5 ms·

> Why should users believe that (closed source) iMessage encryption is free from backdoors when we know that Cook will dance around sensitive truths? At least

> Why should users believe that (closed source) iMessage encryption is free from backdoors when we know that Cook will dance around sensitive truths? At least in China, you can probably assume iMessage is back-doored given that iCloud content in mainland China is operated by a Chinese internet company. Apple quietly posted this last week on their support page: "iCloud services in China mainland are now operated by Chinese internet services company Guizhou on the Cloud Big Data Industrial Development Co., Ltd., (GCBD). This allows us to continue to improve iCloud services in China mainland and comply with Chinese regulations." It goes on to say: "iCloud services and all the data you store with iCloud, including photos, videos, documents, and backups, will be subject to the new terms and conditions of iCloud operated by GCBD." Source: https://support.apple.com/en-us/HT208351 https://support.apple.com/en-us/HT208351 EDIT: After some research, it looks like the iCloud handover actually happened last year (https://www.theregister.co.uk/2018/01/11/icloud_china_goes_to_china/ https://www.theregister.co.uk/2018/01/11/icloud_china_goes_t...).

Despegar 7y ago
Actually we can't assume that at all. It seems I'm going to have to repost this comment a thousand times https://news.ycombinator.com/item?id=20904857 https://news.ycombinator.com/item?id=20904857 >Apple has already publicly said in court filings, and under threat of perjury, that they don't make any exceptions for China. From Apple's filing [1]: >Finally, the government attempts to disclaim the obvious international implications of its demand, asserting that any pressure to hand over the same software to foreign agents “flows from [Apple’s] decision to do business in foreign countries . . . .” Opp. 26. Contrary to the government’s misleading statistics (Opp. 26), which had to do with lawful process and did not compel the creation of software that undermines the security of its users, Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. See Dkt. 16-28 [Apple Inc., Privacy, Gov’t Info. Requests]; Federighi Decl. ¶¶ 6–7. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests. See Federighi Decl. ¶ 5. and a declaration from Craig Federighi personally [2]: >Apple uses the same security protocols everywhere in the world. >Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device. >It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. >I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. When China wants something from iCloud they do it the same way that law enforcement does it everywhere in the world, which is through Apple. [1] https://assets.documentcloud.org/documents/2762131/C-D-Cal-16-Cm-00010-Dckt-000177-000-Filed-2016.pdf https://assets.documentcloud.org/documents/2762131/C-D-Cal-1... [2] https://www.documentcloud.org/documents/2762118-Federighi-Decl-Executed.html#document/p1 https://www.documentcloud.org/documents/2762118-Federighi-De...
- dang 7y ago
  Please don't copy-paste the same comments on Hacker News. It lowers the signal-noise ratio. Threads are supposed to be conversations. In good conversation, people don't recite boilerplate at each other.
- joshuamorton 7y ago
  Apple itself states that it cannot access data in China without permission from the contracting company. Why would the Chinese government ask apple for data it can't provide, but a Chinese company could? Also note your documents are from 2016, these events mostly started in 2017.
  - Despegar 7y ago
    The boilerplate ToS doesn't contradict anything they've said in the court filings I linked to or the press statements and Tim Cook's interview (linked to in the original thread) about how iPhone/iCloud security works in China.
- president 7y ago
  If you look at "E. Access to Your Account and Content" section in the Chinese iCloud T&C [1], it seems like there is an extra clause there not present in the same section in the US T&C [2]. "...You understand and agree that Apple and GCBD will have access to all data that you store on this service, including the right to share, exchange and disclose all user data, including Content, to and between each other under applicable law." Shouldn't this be cause for concern? [1] https://www.apple.com/legal/internet-services/icloud/en/gcbd-terms.html https://www.apple.com/legal/internet-services/icloud/en/gcbd... [2] https://www.apple.com/legal/internet-services/icloud/en/terms.html https://www.apple.com/legal/internet-services/icloud/en/term...
  - Despegar 7y ago
    Apple has said in statements to the press, as well as Tim Cook's interview with Vice, that they retain the keys and that they haven't been made available to GCBD. >Originally, iCloud data was stored on Apple-controlled servers, with the Cupertino company holding the encryption keys. Apple announced a year ago that this would change to comply with new laws in China, and that data for Chinese iCloud accounts would be moved to a server run by Guizhou-Cloud Big Data (GCBD), a company owned by the provincial government. >However, I have spoken to Apple today, who confirmed that it still holds the encryption keys, and states categorically that they have not been made available to either GCBD or China Telecom. https://9to5mac.com/2018/07/18/chinese-icloud-data-china-telecom/ https://9to5mac.com/2018/07/18/chinese-icloud-data-china-tel...
nickfromseattle 7y ago
Microsoft has the same setup for Azure. >Get a physically isolated instance of Azure for your cloud computing services—operated by 21Vianet, a company based in China. Besides censorship and spying on users, China probably doesn't want it's company's data hosted in a place the US's 3 letter agencies can access it via an NSL. https://azure.microsoft.com/en-us/global-infrastructure/china/ https://azure.microsoft.com/en-us/global-infrastructure/chin...
- losteric 7y ago
  AWS is working on it too. Internally, the region is very much treated as untrustworthy.
  - etaioinshrdlu 7y ago
    Very interesting. Any additional info? Info that is maybe not public?
    - mey 7y ago
      AWS is very upfront about AWS China. See https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/ https://aws.amazon.com/about-aws/global-infrastructure/regio... and click AWS China Regions on the left side. I would be asking AWS about the future of AWS Hong Kong which has historically has had special freedoms from China. See current events for more on that. Typical issue is the ICP License ( https://en.wikipedia.org/wiki/ICP_license https://en.wikipedia.org/wiki/ICP_license ), which is why Western companies set up shop in Hong Kong.
      - sterlind 7y ago
        For now, like you say. If China decides to make one country one system, it's curtains for all the Western infrastructure and instances located there. Depending on how it goes down, it could be a big security/confidentiality issue for the data located or flowing through there. I'm hopeful China would have a lot to lose by pulling the plug, since Hong Kong is a valuable interface to the West, but it might happen sooner or later with how unstable geopolitics is becoming.
hamandcheese 7y ago
If I travel to China does that mean my iCloud data will sync to Chinese iCloud?
- morpheuskafka 7y ago
  No, it is based on the account itself. There is no sync between the two sets of servers so that wouldn't work for them to base it on the physical location of the device.
  - foobiekr 7y ago
    Says Apple. Do you believe them? Apple has been kind of marginal quality wise for awhile, mostly being better than the alternative because the alternative is garbage. But their handling of this makes much of what they say suspect.
    - kelnos 7y ago
      I would believe them based on technical reasons. Given that there's a special system, hosted on another company's servers, just for China, syncing non-Chinese iPhones into the Chinese iCloud system would be more work, and for what gain?
      - dpau 7y ago
        it could also be argued that the current system of partnering with a chinese government backed partner company is more work. in these systems efficiency is only one consideration, abiding by the laws and regulations of the host country is another. however in this case from what i've read your icloud data is tied to the account's country.
- ottolin 7y ago
  No, it depends on your iCloud account location instead of where you are.
  - 7y ago
wodenokoto 7y ago
> "iCloud services and all the data you store with iCloud, including photos, videos, documents, and backups, will be subject to the new terms and conditions of iCloud operated by GCBD." How do I know if my data is on the Chinese iCloud? I've been to China once and connected to iCloud.
- _-___________-_ 7y ago
  My understanding is that it's based on the region setting of your phone, but I'd be happy to be corrected.
  - ValentineC 7y ago
    From the other comments, it's more likely to be the region of one's Apple ID, which is decoupled from the region of one's phone. As one can log in and out of multiple Apple IDs (from different countries) in the App Store without breaking anything synced with one's primary iCloud account, it's very likely that Apple encourages this as a best practice.
dkonofalski 7y ago
>Apple quietly posted this last week Quietly? They issued a support article and it was big news in most news outlets when it was released.

Despegar 7y ago

Actually we can't assume that at all. It seems I'm going to have to repost this comment a thousand times https://news.ycombinator.com/item?id=20904857 https://news.ycombinator.com/item?id=20904857 >Apple has already publicly said in court filings, and under threat of perjury, that they don't make any exceptions for China. From Apple's filing [1]: >Finally, the government attempts to disclaim the obvious international implications of its demand, asserting that any pressure to hand over the same software to foreign agents “flows from [Apple’s] decision to do business in foreign countries . . . .” Opp. 26. Contrary to the government’s misleading statistics (Opp. 26), which had to do with lawful process and did not compel the creation of software that undermines the security of its users, Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. See Dkt. 16-28 [Apple Inc., Privacy, Gov’t Info. Requests]; Federighi Decl. ¶¶ 6–7. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests. See Federighi Decl. ¶ 5. and a declaration from Craig Federighi personally [2]: >Apple uses the same security protocols everywhere in the world. >Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device. >It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. >I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. When China wants something from iCloud they do it the same way that law enforcement does it everywhere in the world, which is through Apple. [1] https://assets.documentcloud.org/documents/2762131/C-D-Cal-16-Cm-00010-Dckt-000177-000-Filed-2016.pdf https://assets.documentcloud.org/documents/2762131/C-D-Cal-1... [2] https://www.documentcloud.org/documents/2762118-Federighi-Decl-Executed.html#document/p1 https://www.documentcloud.org/documents/2762118-Federighi-De...

dang 7y ago
Please don't copy-paste the same comments on Hacker News. It lowers the signal-noise ratio. Threads are supposed to be conversations. In good conversation, people don't recite boilerplate at each other.
joshuamorton 7y ago
Apple itself states that it cannot access data in China without permission from the contracting company. Why would the Chinese government ask apple for data it can't provide, but a Chinese company could? Also note your documents are from 2016, these events mostly started in 2017.
- Despegar 7y ago
  The boilerplate ToS doesn't contradict anything they've said in the court filings I linked to or the press statements and Tim Cook's interview (linked to in the original thread) about how iPhone/iCloud security works in China.
president 7y ago
If you look at "E. Access to Your Account and Content" section in the Chinese iCloud T&C [1], it seems like there is an extra clause there not present in the same section in the US T&C [2]. "...You understand and agree that Apple and GCBD will have access to all data that you store on this service, including the right to share, exchange and disclose all user data, including Content, to and between each other under applicable law." Shouldn't this be cause for concern? [1] https://www.apple.com/legal/internet-services/icloud/en/gcbd-terms.html https://www.apple.com/legal/internet-services/icloud/en/gcbd... [2] https://www.apple.com/legal/internet-services/icloud/en/terms.html https://www.apple.com/legal/internet-services/icloud/en/term...
- Despegar 7y ago
  Apple has said in statements to the press, as well as Tim Cook's interview with Vice, that they retain the keys and that they haven't been made available to GCBD. >Originally, iCloud data was stored on Apple-controlled servers, with the Cupertino company holding the encryption keys. Apple announced a year ago that this would change to comply with new laws in China, and that data for Chinese iCloud accounts would be moved to a server run by Guizhou-Cloud Big Data (GCBD), a company owned by the provincial government. >However, I have spoken to Apple today, who confirmed that it still holds the encryption keys, and states categorically that they have not been made available to either GCBD or China Telecom. https://9to5mac.com/2018/07/18/chinese-icloud-data-china-telecom/ https://9to5mac.com/2018/07/18/chinese-icloud-data-china-tel...

nickfromseattle 7y ago

Microsoft has the same setup for Azure. >Get a physically isolated instance of Azure for your cloud computing services—operated by 21Vianet, a company based in China. Besides censorship and spying on users, China probably doesn't want it's company's data hosted in a place the US's 3 letter agencies can access it via an NSL. https://azure.microsoft.com/en-us/global-infrastructure/china/ https://azure.microsoft.com/en-us/global-infrastructure/chin...

losteric 7y ago
AWS is working on it too. Internally, the region is very much treated as untrustworthy.
- etaioinshrdlu 7y ago
  Very interesting. Any additional info? Info that is maybe not public?
  - mey 7y ago
    AWS is very upfront about AWS China. See https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/ https://aws.amazon.com/about-aws/global-infrastructure/regio... and click AWS China Regions on the left side. I would be asking AWS about the future of AWS Hong Kong which has historically has had special freedoms from China. See current events for more on that. Typical issue is the ICP License ( https://en.wikipedia.org/wiki/ICP_license https://en.wikipedia.org/wiki/ICP_license ), which is why Western companies set up shop in Hong Kong.
    - sterlind 7y ago
      For now, like you say. If China decides to make one country one system, it's curtains for all the Western infrastructure and instances located there. Depending on how it goes down, it could be a big security/confidentiality issue for the data located or flowing through there. I'm hopeful China would have a lot to lose by pulling the plug, since Hong Kong is a valuable interface to the West, but it might happen sooner or later with how unstable geopolitics is becoming.

hamandcheese 7y ago

If I travel to China does that mean my iCloud data will sync to Chinese iCloud?

morpheuskafka 7y ago
No, it is based on the account itself. There is no sync between the two sets of servers so that wouldn't work for them to base it on the physical location of the device.
- foobiekr 7y ago
  Says Apple. Do you believe them? Apple has been kind of marginal quality wise for awhile, mostly being better than the alternative because the alternative is garbage. But their handling of this makes much of what they say suspect.
  - kelnos 7y ago
    I would believe them based on technical reasons. Given that there's a special system, hosted on another company's servers, just for China, syncing non-Chinese iPhones into the Chinese iCloud system would be more work, and for what gain?
    - dpau 7y ago
      it could also be argued that the current system of partnering with a chinese government backed partner company is more work. in these systems efficiency is only one consideration, abiding by the laws and regulations of the host country is another. however in this case from what i've read your icloud data is tied to the account's country.
ottolin 7y ago
No, it depends on your iCloud account location instead of where you are.
- 7y ago

wodenokoto 7y ago

> "iCloud services and all the data you store with iCloud, including photos, videos, documents, and backups, will be subject to the new terms and conditions of iCloud operated by GCBD." How do I know if my data is on the Chinese iCloud? I've been to China once and connected to iCloud.

_-___________-_ 7y ago
My understanding is that it's based on the region setting of your phone, but I'd be happy to be corrected.
- ValentineC 7y ago
  From the other comments, it's more likely to be the region of one's Apple ID, which is decoupled from the region of one's phone. As one can log in and out of multiple Apple IDs (from different countries) in the App Store without breaking anything synced with one's primary iCloud account, it's very likely that Apple encourages this as a best practice.

dkonofalski 7y ago

>Apple quietly posted this last week Quietly? They issued a support article and it was big news in most news outlets when it was released.