4 ms·

Apple has done its best to secure customer privacy not only from bad actors and the government, but even from Apple itself, something that is certainly not true

Apple has done its best to secure customer privacy not only from bad actors and the government, but even from Apple itself, something that is certainly not true of Google. Apple went to the mat to protect its customers from the FBI. That earns ️<3 from me. Do I think Google would look out for me like that? Hahah, no, I do not think so. Does this mean these vulnerabilities were not real and serious? Not at all. But Apple took them seriously and reacted quickly. Nobody's perfect, but they deserve a lot of credit for their hard work on security.

shazow 7y ago
> Do I think Google would look out for me like that? Hahah, no, I do not think so. This article is literally about things that Google's Project Zero did which were for your benefit.
- throwaway2048 7y ago
  Project Zero is no charity.
- thothamon 7y ago
  I appreciate the good things Google does for me; they are many. But I don't think protecting my privacy, much less securing my data even from themselves, is their priority.
  - mda 7y ago
    Funnily, I don't think there is any other company that protects users private data better than Google. Not military, not Apple, none of them come closer to it.
    - TazeTSchnitzel 7y ago
      Google are good at preventing people hacking their servers, but they also broadcast your private data to thousands of third parties every time you open a webpage. Facebook and Google's approach to data security is lock it down so only they and their partners can access it. It does nothing for your privacy.
      - plexicle 7y ago
        What are you talking about? Google neither sends nor sells any of your data to "third parties". I don't know why people parrot this nonsense.
        TazeTSchnitzel 7y ago
        It's not nonsense, it's a standard part of adtech: https://brave.com/adtech-data-breach-complaint/ https://brave.com/adtech-data-breach-complaint/
        lern_too_spel 7y ago
        Google gave an ID to these third parties. iOS does the same with its IDFA.
        TazeTSchnitzel 7y ago
        Far from just an ID.
        lern_too_spel 7y ago
        Then what?
imchillyb 7y ago
Oh, google goes to the mat alright. They're just in a different, uh, position. Speaking of positions... this is how I picture Google's relationship with the US Federal Government: https://youtu.be/pSIEKcq32WY?t=16 https://youtu.be/pSIEKcq32WY?t=16 !!! Definitely NSFW !!!
kllrnohj 7y ago
> Apple went to the mat to protect its customers from the FBI. That earns ️<3 from me. Do I think Google would look out for me like that? Hahah, no, I do not think so. Google literally led the charge on pushing back & publishing government data requests and Google is almost entirely why it's legal to disclose ranges of FISA and NSL requests in the first place. They've been doing transparency reports on this for years, far longer than Apple. There's a lot you can complain about with Google. But this isn't one of them.
- bilbo0s 7y ago
  No dog in this race really, I'm pretty much against all of big tech on privacy grounds. That said, I have to say that from my perspective, it seems pretty clear that Apple is light years ahead of Google where privacy and security are concerned. I try never to even touch Google properties or products, because it's tantamount to making whatever information you provide to that service public. That's kind of how I think about it. Everything I put into google maps, google apps, gmail, whatever, will be open for the entire world to see at some point. Either a leak by google, or google shares with someone who gets hacked, or maybe through a court case where stuff from 10 years ago pops up in court records or whatever. I mean, if that doesn't happen, great. If it does though, no biggie, I behaved as if it would happen from day one. Of all the dangerous big tech companies out there, Google and Facebook are, to my mind, unquestionably the most dangerous. And by far the biggest threats to the privacy and security of the average person.
  - kllrnohj 7y ago
    > Apple is light years ahead of Google where privacy and security are concerned. Privacy I'd agree, but security? Apple's security track record is straight up hot garbage. Their cloud security is a complete joke (iCloud has been hacked how many times now?). Google's cloud security meanwhile has a stellar record. Outside of cloud yeah Apple has lots of security buzzwords, but they still are repeatedly hacked. We are, after all, talking about a post where 5 different 0-days were actively exploited on iOS. And just about every release of iOS has had critical escalation vulnerabilities (aka, jailbreaks) - such as the CoreTrust bypass exploit in iOS 12 ( https://gist.github.com/pwn20wndstuff/a57b213a6f8c75cb3b9a8c6002ae5756 https://gist.github.com/pwn20wndstuff/a57b213a6f8c75cb3b9a8c... ) Android has an update problem, but between all the hardening that's been done there (such as extensive selinux policies) it's pretty fucking solid, and is backing that up with results.
ben1040 7y ago
>Apple went to the mat to protect its customers from the FBI. That earns ️<3 from me. Do I think Google would look out for me like that? Hahah, no, I do not think so. They implemented countermeasures on their devices to prevent the exact situation where the FBI would compel them to produce a signed, backdoored, firmware like they wanted Apple to do after San Bernadino. https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html https://android-developers.googleblog.com/2018/05/insider-at... Unless you have the device's passcode, you can't update the firmware that deals with passcode checking, unless you wipe the data.
- thothamon 7y ago
  If this works as described and there are no tricks (such as Google changing your account password from their servers to a known password and then logging in), then that is a great step in the right direction. A very important next step would be to make this a required feature for all handset developers who wish to use Google services such as the Play Store. As long as it's a niche feature only used on the Pixel, it's more of a good gesture than a substantive benefit for users.
lern_too_spel 7y ago
> Apple has done its best to secure customer privacy not only from bad actors and the government Apple's marketing people would like you to believe that. In actual fact, only Apple has handed over the data of its iCloud and iMessage users wholesale to the Chinese government. Not Facebook. Not Google. https://www.amnesty.org/en/latest/news/2018/03/apple-privacy-betrayal-for-chinese-icloud-users/ https://www.amnesty.org/en/latest/news/2018/03/apple-privacy... > Do I think Google would look out for me like that? Google has done this repeatedly according to its transparency reports. The only difference is that Apple lied to its customers that it was "not technically feasible" to comply with data requests and then silently removed that claim after the FBI showed that to be false. https://slate.com/technology/2014/09/if-you-use-a-passcode-in-ios-8-apple-won-t-be-able-to-give-your-personal-data-to-law-enforcement.amp https://slate.com/technology/2014/09/if-you-use-a-passcode-i... If you want more lies that magically disappear, Apple is more than happy to comply. More recently, Tim Cook posted, “We have also never allowed access to our servers. “And we never will.” That's gone too after the China collaboration, with "our servers" replaced by "Apple servers." Maybe technically the servers that Apple set up in China are not "Apple servers" and instead Guizhou servers, but that is not a useful distinction to the users whose data is now freely accessible by the CPC, and so Apple deceives its users with a wording change without any announcement of policy change or any apologies. https://www.sfchronicle.com/news/article/Battle-with-FBI-reveals-possible-loophole-in-6866918.php https://www.sfchronicle.com/news/article/Battle-with-FBI-rev...
kvartz 7y ago
Apple will and did surrender iCloud data to LE, so would Google. they denied unlocking the device or implementing backdoor in the future, which I believe is not feature any other vendors have implemented. And let's not forget that the device apple was so eager to protect belonged to already dead terrorist, as far as average user is concerned that was a PR stunt.
- dpkonofa 7y ago
  Apple wasn't eager to protect the device of a terrorist. They were eager to protect everyone's devices. Opening up access to "the terrorist's" device would open up that access to every device. I, personally, think they made absolutely the right call.
dammitfoo 7y ago
> Apple has done its best to secure customer privacy... That earns ️<3 from me. Do I think Google would look out for me like that? Hahah, no, I do not think so. Both Apple and Google are NSA's PRISM partners, Hahah. It's amazing how short some people's memories are.
- lern_too_spel 7y ago
  Apple and Google had no interaction with PRISM. Read the slides.

shazow 7y ago

> Do I think Google would look out for me like that? Hahah, no, I do not think so. This article is literally about things that Google's Project Zero did which were for your benefit.

throwaway2048 7y ago
Project Zero is no charity.
thothamon 7y ago
I appreciate the good things Google does for me; they are many. But I don't think protecting my privacy, much less securing my data even from themselves, is their priority.
- mda 7y ago
  Funnily, I don't think there is any other company that protects users private data better than Google. Not military, not Apple, none of them come closer to it.
  - TazeTSchnitzel 7y ago
    Google are good at preventing people hacking their servers, but they also broadcast your private data to thousands of third parties every time you open a webpage. Facebook and Google's approach to data security is lock it down so only they and their partners can access it. It does nothing for your privacy.
    - plexicle 7y ago
      What are you talking about? Google neither sends nor sells any of your data to "third parties". I don't know why people parrot this nonsense.
      - TazeTSchnitzel 7y ago
        It's not nonsense, it's a standard part of adtech: https://brave.com/adtech-data-breach-complaint/ https://brave.com/adtech-data-breach-complaint/
        lern_too_spel 7y ago
        Google gave an ID to these third parties. iOS does the same with its IDFA.
        TazeTSchnitzel 7y ago
        Far from just an ID.
        lern_too_spel 7y ago
        Then what?

imchillyb 7y ago

Oh, google goes to the mat alright. They're just in a different, uh, position. Speaking of positions... this is how I picture Google's relationship with the US Federal Government: https://youtu.be/pSIEKcq32WY?t=16 https://youtu.be/pSIEKcq32WY?t=16 !!! Definitely NSFW !!!

kllrnohj 7y ago

> Apple went to the mat to protect its customers from the FBI. That earns ️<3 from me. Do I think Google would look out for me like that? Hahah, no, I do not think so. Google literally led the charge on pushing back & publishing government data requests and Google is almost entirely why it's legal to disclose ranges of FISA and NSL requests in the first place. They've been doing transparency reports on this for years, far longer than Apple. There's a lot you can complain about with Google. But this isn't one of them.

bilbo0s 7y ago
No dog in this race really, I'm pretty much against all of big tech on privacy grounds. That said, I have to say that from my perspective, it seems pretty clear that Apple is light years ahead of Google where privacy and security are concerned. I try never to even touch Google properties or products, because it's tantamount to making whatever information you provide to that service public. That's kind of how I think about it. Everything I put into google maps, google apps, gmail, whatever, will be open for the entire world to see at some point. Either a leak by google, or google shares with someone who gets hacked, or maybe through a court case where stuff from 10 years ago pops up in court records or whatever. I mean, if that doesn't happen, great. If it does though, no biggie, I behaved as if it would happen from day one. Of all the dangerous big tech companies out there, Google and Facebook are, to my mind, unquestionably the most dangerous. And by far the biggest threats to the privacy and security of the average person.
- kllrnohj 7y ago
  > Apple is light years ahead of Google where privacy and security are concerned. Privacy I'd agree, but security? Apple's security track record is straight up hot garbage. Their cloud security is a complete joke (iCloud has been hacked how many times now?). Google's cloud security meanwhile has a stellar record. Outside of cloud yeah Apple has lots of security buzzwords, but they still are repeatedly hacked. We are, after all, talking about a post where 5 different 0-days were actively exploited on iOS. And just about every release of iOS has had critical escalation vulnerabilities (aka, jailbreaks) - such as the CoreTrust bypass exploit in iOS 12 ( https://gist.github.com/pwn20wndstuff/a57b213a6f8c75cb3b9a8c6002ae5756 https://gist.github.com/pwn20wndstuff/a57b213a6f8c75cb3b9a8c... ) Android has an update problem, but between all the hardening that's been done there (such as extensive selinux policies) it's pretty fucking solid, and is backing that up with results.

ben1040 7y ago

>Apple went to the mat to protect its customers from the FBI. That earns ️<3 from me. Do I think Google would look out for me like that? Hahah, no, I do not think so. They implemented countermeasures on their devices to prevent the exact situation where the FBI would compel them to produce a signed, backdoored, firmware like they wanted Apple to do after San Bernadino. https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html https://android-developers.googleblog.com/2018/05/insider-at... Unless you have the device's passcode, you can't update the firmware that deals with passcode checking, unless you wipe the data.

thothamon 7y ago
If this works as described and there are no tricks (such as Google changing your account password from their servers to a known password and then logging in), then that is a great step in the right direction. A very important next step would be to make this a required feature for all handset developers who wish to use Google services such as the Play Store. As long as it's a niche feature only used on the Pixel, it's more of a good gesture than a substantive benefit for users.

lern_too_spel 7y ago

> Apple has done its best to secure customer privacy not only from bad actors and the government Apple's marketing people would like you to believe that. In actual fact, only Apple has handed over the data of its iCloud and iMessage users wholesale to the Chinese government. Not Facebook. Not Google. https://www.amnesty.org/en/latest/news/2018/03/apple-privacy-betrayal-for-chinese-icloud-users/ https://www.amnesty.org/en/latest/news/2018/03/apple-privacy... > Do I think Google would look out for me like that? Google has done this repeatedly according to its transparency reports. The only difference is that Apple lied to its customers that it was "not technically feasible" to comply with data requests and then silently removed that claim after the FBI showed that to be false. https://slate.com/technology/2014/09/if-you-use-a-passcode-in-ios-8-apple-won-t-be-able-to-give-your-personal-data-to-law-enforcement.amp https://slate.com/technology/2014/09/if-you-use-a-passcode-i... If you want more lies that magically disappear, Apple is more than happy to comply. More recently, Tim Cook posted, “We have also never allowed access to our servers. “And we never will.” That's gone too after the China collaboration, with "our servers" replaced by "Apple servers." Maybe technically the servers that Apple set up in China are not "Apple servers" and instead Guizhou servers, but that is not a useful distinction to the users whose data is now freely accessible by the CPC, and so Apple deceives its users with a wording change without any announcement of policy change or any apologies. https://www.sfchronicle.com/news/article/Battle-with-FBI-reveals-possible-loophole-in-6866918.php https://www.sfchronicle.com/news/article/Battle-with-FBI-rev...

kvartz 7y ago

Apple will and did surrender iCloud data to LE, so would Google. they denied unlocking the device or implementing backdoor in the future, which I believe is not feature any other vendors have implemented. And let's not forget that the device apple was so eager to protect belonged to already dead terrorist, as far as average user is concerned that was a PR stunt.

dpkonofa 7y ago
Apple wasn't eager to protect the device of a terrorist. They were eager to protect everyone's devices. Opening up access to "the terrorist's" device would open up that access to every device. I, personally, think they made absolutely the right call.

dammitfoo 7y ago

> Apple has done its best to secure customer privacy... That earns ️<3 from me. Do I think Google would look out for me like that? Hahah, no, I do not think so. Both Apple and Google are NSA's PRISM partners, Hahah. It's amazing how short some people's memories are.

lern_too_spel 7y ago
Apple and Google had no interaction with PRISM. Read the slides.