8 ms·

It's mostly marketing bullshit. Apple and Microsoft both tried to build ad businesses, but when they weren't as successful as Google, they turned lemons into l

It's mostly marketing bullshit. Apple and Microsoft both tried to build ad businesses, but when they weren't as successful as Google, they turned lemons into lemonade by launching data privacy PR campaigns against Google. Meanwhile, Apple and Microsoft quietly censor their products in China, surrender data to Chinese authorities, and now we find Apple is intentionally leaving iCloud data insecure. Presumably Google was under the same pressure from US law enforcement, but somehow Google delivered end-to-end encrypted Android backups in October, 2018. And Google did it without all of Apple's self-congratulatory media hoopla. e2ee: https://security.googleblog.com/2018/10/google-and-android-have-your-back-by.html https://security.googleblog.com/2018/10/google-and-android-h... Third party security audit: https://www.nccgroup.trust/us/our-research/android-cloud-backuprestore/?research=Public+Reports https://www.nccgroup.trust/us/our-research/android-cloud-bac...

meester_ben 7y ago
"Apple is intentionally leaving iCloud data insecure" ... if you'd done some research you would know that iCloud backups are not end-to-end encrypted. That means you have a choice: backup to iCloud for the convenience and give up some privacy, or turn off the iCloud backup. It would be nice if Apple was more forthcoming with that fact but there is some onus on the customer these days to understand what's private and what is not. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 iCloud backups are not on the list of end-to-end encrypted.
- mch82 7y ago
  Doesn’t that page show everything as end-to-end encrypted, except email messages on the server? If “backup”, photos, messages, contacts, calendars, iCloud Drive, notes, and safari data (and a few more) are end-to-end encrypted what else is there?
  - Despegar 7y ago
    I mean if you scroll down a little more you'll see what data is actually end-to-end encrypted.
  - morpheuskafka 7y ago
    I don't think you are reading the list right. That is all the stuff that is encrypted both at-rest and in-transit (with keys known to Apple). The list of E2E is further down, separate from the table, and includes: Home data, Health data (requires iOS 12 or later), iCloud Keychain (includes all of your saved accounts and passwords), payment information, QuickType Keyboard learned vocabulary (requires iOS 11 or later), Screen Time, Siri information, and Wi-Fi passwords. So virtually nothing, by comparison. Messages, probably the most personal and relevant for legal cases, are end-to-end-encrypted as well, but if you have iCloud Backup enabled, the key is stored in the backup, making this useless.
- dpau 7y ago
  Please see "iCloud security overview", it clearly states which iCloud data is encrypted in transit, on server, and end-to-end: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - youareostriches 7y ago
    This is from your own link: “For certain sensitive information, Apple uses end-to-end encryption.” “These features and their data are transmitted and stored in iCloud using end-to-end encryption:” * Home data * Health data (requires iOS 12 or later) * iCloud Keychain (includes all of your saved accounts and passwords) * Payment information * QuickType Keyboard learned vocabulary (requires iOS 11 or later) * Screen Time * Siri information * Wi-Fi passwords
    - cies 7y ago
      And please mind that e2e means next to nothing when the data is stored and retrieved with a closed source (and usually auto-updating) client app.
    - dpau 7y ago
      Yes, I wasn't debating a point, just providing a list of exactly how Apple encrypts user data.
dpau 7y ago
Just a reminder, Apple ceded control of its iCloud management in China to a state-controlled company, in addition began storing its encryption keys in China in order to "comply with local regulations". So whether or not your backups are encrypted is almost a moot point, given that the government can submit a lawful demand for your data at any time.. Apple will store some iCloud encryption keys in China, raising security concerns https://www.theverge.com/2018/2/26/17052802/apple-icloud-encryption-keys-storage-china https://www.theverge.com/2018/2/26/17052802/apple-icloud-enc...
- newscracker 7y ago
  That’s only for devices where the region is set as China. Why would it be a moot point elsewhere for that reason?
  - aiisjustanif 7y ago
    Injustice anywhere is a threat to justice everywhere.
    - tomp 7y ago
      Different places define (in)justice differently.
      - justwalt 7y ago
        But isn’t morality universal?
        JohnFen 7y ago
        Morality is defined by culture, so there is no "universal" morality as such. However, there are certain specific things that are included in almost all moral frameworks.
        mensetmanusman 7y ago
brosinante 7y ago
Yeah, the current privacy dystopia is obviously just evil apple and microsoft sticking it to noble google.
- panarky 7y ago
  Certainly not. But distinguishing PR bullshit from actual practice is essential when navigating the dystopia.
derefr 7y ago
A good way to figure out whether this kind of claim is marketing bullshit, is to look for a PR claim that goes the other way: that Apple or whoever helps the FBI find uploaded images of child sexual abuse. If they are matching on your data, they can’t be encrypting it; if they’re encrypting it, they can’t be matching on it. It’s one or the other. And, well, Apple have confirmed that they‘re matching on your data[1]. So, guess what? [1] https://www.scmagazine.com/home/security-news/apple-scans-icloud-content-for-child-sexual-abuse-photos-privacy-chief-says/ https://www.scmagazine.com/home/security-news/apple-scans-ic...
- shuckles 7y ago
  This was clarified to be iCloud Mail attachments.
azinman2 7y ago
I totally disagree. I work for Apple, and I can tell you that for everything you do privacy is involved. It’s not just marketing.
- nickpeterson 7y ago
  Involved isn’t the same as guaranteed. I think commenters here are arguing that Apple isn’t being honest about what is available to law enforcement. My guess would be silent updates targeted at individual users who they have search warrants against.
  - azinman2 7y ago
    The list of E2E above is quite transparent. The notion of building a special version of the OS to target an individual is just not how the infrastructure works, and totally goes against the entire spirit of privacy that pervades everything you do internally.
    - ghostpepper 7y ago
      Sorry to be blunt (and I am a big fan of Apple's pro-privacy shift of late) but nobody outside Apple can know that with any certainty. Even the 2016 blackhat talk on youtube, which describes an elaborate signing mechanism for updates, doesn't preclude shipping targeted OS updates to individual users. Maybe I missed something though, and in that case I'd appreciate you pointing it out.
      - azinman2 7y ago
        I can tell you that most people inside of Apple would be shocked if such a thing occurred. I doubt the code pathway / infrastructure even exists to do such a thing. There’s always the possibility of strange things happening that only the right 1-2 people know about.... although it’s probably have to be many more given the number of changes that would be needed to be made to propagate a special one off code signed OS OTA. That would likely have a whistleblower somewhere. The reality is it’s way easier to just exploit a weakness that you can text someone [1]. But if you’re dressed in tin foil hat to toe, then there’s nothing that I can say to convince you. At that point I’d suggest not using any computing technology that you don’t personally build yourself and watch 24/7. [1] https://www.nytimes.com/2020/01/21/technology/bezos-phone-hacking.amp.html https://www.nytimes.com/2020/01/21/technology/bezos-phone-ha...

meester_ben 7y ago

"Apple is intentionally leaving iCloud data insecure" ... if you'd done some research you would know that iCloud backups are not end-to-end encrypted. That means you have a choice: backup to iCloud for the convenience and give up some privacy, or turn off the iCloud backup. It would be nice if Apple was more forthcoming with that fact but there is some onus on the customer these days to understand what's private and what is not. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 iCloud backups are not on the list of end-to-end encrypted.

mch82 7y ago
Doesn’t that page show everything as end-to-end encrypted, except email messages on the server? If “backup”, photos, messages, contacts, calendars, iCloud Drive, notes, and safari data (and a few more) are end-to-end encrypted what else is there?
- Despegar 7y ago
  I mean if you scroll down a little more you'll see what data is actually end-to-end encrypted.
- morpheuskafka 7y ago
  I don't think you are reading the list right. That is all the stuff that is encrypted both at-rest and in-transit (with keys known to Apple). The list of E2E is further down, separate from the table, and includes: Home data, Health data (requires iOS 12 or later), iCloud Keychain (includes all of your saved accounts and passwords), payment information, QuickType Keyboard learned vocabulary (requires iOS 11 or later), Screen Time, Siri information, and Wi-Fi passwords. So virtually nothing, by comparison. Messages, probably the most personal and relevant for legal cases, are end-to-end-encrypted as well, but if you have iCloud Backup enabled, the key is stored in the backup, making this useless.
dpau 7y ago
Please see "iCloud security overview", it clearly states which iCloud data is encrypted in transit, on server, and end-to-end: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- youareostriches 7y ago
  This is from your own link: “For certain sensitive information, Apple uses end-to-end encryption.” “These features and their data are transmitted and stored in iCloud using end-to-end encryption:” * Home data * Health data (requires iOS 12 or later) * iCloud Keychain (includes all of your saved accounts and passwords) * Payment information * QuickType Keyboard learned vocabulary (requires iOS 11 or later) * Screen Time * Siri information * Wi-Fi passwords
  - cies 7y ago
    And please mind that e2e means next to nothing when the data is stored and retrieved with a closed source (and usually auto-updating) client app.
  - dpau 7y ago
    Yes, I wasn't debating a point, just providing a list of exactly how Apple encrypts user data.

dpau 7y ago

Just a reminder, Apple ceded control of its iCloud management in China to a state-controlled company, in addition began storing its encryption keys in China in order to "comply with local regulations". So whether or not your backups are encrypted is almost a moot point, given that the government can submit a lawful demand for your data at any time.. Apple will store some iCloud encryption keys in China, raising security concerns https://www.theverge.com/2018/2/26/17052802/apple-icloud-encryption-keys-storage-china https://www.theverge.com/2018/2/26/17052802/apple-icloud-enc...

newscracker 7y ago
That’s only for devices where the region is set as China. Why would it be a moot point elsewhere for that reason?
- aiisjustanif 7y ago
  Injustice anywhere is a threat to justice everywhere.
  - tomp 7y ago
    Different places define (in)justice differently.
    - justwalt 7y ago
      But isn’t morality universal?
      - JohnFen 7y ago
        Morality is defined by culture, so there is no "universal" morality as such. However, there are certain specific things that are included in almost all moral frameworks.
        mensetmanusman 7y ago

brosinante 7y ago

Yeah, the current privacy dystopia is obviously just evil apple and microsoft sticking it to noble google.

panarky 7y ago
Certainly not. But distinguishing PR bullshit from actual practice is essential when navigating the dystopia.

derefr 7y ago

A good way to figure out whether this kind of claim is marketing bullshit, is to look for a PR claim that goes the other way: that Apple or whoever helps the FBI find uploaded images of child sexual abuse. If they are matching on your data, they can’t be encrypting it; if they’re encrypting it, they can’t be matching on it. It’s one or the other. And, well, Apple have confirmed that they‘re matching on your data[1]. So, guess what? [1] https://www.scmagazine.com/home/security-news/apple-scans-icloud-content-for-child-sexual-abuse-photos-privacy-chief-says/ https://www.scmagazine.com/home/security-news/apple-scans-ic...

shuckles 7y ago
This was clarified to be iCloud Mail attachments.

azinman2 7y ago

I totally disagree. I work for Apple, and I can tell you that for everything you do privacy is involved. It’s not just marketing.

nickpeterson 7y ago
Involved isn’t the same as guaranteed. I think commenters here are arguing that Apple isn’t being honest about what is available to law enforcement. My guess would be silent updates targeted at individual users who they have search warrants against.
- azinman2 7y ago
  The list of E2E above is quite transparent. The notion of building a special version of the OS to target an individual is just not how the infrastructure works, and totally goes against the entire spirit of privacy that pervades everything you do internally.
  - ghostpepper 7y ago
    Sorry to be blunt (and I am a big fan of Apple's pro-privacy shift of late) but nobody outside Apple can know that with any certainty. Even the 2016 blackhat talk on youtube, which describes an elaborate signing mechanism for updates, doesn't preclude shipping targeted OS updates to individual users. Maybe I missed something though, and in that case I'd appreciate you pointing it out.
    - azinman2 7y ago
      I can tell you that most people inside of Apple would be shocked if such a thing occurred. I doubt the code pathway / infrastructure even exists to do such a thing. There’s always the possibility of strange things happening that only the right 1-2 people know about.... although it’s probably have to be many more given the number of changes that would be needed to be made to propagate a special one off code signed OS OTA. That would likely have a whistleblower somewhere. The reality is it’s way easier to just exploit a weakness that you can text someone [1]. But if you’re dressed in tin foil hat to toe, then there’s nothing that I can say to convince you. At that point I’d suggest not using any computing technology that you don’t personally build yourself and watch 24/7. [1] https://www.nytimes.com/2020/01/21/technology/bezos-phone-hacking.amp.html https://www.nytimes.com/2020/01/21/technology/bezos-phone-ha...