adaptation" of their infrastructure to serve that regional market wouldn't surprise me either. I'm skeptical of any scheme, and one that isn't presented in BAN logic tends to mean protocol designers have handwaved over where they are hiding things. Good examples of this notation are here. (http://www.lsv.fr/Software/spore/table.html http://www.lsv.fr/Software/spore/table.html). If they have weakened the scheme, the technical ways Apple may have conceded to Chinese requirements, are all discoverable. Breakable? I doubt that's viable given the security difference is an HSM with shredded keys vs. one where the keys still exist somewhere (probably in a duplicate HSM that operates the decryption service for Chinese govt). So still at least as good as any EMV payment system. We can speculate about how this is implemented but reality is tech companies while ubiquitous, are not sovereign. Yet, anyway.

215 points by auslander 9y ago

Quick question: if a user is under camera based surveillance and they type in their PIN, does that allow someone holding their data to decrypt it? Because apparently China is putting cameras everywhere, and it stands to reason they could have a module that monitors for PIN entry and records it. Even at my workplace in the US I try to avoid entering my PIN near security cameras.

lathiat 9y ago
The answer to this used to be no, but iOS 11 made a number of changes that I don't fully understand yet; I think the answer is still no unless you have the device then you may be able to get an iCloud reset token.. but don't take my word for it. (at that point they already have your device though eh?) As a side note I think people vastly underestimate how easy it is to capture you typing your password on a phone screen.. especially when you put it in the context of complaining about minor security implications of TouchID or FaceID. I would suggest it's typically much easier to watch you typing a password than to clone your TouchID .
- spacehome 9y ago
  In the US, though, TouchID and FaceID are liabilities because the police can compel you to provide your fingerprint and face.
  - extrapickles 9y ago
    There are some protections against exactly this. If its been more than 48hrs since you last unlocked the phone or you turned off the phone, it will require your password again.
    - Trundle 9y ago
      Or just use the wrong finger a couple of times.
    - fiatpandas 9y ago
      You can also discretely disable Face ID by holding down power and a volume button.
      - akarambir 9y ago
        I am curious if android has the ability to quickly disable fingerprint unlock if you are in adversarial situation. So it only asks for passcode.
        EwanToo 9y ago
        If you reboot the phone then it’ll only accept the PIN to unlock, at least on newer versions.
- auslander 9y ago
  Snowden hides under towel to type passwords :)) https://youtu.be/4EgTXEn15ls?t=37m31s https://youtu.be/4EgTXEn15ls?t=37m31s
  - jacquesm 9y ago
    I could not help but notice the dissonance between Laura Poitras arriving at 'Newark Liberty International Airport' and how she was treated there. For small values of Liberty I guess. It's simply harassment, the kind that I would have expected in former Eastern Germany, Poland, Russia or any other state like that.
    - mindslight 9y ago
      Furthermore, clicking the above link actually displays a message saying the video is not available for viewing in the US...
      - jacquesm 9y ago
        That's odd, it works for me.
        mindslight 9y ago
        Sorry. I edited to add that it's based on country - information control (and its associated ambiguity) being another quality of totalitarianism.
        deleted 9y ago
        [deleted]
        lern_too_spel 9y ago
        It clearly says it's blocked by the Weinstein Company, who owns the US rights.
        9y ago
fiatpandas 9y ago
Was curious about this as well. It would be a huge oversight if the encrypted blobs could be decrypted with a 4 - 6 digit pin. Couldn’t it be brute forced? My amateur understanding is the pin unlocks a hardware “safe” on the device which contains the actual decryption key, requiring physicAl access to the device even if the pin was caught on security cam.
ssdd 9y ago
Your concern is unnecessary. Real issue is that PIN lock is not secure enough in first place. Even if Chinese or US government doesn't have the PIN they can still decrypt a phone given the abundance of computing power they posses.
Yizahi 9y ago
According to this (1) since iOS 11 update PIN code is now a single point of failure, if know PIN and have access to device (or probably Apple made data dump on Chinese servers) you can have everything. (1) https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-rise-and-fall-of-ios-security/ https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-r...

bradenb 9y ago

Maybe I'm off-base, but I feel like at this point the question of "who can see my data if it's stored in China?" is a bit silly. I--for one--will just always assume that any data stored in China might as well be public.

puzzle 9y ago
Well, not public, but eventually accessible by those holding the guns and running the prisons. Which is still not great.
- tluyben2 9y ago
  I get into many discussions like this; not sure where you are from but educated Americans I talk to do not accept their data being read by anyone except the gov in cases of terrorism. That means, in practice, the gov can read your data. What is the difference in China? Do you want all data or no data or some data and how is some data defined exactly? If this is not black and white the definitions are going to be painful and biased and how to enforce proper use?
  - mattnewton 9y ago
    Many Americans (but probably not the majority) don’t accept that their data is going to be read in cases of terrorism. It’s why Apple refused to backdoor their phone for the government in a case of terrorism. Narrow warrants granted by a seperate branch of government in broad daylight is very different from this. And it’s why we need to fight to restore that norm in America. I don’t buy that terrorism is such an exceptional case that we ought to bend due process out of shape.
    - Feniks 9y ago
      What little protection remains is a relic of the seventies. An interesting time in America. A time of strong resentment against the government after Vietnam and Nixon. There was a really powerful TRUE left wing in Washinton that had power. Ofcourse even back then they never extended FISA to non US citizens. Nobody legislates the CIA.

natch 9y ago

What I want to know is if I send an iMessage to someone who is, unbeknownst to me, living in or visiting China, does that mean my private information is now going to be shared with the Chinese government without my knowledge? I get that we have “no” or very little privacy now. But I’m wondering if Apple is making it clear to users in the US that their private messages may be siphoned off and exploited by governments of countries they have never been to.

dfee 9y ago
Well, which is it? Do you want to know the answer to your question, or do you already have the answer as suggested by your claim?
- natch 9y ago
  Well there's a contradiction. On the one hand, if I send a message to China (including unknowingly) it sounds like it would end up as part of a conversation stored on servers in China. On the other hand, Apple has a reputation as a company that cares about and protects user privacy. There's a contradiction, is all I know.
stevefeinstein 9y ago
Top of article: > Beginning on February 28th, all users who have specified China as their country/region will have their iCloud data transferred to the GCBD cloud services operator in Guizhou, China. So living, most likely yes. Visiting then presumably no. But who really knows?
- natch 9y ago
  I'm not wondering about those people, though. I'm wondering about the people who correspond with them.

threeseed 9y ago

Something that doesn't get enough attention. iCloud Keychain stores the passwords, SSH keys, client side certificates etc for third party sites. That means that sites like Facebook, Google etc would be compromised on the biggest scale in history if Apple were to hand over encryption keys to the Chinese government. Not to mention the national security implications e.g. my work VPN credentials are in iCloud Keychain. There is no way Apple would be stupid enough to allow this situation to persist without informing users unless they maintained the keys and it was a moot point. Otherwise they are inviting themselves up for all sorts of legal issues. Not to mention people who travel to China for holiday/work purposes.

AceJohnny2 9y ago
> Not to mention people who travel to China for holiday/work purposes. Like a lot of Apple employees themselves, considering so much of the manufacturing is there. I would love to be a fly on the wall of their infosec team.
- threeseed 9y ago
  Exactly. And I worked at Apple and it's not like we were given special phones with enhanced security. It's just a standard VPN to log on to internal sites. And of course the problem with keychains like this is that surely amongst one of your previous accounts is the password you used for your VPN and/or work email.
  - puzzle 9y ago
    Interesting. Google treated remote access from China or employees based in China differently even before Aurora: http://fortune.com/2011/04/15/inside-googles-china-misfortune/ http://fortune.com/2011/04/15/inside-googles-china-misfortun... Maybe in ten years or more someone (Farris?) will describe the details behind the scenes about the cat-and-mouse, the unexplained outages, etc.
    - elefanten 9y ago

IBM 9y ago

Apple's statements to the press about this have repeatedly said [1]: >Apple has strong data privacy and security protections in place and no backdoors will be created into any of our systems. iMessage is end-to-end encrypted and has never been blocked in China, while services like WhatsApp are [2]. During the FBI brouhaha, the national security establishment water holders started writing op-eds on blogs like Lawfare suggesting that Apple was being hypocritical in opposing the FBI, alleging that they had already given the jewels away to China [3]. The DoJ basically parroted this in their filings to the court, accusing Apple of this outright (whether or not the op-eds were co-ordinated with the DoJ is unclear). Fortunately, this led to Apple responding to these accusations in their own filings to the court [4], including this declaration from Craig Federighi under threat of perjury [5]: >5. Apple uses the same security protocols everywhere in the world. >6. Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device. >7. It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. >I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Assuming Craig Federighi didn't perjure himself, why has China seemingly made an exception for Apple when it comes to iMessage (or iOS or iCloud)? The answer is that Apple is the only tech company that actually has leverage with the CPC in (indirectly) employing millions of workers in China. People have criticized Apple for taking down the NYT's app or VPN apps in the App Store in China and for not resisting it, but Apple is rightly picking their battles to protect the crown jewels. [1] https://9to5mac.com/2018/01/10/apple-will-begin-storing-chinese-customer-icloud-data-at-new-china-data-center-from-next-month/ https://9to5mac.com/2018/01/10/apple-will-begin-storing-chin... [2] https://www.nytimes.com/2017/09/25/business/china-whatsapp-blocked.html https://www.nytimes.com/2017/09/25/business/china-whatsapp-b... [3] https://www.lawfareblog.com/deposing-tim-cook https://www.lawfareblog.com/deposing-tim-cook [4] https://assets.documentcloud.org/documents/2762131/C-D-Cal-16-Cm-00010-Dckt-000177-000-Filed-2016.pdf https://assets.documentcloud.org/documents/2762131/C-D-Cal-1... [5] https://www.documentcloud.org/documents/2762118-Federighi-Decl-Executed.html#document/p1 https://www.documentcloud.org/documents/2762118-Federighi-De...

xoa 9y ago

I think the core issue uniting all of these recent concerns about Apple and China (or any other country) is how critical structural incentives and capabilities are when it comes to individual free, privacy, and security, and in turn the fundamental danger of centralization. I've seen a lot of criticism towards companies for "folding" to oppressive regimes or orders, comparisons to people or organizations being party to atrocities in the past, etc., but I think those often miss the point. It is generally unreasonable to expect companies to directly oppose powerful governments. By design they are not in fact governments themselves, mostly for better (though maybe rarely for worse). Conflicting laws and norms between sovereign polities can be directly opposed, and there is rarely a bright line for "worth giving up everything for." In general, I don't think it's that fruitful to expect humans not to be humans. So it's a lot better if they just plain don't have the power (or at least not total power) in the first place. It's just like in infosec in general: the most secure information is the information that you don't ever have, you cannot be hacked for it or leak it. That's the only surefire way to avoid not merely abuse but even pressure for abuse, and it's here that I think Apple has made a big blunder even vs the rest of the tech industry. Yes the cloud is a big deal nowadays, but Apple's business model is uniquely well suited to supporting full non-cloud distributed usage models in addition as a differentiator from where so many other offerings have gone. It's fine if Apple has their own iCloud and App Store as the core principle source, but if they simply gave individual users and organizations the full and ungated ability to replicate that (in features if not breadth) locally then Apple could simply wash their hands of some of this without hassle (it could even let them get pickier elsewhere since there'd be a separate release valve). Apple used to be great at this too, back in OS X 10.5/10.6 at least Mac OS X Server had a lot of interesting potential. Easy full mirrors of Software Update, Network Homes and NetBoot/NetInstall were awesome, etc. It's not hard to imagine them having gone further that route, and it's too bad they've kind of half-assed gone the other way despite being weaker at network services then their competitors anyway. Legislatively from an American perspective this would also be the right way to try to fight back against authoritarian regimes: require American tech companies by law to offer decentralized options for owners of devices, like side-loading. If that's available then it would make the job of authoritarians significantly more challenging.

stevefeinstein 9y ago

Apple would have us believe that they're the privacy company. They're doing a good job with that marketing message. But what's more secure? How do Google, and Amazon compare? Do I have to run my own servers? Do I have not run servers? Do I have to keep a hardened device on my person at all time? What about backups?

deleted 9y ago

[deleted]

John_KZ 9y ago

The Chinese government is right to require all of it's citizens data to be stored in domestic datacenters. The danger of the Chinese government accessing your data is 1) Non-existent if you didn't declare you're Chinese 2) Not any different than the danger of the US government accessing your data By the way, since so many of you feel so strongly about your data being stored abroad, don't you think the Chinese should feel the same? Why should they trust their data to a foreign government?

abtinf 9y ago
> The Chinese government is right to require all of it's citizens data to be stored in domestic datacenters. "The only proper purpose of a government is to protect man’s rights, which means: to protect him from physical violence. A proper government is only a policeman, acting as an agent of man’s self-defense, and, as such, may resort to force only against those who start the use of force. The only proper functions of a government are: the police, to protect you from criminals; the army, to protect you from foreign invaders; and the courts, to protect your property and contracts from breach or fraud by others, to settle disputes by rational rules, according to objective law. But a government that initiates the employment of force against men who had forced no one, the employment of armed compulsion against disarmed victims, is a nightmare infernal machine designed to annihilate morality: such a government reverses its only moral purpose and switches from the role of protector to the role of man’s deadliest enemy, from the role of policeman to the role of a criminal vested with the right to the wielding of violence against victims deprived of the right of self-defense. Such a government substitutes for morality the following rule of social conduct: you may do whatever you please to your neighbor, provided your gang is bigger than his." - from "For the New Intellectual" https://www.amazon.com/New-Intellectual-Philosophy-Anniversary-Signet/dp/0451163087 https://www.amazon.com/New-Intellectual-Philosophy-Anniversa...
- Nomentatus 9y ago
  No sewers? I like sewers.
wmf 9y ago
Some people take the position that it's better for the US government to have access to Chinese people's data than for the Chinese government to have access their data because the US government is better (e.g. more due process).

omeid2 9y ago

Y in X: who holds the keys? The alphabet agencies in X. Where Y is any corporation, and X any nation. At this point, I believe any assumption otherwise is naive.

abalone 9y ago

> Where Apple provides overwhelming detail about their best security systems (file encryption, iOS, iMessage), they provide distressingly little technical detail about the weaker links like iCloud encryption. Sounds like the author missed Apple's BlackHat 2016 talk. It goes into lots of technical detail on Cloud Key Vault.[1] Well worth watching -- and a very cool implementation of a secure backup system designed for "adversarial clouds". It's pretty cool how it retains end-to-end encryption of your keychain while also backing it up to untrusted clouds. Basically it employs Hardware Security Modules that limit recovery attempts to 10 tries before destroying the data, thus protecting against backend brute forcing and allowing you to use your relatively weak device passcode to encrypt the backup. And here's the kicker -- they put the HSM firmware signing keys in a blender so even an adversarial government can't force them to modify them. Update: I guess he did watch the video (he previously wrote a whole post on it). So I'm not sure what he thinks is missing, or maybe I misunderstood and he's only complaining about non-keychain data encryption. [1] https://www.youtube.com/watch?v=BLGFriOKz6U&feature=youtu.be&t=25m43s https://www.youtube.com/watch?v=BLGFriOKz6U&feature=youtu.be...

JoachimSchipper 9y ago
The author, in fact, has specifically written an article on the talk you mention: https://blog.cryptographyengineering.com/2016/08/13/is-apples-cloud-key-vault-crypto/ https://blog.cryptographyengineering.com/2016/08/13/is-apple.... Matthew Green is a capable cryptographer who engages with the wider security community and practical encryption a lot (e.g. https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-apple-imessage/); https://blog.cryptographyengineering.com/2016/03/21/attack-o... if you're interested in this kind of thing, I'd recommend following him more closely (e.g. on Twitter.)
Buge 9y ago
This is covered in the blog post: >With one major exception — iCloud Keychain, which I’ll discuss below — iCloud fails the mud puddle test. That’s because most Apple files are not end-to-end encrypted. The blog post is saying that iCloud backups are not protect from Apple, except keychain backups. So your files, messages, etc are not protected from Apple. And the video you posted seems to only be about keychain backups.

Cw67NTN8F 9y ago

So if China demands the key, Apple will pull out of China? https://www.cnbc.com/2017/11/02/apple-china-revenue-up.html https://www.cnbc.com/2017/11/02/apple-china-revenue-up.html ~$10 Billion last quarter of 2017

juanmirocks 9y ago

Call me a cynic, but I bet China has it all. One way or another.

motohagiography 9y ago

I interpret that there is an implication in what is described in the article that, when you set the region on your apple device, you get region specific iCloud keys provisioned to it. If that were the case, there is no reason why you couldn't provision from to an HSM domain that hadn't had its keys shredded. The implied architecture is there is a secure element on the phone with a unique key provisioned to it during manufacture - likely one that is derived from one of the HSM keys at Apple. However, since Apple cannot produce this individual device key themselves to do 3rd party device decryption, they must generate keys randomly in SE hardware on the device, using the user PIN as a derivation component - and somehow use SE firmware to set a fuse on the number of PIN tries. I don't know specifically how Apple does this, but the list of secure/viable approaches is short. (edit: unnecessary if they shred hsm keys.) I don't doubt Apple's integrity on this, given the heat they have taken over it in the west. But an "adaptation" of their infrastructure to serve that regional market wouldn't surprise me either. I'm skeptical of any scheme, and one that isn't presented in BAN logic tends to mean protocol designers have handwaved over where they are hiding things. Good examples of this notation are here. (http://www.lsv.fr/Software/spore/table.html http://www.lsv.fr/Software/spore/table.html). If they have weakened the scheme, the technical ways Apple may have conceded to Chinese requirements, are all discoverable. Breakable? I doubt that's viable given the security difference is an HSM with shredded keys vs. one where the keys still exist somewhere (probably in a duplicate HSM that operates the decryption service for Chinese govt). So still at least as good as any EMV payment system. We can speculate about how this is implemented but reality is tech companies while ubiquitous, are not sovereign. Yet, anyway.