5 ms·
Source? iMessage is E2E encrypted so no, Apple did not share that part (or other encrypted data like keychain). They’ve actually gone pretty far in protecting t
by abalone 8y ago
Source? iMessage is E2E encrypted so no, Apple did not share that part (or other encrypted data like keychain). They’ve actually gone pretty far in protecting their E2E encryption from adversarial clouds.
- bduerst 8y agoAdded sources. Apple moved the keys for accessing the data at rest to Chinese servers, which were nationalized by the Chinese government. The Chinese government has access to the users' data at rest and the keys to decrypt it.
- celeritascelery 8y agoI think you are misunderstanding. Apple moved Chinese iClouds to Chinese firms. So yes, Chinese iCloud users in China will be under the full surveillance of the government. Which they always have been. But that has no impact on anyone outside of China. Dragonfly is a censored search engine, not a user data base.
- bduerst 8y agoThe Chinese firms were nationalized by the government in July, giving full access. This isn't generic surveillance but complete ownership. First source listed in my original comment. Dragonfly was complying with China's firewall, because clicking broken links in search results sucks, but it was also linking every search query to the users phone number and sharing with the Chinese government, which is what Google employees revolted over.
- abalone 8y agoThis does not affect E2E encrypted data like iMessage. Apple doesn’t have those keys to give.[1] [1] https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide....
- bduerst 8y agoYour messages are stored on iCloud, right?
- tylerl 8y agoBut since key management is out of your control or visibility, Apple can just add another key to your account on behalf of the government. They don't have to disclose the existing keys on your device. This gets them the messages going forward but not the ones from the past. So they'd have to do this for all Chinese customers ahead of time, rather than as a response to an inquiry.
- abalone 8y agoAnything's possible if the vendor secretly collaborates with a government to insert vulnerabilities and lies about it. But what we're talking about here is, given the way Apple has publicly declared how the system works[1], what can a government do with full server access. Apple states "All of the user’s registered devices display an alert message when a new device, phone number, or email address is added." So no, it's not correct to say key management is out of your visibility. [1] https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide....