8 ms·

Two things: 1) There is no way Apple would be allowed to sell iPhones in China, without China government having access to anything. So, I assume that Apple use

Two things: 1) There is no way Apple would be allowed to sell iPhones in China, without China government having access to anything. So, I assume that Apple users in China have e2e encrypted exactly nothing. 2) I have a strong suspicion that those 'enter your Apple ID password because your account needs it' message really means 'a government has requested your data and even though it's encrypted, we will nag you about entering a password, and if you give it, you're a free game'. I don't blame Apple for this, I'm sure they're doing what they can, but when a government says 'give us this data', they can't not comply. Vote responsibly - companies can't protect us from a government we have put into power.

baddox 7y ago
My impression is that iMessage is indeed encrypted end-to-end in China, same as everywhere else.
- filmgirlcw 7y ago
  iMessage is. iMessage backups are not.
  - baddox 7y ago
    Yes, same as everywhere else.
- radicaldreamer 7y ago
  The key is included in the iCloud backup stored by Guizhou on the “Cloud Big Data Industrial Development Co., Ltd.“ https://support.apple.com/en-us/HT208351 https://support.apple.com/en-us/HT208351
  - baddox 7y ago
    If you use iCloud backups then your iMessage key is stored unencrypted regardless of which country you're in. That's a main point of this article.
    - commoner 7y ago
      Apple's decision to store the keys on Chinese servers was criticized because it effectively reduced security for Chinese iCloud users: > Chinese users of Apple’s iCloud service will see their data–along with that data’s cryptographic keys–stored inside the country beginning Wednesday, Reuters reports. The move will mean that Chinese authorities will have easier access to Chinese users’ iCloud data than before when that data was stored in the U.S. The move is a contentious one, as human rights activists say Chinese authorities will now have an easier means of obtaining dissidents data since it no longer needs to go through the U.S. legal system to get Apple to hand over its cryptographic keys for Chinese users. https://www.fastcompany.com/40535933/apple-will-store-icloud-keys-in-china-for-local-users-from-february-28 https://www.fastcompany.com/40535933/apple-will-store-icloud...
minton 7y ago
> 2) I have a strong suspicion that those 'enter your Apple ID password because your account needs it' message really means 'a government has requested your data and even though it's encrypted, we will nag you about entering a password, and if you give it, you're a free game'. Haha I hadn’t thought of that. If true, I must have every government requesting my data frequently as I constantly get bombarded to enter my iCloud password.
- dmix 7y ago
  FISA warrants can go multiple hops from the target which with network effects can sweep up tons of unrelated data from random people who happened to interact with someone who interacted with x bad guy. That’s just for domestic surveillance keep in mind.
- cheeze 7y ago
  Seriously. It drives me nuts just how much my iPad asks me for my password. I'm not all in on Apple's ecosystem so maybe that is why? IDK.
president 7y ago
Regarding #1: iCloud in China is operated by a mainland Chinese company and subject to that company's terms and conditions. So you can pretty much assume iCloud data is completely accessible by the government. Source: https://support.apple.com/en-us/HT208351 https://support.apple.com/en-us/HT208351
- scarface74 7y ago
  Apple uses third party data centers, if it can't host encrypted data on a Chinese server without China having access to the data, there is something wrong with the encryption.
  - president 7y ago
    I would urge you to read up on the Chinese cryptography law [1] which took effect on the 1st of this year. Essentially all companies foreign or not must provide unencrypted access to data to the Chinese government and must do so in secrecy. Prior to this, companies were being compelled to give up their data anyways but this just makes things easier. By the way, the source below is an official Chinese government media source. [1] http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm
    - scarface74 7y ago
      Do you have any evidence that Apple rearchitected their system to have access to private keys that it doesn’t have access to anywhere, to have access to give it to China?
      - president 7y ago
        Technology is irrelevant here. Laws (or in China, the Chinese Communist Party) govern these things.
        scarface74 7y ago
thorwasdfasdf 7y ago
You say vote responsibly but neither of the 2 parties will address this. The libertarian party surely would but most people don't even know it exists, i would guess.
Despegar 7y ago
>1) There is no way Apple would be allowed to sell iPhones in China, without China government having access to anything. So, I assume that Apple users in China have e2e encrypted exactly nothing. E2E works exactly the same in China. You can read more in my comments here: https://news.ycombinator.com/item?id=20904857 https://news.ycombinator.com/item?id=20904857 The same "vulnerability" of being able to respond to legal requests for iCloud data that exists in China exists everywhere else in the world.
- president 7y ago
  Please stop spreading disinformation. Your sources are outdated and the quotes that you are referencing are not legally binding. The fact is that Apple has clearly stated that iCloud data for Mainland Chinese users is stored on servers operated by a Chinese company, which must abide by the local laws and regulations. It is also a well known fact that all companies operating in China can be compelled by the Chinese government to provide data and do so in secret.
  - Despegar 7y ago
    There's no disinformation in my comments. I seem to be one of the few people on the planet who seems to have actually dug into this exact issue while others only offer the typical FUD we've seen about how Apple's encryption works in China. The fact is that Apple has said multiple times (and even under oath) that end-to-end encryption applies to iPhones and iMessage in China, the same as it does everywhere else. And once again Erik Neuenschwander, an Apple privacy exec, told Congress in a hearing in December that this was still the case. At 02:10:46 https://www.judiciary.senate.gov/meetings/encryption-and-lawful-access-evaluating-benefits-and-risks-to-public-safety-and-privacy https://www.judiciary.senate.gov/meetings/encryption-and-law...
    - president 7y ago
      > In fact I seem to be one of the few people on the planet who seems to have actually dug into this exact issue while others only offer the typical FUD we've seen about how Apple's encryption works in China. I think instead of researching how Apple works in China, you need to start doing some research on how the Chinese government works and their track record on legal matters and rule of law. Also, the segment in the Senate hearing you referenced shows a senator who obviously does not have a good grasp on encryption technology asking bumbling questions about encryption. I have paraphrased the section here: > Senator: Do you sell phones in China? Are they encrypted? > Apple: The phones are the same and all of our phones are encrypted across the world Yes, obviously all phones have encryption but the Senator did not clarify what was being encrypted here and Apple took advantage of this in the response. > Senator: You're telling me that they [China] allows you to sell devices without you allowing them to breach the encryption and gain information about the users? > Apple: You're 100% correct Once again, the question posed was incoherent. Of course there is no "breaching of encryption" here - the Chinese government just asks for the keys or the data. It's all about language here. If this Senate hearing is your case for why data is safe in China, I honestly fear for all the political and religious dissidents that are trusting Apple for their safety.
jackjeff 7y ago
The only thing in that list that would is of interest to a government are messages. Fortunately no-one really uses iMessage in China. People use WeChat and (you guessed it) the Chinese government has access to these. As for the End-to-End encryption of iMessage it is a bit overrated. Apple does the key management for you. So theoretically they could pretend that the key of your interlocutor recently changed (because new phone or something), it would just work transparently. So if a "nefarious" entity were to gain access to iMessage servers, they could use that technique to decrypt, "on the fly", the messages of whoever they want to spy on, without the clients knowing that this even occurred. When you use "WhatsApp" you have the ability to get some kind of warning when the interlocutor's key has been updated. It's also possible to check each others' identity by scanning some kind of QR Code. But the app does not really put any emphasis on which accounts have been verified. Signal is about as bad as WhatsApp. My guess a government that wants to spy on your WhatsApp/Signal messages probably could, because most people would notice the key change warning nor understand what it means. Only Apps which makes a big fuss about key management (Threema for example) are properly End to End encrypted, with no possibility for Big Gov to hack into servers and spy on you by adding their keys to conversations. But then they would probably just hack the OS on your phone at this stage. In fact that method, is probably better than messing around with iMessage/WhatsApp servers. You bypass ALL forms E2E encryption, and you get access to everything else, with one swift hack. I bet the NSA and their Chinese equivalents have such hacks in reserve for very juicy targets they want to spy on. With the kind of unlimited budget the NSA has, it's hard to imagine something they cannot hack. That is why big A-list targets like Bin Laden went totally off-grid for communication.
devxpy 7y ago
> companies can't protect us from a government we have put into power. But.. the electoral college.

baddox 7y ago

My impression is that iMessage is indeed encrypted end-to-end in China, same as everywhere else.

filmgirlcw 7y ago
iMessage is. iMessage backups are not.
- baddox 7y ago
  Yes, same as everywhere else.
radicaldreamer 7y ago
The key is included in the iCloud backup stored by Guizhou on the “Cloud Big Data Industrial Development Co., Ltd.“ https://support.apple.com/en-us/HT208351 https://support.apple.com/en-us/HT208351
- baddox 7y ago
  If you use iCloud backups then your iMessage key is stored unencrypted regardless of which country you're in. That's a main point of this article.
  - commoner 7y ago
    Apple's decision to store the keys on Chinese servers was criticized because it effectively reduced security for Chinese iCloud users: > Chinese users of Apple’s iCloud service will see their data–along with that data’s cryptographic keys–stored inside the country beginning Wednesday, Reuters reports. The move will mean that Chinese authorities will have easier access to Chinese users’ iCloud data than before when that data was stored in the U.S. The move is a contentious one, as human rights activists say Chinese authorities will now have an easier means of obtaining dissidents data since it no longer needs to go through the U.S. legal system to get Apple to hand over its cryptographic keys for Chinese users. https://www.fastcompany.com/40535933/apple-will-store-icloud-keys-in-china-for-local-users-from-february-28 https://www.fastcompany.com/40535933/apple-will-store-icloud...

minton 7y ago

> 2) I have a strong suspicion that those 'enter your Apple ID password because your account needs it' message really means 'a government has requested your data and even though it's encrypted, we will nag you about entering a password, and if you give it, you're a free game'. Haha I hadn’t thought of that. If true, I must have every government requesting my data frequently as I constantly get bombarded to enter my iCloud password.

dmix 7y ago
FISA warrants can go multiple hops from the target which with network effects can sweep up tons of unrelated data from random people who happened to interact with someone who interacted with x bad guy. That’s just for domestic surveillance keep in mind.
cheeze 7y ago
Seriously. It drives me nuts just how much my iPad asks me for my password. I'm not all in on Apple's ecosystem so maybe that is why? IDK.

president 7y ago

Regarding #1: iCloud in China is operated by a mainland Chinese company and subject to that company's terms and conditions. So you can pretty much assume iCloud data is completely accessible by the government. Source: https://support.apple.com/en-us/HT208351 https://support.apple.com/en-us/HT208351

scarface74 7y ago
Apple uses third party data centers, if it can't host encrypted data on a Chinese server without China having access to the data, there is something wrong with the encryption.
- president 7y ago
  I would urge you to read up on the Chinese cryptography law [1] which took effect on the 1st of this year. Essentially all companies foreign or not must provide unencrypted access to data to the Chinese government and must do so in secrecy. Prior to this, companies were being compelled to give up their data anyways but this just makes things easier. By the way, the source below is an official Chinese government media source. [1] http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm
  - scarface74 7y ago
    Do you have any evidence that Apple rearchitected their system to have access to private keys that it doesn’t have access to anywhere, to have access to give it to China?
    - president 7y ago
      Technology is irrelevant here. Laws (or in China, the Chinese Communist Party) govern these things.
      - scarface74 7y ago

thorwasdfasdf 7y ago

You say vote responsibly but neither of the 2 parties will address this. The libertarian party surely would but most people don't even know it exists, i would guess.

Despegar 7y ago

>1) There is no way Apple would be allowed to sell iPhones in China, without China government having access to anything. So, I assume that Apple users in China have e2e encrypted exactly nothing. E2E works exactly the same in China. You can read more in my comments here: https://news.ycombinator.com/item?id=20904857 https://news.ycombinator.com/item?id=20904857 The same "vulnerability" of being able to respond to legal requests for iCloud data that exists in China exists everywhere else in the world.

president 7y ago
Please stop spreading disinformation. Your sources are outdated and the quotes that you are referencing are not legally binding. The fact is that Apple has clearly stated that iCloud data for Mainland Chinese users is stored on servers operated by a Chinese company, which must abide by the local laws and regulations. It is also a well known fact that all companies operating in China can be compelled by the Chinese government to provide data and do so in secret.
- Despegar 7y ago
  There's no disinformation in my comments. I seem to be one of the few people on the planet who seems to have actually dug into this exact issue while others only offer the typical FUD we've seen about how Apple's encryption works in China. The fact is that Apple has said multiple times (and even under oath) that end-to-end encryption applies to iPhones and iMessage in China, the same as it does everywhere else. And once again Erik Neuenschwander, an Apple privacy exec, told Congress in a hearing in December that this was still the case. At 02:10:46 https://www.judiciary.senate.gov/meetings/encryption-and-lawful-access-evaluating-benefits-and-risks-to-public-safety-and-privacy https://www.judiciary.senate.gov/meetings/encryption-and-law...
  - president 7y ago
    > In fact I seem to be one of the few people on the planet who seems to have actually dug into this exact issue while others only offer the typical FUD we've seen about how Apple's encryption works in China. I think instead of researching how Apple works in China, you need to start doing some research on how the Chinese government works and their track record on legal matters and rule of law. Also, the segment in the Senate hearing you referenced shows a senator who obviously does not have a good grasp on encryption technology asking bumbling questions about encryption. I have paraphrased the section here: > Senator: Do you sell phones in China? Are they encrypted? > Apple: The phones are the same and all of our phones are encrypted across the world Yes, obviously all phones have encryption but the Senator did not clarify what was being encrypted here and Apple took advantage of this in the response. > Senator: You're telling me that they [China] allows you to sell devices without you allowing them to breach the encryption and gain information about the users? > Apple: You're 100% correct Once again, the question posed was incoherent. Of course there is no "breaching of encryption" here - the Chinese government just asks for the keys or the data. It's all about language here. If this Senate hearing is your case for why data is safe in China, I honestly fear for all the political and religious dissidents that are trusting Apple for their safety.

jackjeff 7y ago

The only thing in that list that would is of interest to a government are messages. Fortunately no-one really uses iMessage in China. People use WeChat and (you guessed it) the Chinese government has access to these. As for the End-to-End encryption of iMessage it is a bit overrated. Apple does the key management for you. So theoretically they could pretend that the key of your interlocutor recently changed (because new phone or something), it would just work transparently. So if a "nefarious" entity were to gain access to iMessage servers, they could use that technique to decrypt, "on the fly", the messages of whoever they want to spy on, without the clients knowing that this even occurred. When you use "WhatsApp" you have the ability to get some kind of warning when the interlocutor's key has been updated. It's also possible to check each others' identity by scanning some kind of QR Code. But the app does not really put any emphasis on which accounts have been verified. Signal is about as bad as WhatsApp. My guess a government that wants to spy on your WhatsApp/Signal messages probably could, because most people would notice the key change warning nor understand what it means. Only Apps which makes a big fuss about key management (Threema for example) are properly End to End encrypted, with no possibility for Big Gov to hack into servers and spy on you by adding their keys to conversations. But then they would probably just hack the OS on your phone at this stage. In fact that method, is probably better than messing around with iMessage/WhatsApp servers. You bypass ALL forms E2E encryption, and you get access to everything else, with one swift hack. I bet the NSA and their Chinese equivalents have such hacks in reserve for very juicy targets they want to spy on. With the kind of unlimited budget the NSA has, it's hard to imagine something they cannot hack. That is why big A-list targets like Bin Laden went totally off-grid for communication.

devxpy 7y ago

> companies can't protect us from a government we have put into power. But.. the electoral college.