12 ms·
Apple moves to store iCloud keys in China, raising human rights fears
- walterbell 9y agoReminder: iCloud is entirely optional, even if Apple device provisoning UX uses dark patterns to hide the difference between App Store account (mandatory) and iCloud account (optional). For E2E messaging, you can use Wire which works even on iPads or iPod touch that does not have a phone number. Create an email-only account from a desktop PC at http://app.wire.com http://app.wire.com, then use that to sign into mobile device.
- greggarious 9y agoStuff like this is why I backup to an encrypted USB drive.
- tcd 9y agoSo don't store data in iCloud? It's perfectly possible to perform your own encryption and hold the private key yourself.
- nixpulvis 9y agoBut they won't...
- techrede 9y agoSure, many users in China can use other services, but it seems to be a no win situation for most people. Unless you’re technically sophisticated, you’re unlikely to pursue alternatives which provide a greater degree of security and require a bit of technical know how. At best you can say that Chinese users will likely be no worse off using iCloud than they would using any other China-based service. Unfortunately that is no consolation for anyone who might have sensitive data.
- pmlnr 9y ago> Unless you’re technically sophisticated, you’re unlikely to pursue alternatives which provide a greater degree of security and require a bit of technical know how. I'm completely pro-privacy, but I need to ask: why would ordinary people's ordinary data need better security? Even if iCloud might be decrypted by the government. If it's data like bills, government issued photos of ID cards, family photos, it will most likely won't matter at all and the security is good enough, just like anything available. Once you do have a reason to encrypt something, learning GPG, LUKS, etc. is not that hard or that technical.
- blfr 9y agoLUKS, maybe. Although it lacks deniability. GPG, however, has proven to be virtually impossible to properly use and almost no one does, even in the hacker crowd.
- saagarjha 9y agoAlmost everyone does something that can be construed as being illegal. By allowing unfettered access to private information, this makes it much easier for laws to be selectively enforced in ways that benefit the government.
- techrede 9y ago> Almost everyone does something that can be construed as being illegal. By allowing unfettered access to private information, this makes it much easier for laws to be selectively enforced in ways that benefit the government. Exactly. It could be something as simple as guilt by association. Even though you might not have done anything illegal yourself, you may have the contact information of someone who is on a watchlist or has been convicted of a crime. For example, China is looking into developing a social credit rating system, any association an individual has to persons who the government consider less reputable could have real impacts on their credit rating.
- abalone 9y ago> At best you can say that Chinese users will likely be no worse off using iCloud You can say better than that. iCloud is more secure than your average service (especially in China). It end to end encrypts the most sensitive data (keychain) for example, and iMessage has managed to stay alive so far.
- mtgx 9y agoAs usual with all privacy issues, most people aren't aware of what's happening behind the scenes, and companies usually don't have any incentive to be transparent about it. It would be nice if Apple gave all of its Chinese iPhone users a nice big prompt that told them their iCloud/iMessage backups can be accessed by the Chinese government from that point forward, and maybe even tell them how they can disable it in the settings if they want to. It's the least Apple could do.
- echevil 9y agoWell my iCloud account in China did receive a long email from Apple before this happens, saying that they will move their iCloud servers to China, and what can be done if you do not want your data to be moved. I think they've done enough.
- gruez 9y ago>When Apple Inc begins hosting Chinese users’ iCloud accounts in a new Chinese data center 1. get vpn 2. create US icloud account 3. ??? 4. profit?
- b1ackb0x 9y agoit's not so easy without US credit/debit card
- 4ad 9y agoYou don't need a credit card to create a US Apple account, and you don't need a VPN either. I don't live in China, I live in Europe, but I have a US account because everything is better about Apple US accounts. You can use it for free (you get 5GB of iCloud space, IIRC), but to be able to pay for services I buy US iTunes gift cards from ebay (mark-up about 1%). I can pay all Apple services with this, including iCloud storage and apps and music and movies. It's a hassle, but it's totally worth it for me.
- seanmcdirmid 9y agoI would just stock up on USA iTune gift cards when I lacked a US credit card. Its not hard really, the real problem are Chinese apps that you might need for your day to day life (e.g. the dedicated Didi dache app if you didn't want to go native and use WeChat). Even then, Apple seems to let you change your app store easily, you can even have apps from both the US and Chinese app stores on your phone (or at least, that was true a couple of years ago).
- saagarjha 9y agoVPNs are becoming increasingly hard to acquire in China.
- Markoff 9y agoit's not problem to acquire but to find running one reliably
- supergirl 9y agoBecause if they would continue to store them in US then all would be well. They are perfectly safe in the US...
- WillPostForFood 9y agoIf you are a Chinese activist, then yes, of course you are better off with the keys anywhere outside China.
- supergirl 9y agowhat about American activists? why nobody worries about them?
- klodolph 9y agoWe do worry about American activists, but the legal system is different here and Americans can easily use services hosted outside the US. Chinese users cannot easily use services hosted outside China.
- supergirl 9y ago> Americans can easily use services hosted outside the US. Chinese users cannot easily use services hosted outside China. Services hosted outside the US by companies with presence in the US fall under Patriot Act which means US can spy on them any time without warrant, but ianal. Even if the company has no presence in the US, there are only a handful of countries that would not bend over to hand data to US. That's why US doesn't need to block access to anything while China has to.
- elefanten 9y agoOk but you're still ignoring the basic fact that activists and even criminals in liberal democracies have legal and human rights. In China, you have no guarantees and no recourse. Torture, forced confession and retaliation against your family are all on the table. That's why no one worries about US activists the same way they do about Chinese ones.
- vtange 9y agoRelated, earlier thread: https://news.ycombinator.com/item?id=16449326 https://news.ycombinator.com/item?id=16449326
- abalone 9y agoTo Apple's credit there are still significant parts of their platform that remain end-to-end encrypted even in China -- meaning that Apple or any other cloud operator can't read because they don't have the keys, notably:[1] - iMessage - Keychain - Siri data And more like health, home & payments. While it's unfortunate that Apple couldn't compel China to run their government requests for data through the U.S. court system, in my view it is pretty amazing that they are "getting away" with keeping the most sensitive data end-to-end encrypted. I mean China shut down WhatsApp last year and iMessage is of a similar level of security.[2] Then again nobody really uses iMessage in China. They do use keychain. [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 [2] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- mtgx 9y agoTo Apple's non-credit, it's still tying iMessage backups to iCloud backups despite years of criticism over this. That means everyone who uses iCloud backups (enabled by default on iPhones) don't actually benefit from iMessage's "end-to-end encryption" (which isn't that safe against sophisticated hackers or oppressive authorities to begin with). I'd say people may as well forget about Apple's "privacy stance". It's nothing but smokescreen at this point (yes, even in the U.S.).
- abalone 9y ago> iMessage's "end-to-end encryption" (which isn't that safe against sophisticated hackers or oppressive authorities to begin with) Could you support this claim please? Re: iCloud backups you're correct. So far. They're about to release iMessages-in-iCloud though, which might obviate the need to include them in iCloud backups.
- vengefulduck 9y agoiMessage uses short RSA 1280-bit keys which could be cracked by a well funded attacker. [1]https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- echevil 9y agoSpeaking as a Chinese citizen, I'd say most people already use local apps/services for almost everything, so having Apple moving servers to China won't practically have any impact on "privacy" or "human rights concerns", at least to vast majority of the population. I really appreciate that Apple is finally moving their servers to China as downloading apps and updates from App Store has been painfully slow. iPhone has lost quite some market shares to local brands like Huawei, Xiaomi in the past few years, and more people are feeling local brands knows what people needs better. Having a faster service might actually help bringing back some market share.
- tonylinn80 9y agoTotally agree! I would have already switched if I hadn't bought so many iOS apps.
- seanmcdirmid 9y agoAs of December 2017, iOS had around 19.7% of China's mobile web browsing market. That is unexpectedly huge, is there a large enough middle class to support that many iPhones? https://www.statista.com/statistics/262176/market-share-held-by-mobile-operating-systems-in-china/ https://www.statista.com/statistics/262176/market-share-held... Sales in China have been expanding, though it goes up and down with new iPhone releases: https://www.forbes.com/sites/chuckjones/2018/01/13/apples-new-iphone-8-and-x-are-getting-chinese-android-users-to-defect/#3213bf6b4b98 https://www.forbes.com/sites/chuckjones/2018/01/13/apples-ne... Samsung has absolutely gotten killed in China recently, but I don't think Apple has.
- echevil 9y agoIt’s not killed for sure, but it used to have bigger market share
- seanmcdirmid 9y agoNot according to the forbes article, but that is indicating sales in quarter rather than overall marketshare (Apple sold more phones than Xiaomi in Q4 17, see https://techcrunch.com/2018/01/25/chinas-smartphone-market-is-no-longer-growing/ https://techcrunch.com/2018/01/25/chinas-smartphone-market-i...). Apple is not doing poorly in China by any economic measure, but ya they don't sell many $200 Xiaomi/Huawei phones. I'm sure that Apple wins consistently based on phone sales revenue, even if they trail in total units sold.
- tonylinn80 9y agoWell, I do live in China and I don't see anyone feeling any fear about this... Seriously, you can easily turn off keychain if you don't trust a cloud service to store all your passwords. And if i decide to use such a service, I'd certainly trust a local company much more than Apple or anything of US origin.
- abalone 9y agoTo be clear, keychain is end to end encrypted including the Cloud Key Vault that backs it up to potentially adversarial clouds. Not true for other iCloud data but your passwords are probably safe.
- tonylinn80 9y agoYeah, other iCloud services are just widely unpopular in China, they're basically irrelevant. Need to store photos? Baidu disk and tons of other services provide much larger space with no cost, and much more affordable paid version. Wallet? almost everyone in China uses Wechat pay or Alipay now. Even App Store supports Alipay for purchasing apps. Maybe they can steal my contacts? If so, they would have all my Wechat and QQ contacts already, maybe even all the messages. While I do like more privacy, but it's basically at the bottom of my list of concerns. People mention "Chinese activists", well, almost all of them don't even live in China. Rest assured their lives are not impacted as well
- seanmcdirmid 9y agoThere are many foreigners who live in China that are concerned about this. However, it is easy to get out of it just by setting your app store home to a country other than China.
- cromwellian 9y agoHave you ever been to Xinjiang? A Uighur friend of mine is a tour guide there and he has to communicate with foreigners via email. He specifically uses foreign hosted mail and continually deletes his email and local cache and is paranoid about it. You won't care about privacy until you've been on the receiving end of government interference in your life.
- saagarjha 9y agoI’m disappointed that all this hoopla was completely avoidable: all Apple would have to do is end-to-end encrypt everything, and this wouldn’t even be an issue: they’d be no keys to hand over. Instead, by keeping the keys, they’ve basically opened themselves up to requests like these that they really have no choice but to abide by.
- api 9y agoThis is why I always disable such things. Other vendors are mostly worse.
- strin 9y agoMany U.S. businesses never survived local competition in China. Kudos for Apple to stay in business and remain a significant share of the Chinese cell phone market.
- chrischen 9y agoThe alternative is to have the iCloud keys stores in the US. Do you trust the US government? China definitely doesn’t.
- ttflee 9y agoMy fear of future is way above this. Apple and other mobile OS all incorporated so called Mobile Device Management features into their cores. With one or a few payloads pushed to your device, it could do fairly lot from install an app remotely to wipe it out (like find-my-iPhone). I wonder what would be the case if China gov't asks. It could just be a small step forward in the whole Salami tactics. EDIT: Of course, for now, it requires enrollment of the device to a legitimate MDM server, but what will happen tomorrow? https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html https://developer.apple.com/library/content/documentation/Mi...
- hotz 9y agoApple is great at lecturing us about how bad the Trump administration is. But when the Chinese say jump, Apple asks how high...
- jacksmith21006 9y agoPretty interesting to compare to what Google did in China. Google noticed the China government trying to hack in to Gmail accounts and said enough is enough. Versus Apple handed the keys to the China government.