12 ms·

Regarding #1: iCloud in China is operated by a mainland Chinese company and subject to that company's terms and conditions. So you can pretty much assume iCloud

Regarding #1: iCloud in China is operated by a mainland Chinese company and subject to that company's terms and conditions. So you can pretty much assume iCloud data is completely accessible by the government. Source: https://support.apple.com/en-us/HT208351 https://support.apple.com/en-us/HT208351

scarface74 7y ago
Apple uses third party data centers, if it can't host encrypted data on a Chinese server without China having access to the data, there is something wrong with the encryption.
- president 7y ago
  I would urge you to read up on the Chinese cryptography law [1] which took effect on the 1st of this year. Essentially all companies foreign or not must provide unencrypted access to data to the Chinese government and must do so in secrecy. Prior to this, companies were being compelled to give up their data anyways but this just makes things easier. By the way, the source below is an official Chinese government media source. [1] http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm
  - scarface74 7y ago
    Do you have any evidence that Apple rearchitected their system to have access to private keys that it doesn’t have access to anywhere, to have access to give it to China?
    - president 7y ago
      Technology is irrelevant here. Laws (or in China, the Chinese Communist Party) govern these things.
      - scarface74 7y ago
        So technology is irrelevant when it comes to the entire architecture of how public/private key encryption works?
        president 7y ago
        No. How the technology works is irrelevant when the end result is that the government wants the data. If your boss asks you to build a machine that produces a widget, does he really care what your code looks like? Probably not. In the same vein, Apple can figure out whatever solution they want, whether it involves conventional use of encryption keys or not, to provide a system where the Chinese government can get access to their users' data. It's really not that hard.
        scarface74 7y ago
        Do you have any proof? Any citations from security experts?
        president 7y ago
        It doesn't take Bruce Schneier to understand how laws work.
        scarface74 7y ago
        And you still haven’t provided proof that it is required or that Apple has uploaded users private keys or given up private keys.
        president 7y ago
        At this point, you're either a shill or a troll or did not earn your high school GED.
    - DevKoala 7y ago
      > It is the latest development in a pattern of Apple acquiescing to Beijing’s demands. Last July, Apple deleted VPN apps from the App Store that let mainland Chinese internet users evade censorship. Apple’s lawyers have also added a clause in the Chinese terms of service that states both Apple and GCBD may access all user data. Apple has not responded to requests for comment. > Meanwhile, Chinese laws do not protect internet users’ privacy from government intrusion. In 2015, China passed a National Security Law, which included a provision to give police the authority to demand companies let them bypass encryption or other security tools to access personal data. The National People’s Congress was not available to comment. https://www.theverge.com/2018/2/28/17055088/apple-chinese-icloud-accounts-government-privacy-speed https://www.theverge.com/2018/2/28/17055088/apple-chinese-ic...
      - scarface74 7y ago
        Well, after actually reading the Reuter’s article that the verge citation is based on... Apple says the joint venture does not mean that China has any kind of “backdoor” into user data and that Apple alone – not its Chinese partner – will control the encryption keys. But Chinese customers will notice some differences from the start: their iCloud accounts will now be co-branded with the name of the local partner, a first for Apple.
    - commoner 7y ago
      > And even though Chinese iPhones will retain the security features that can make it all but impossible for anyone, even Apple, to get access to the phone itself, that will not apply to the iCloud accounts. Any information in the iCloud account could be accessible to Chinese authorities who can present Apple with a legal order. > Apple said it will only respond to valid legal requests in China, but China’s domestic legal process is very different than that in the U.S., lacking anything quite like an American “warrant” reviewed by an independent court, Chinese legal experts said. Court approval isn’t required under Chinese law and police can issue and execute warrants. https://www.reuters.com/article/us-china-apple-icloud-insight/apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSKCN1G8060 https://www.reuters.com/article/us-china-apple-icloud-insigh...
      - scarface74 7y ago
        Apple says the joint venture does not mean that China has any kind of “backdoor” into user data and that Apple alone – not its Chinese partner – will control the encryption keys. But Chinese customers will notice some differences from the start: their iCloud accounts will now be co-branded with the name of the local partner, a first for Apple.
        commoner 7y ago
        From the same article: > That means Chinese authorities will no longer have to use the U.S. courts to seek information on iCloud users and can instead use their own legal system to ask Apple to hand over iCloud data for Chinese users, legal experts said. U.S. courts are highly unlikely to order Apple to release iCloud data to Chinese officials. Any cases would be public and attract international media attention. For Chinese iCloud users, that makes all the difference.
        scarface74 7y ago
        How many countries have laws that state user data must not be in foreign data centers? Every company in the US has to comply when it’s ordered by the court to give up user data. The US justice system is not exactly a shining light on the hill when it comes to needing a high bar to give investigators search warrants. All someone has to do is say “terrorism”, “drugs” or “protect the children” and courts will fall over backwards. Also from the same article: Until now, Apple appears to have handed over very little data about Chinese users. From mid-2013 to mid-2017, Apple said it did not give customer account content to Chinese authorities, despite having received 176 requests, according to transparency reports published by the company. By contrast, Apple has given the United States customer account content in response to 2,366 out of 8,475 government requests. You have much more faith in the US justice system than I do.
  - mdjasper 7y ago
    I've just read the article you linked[1], as well as several others [2][3][4] and cannot find any information about this: >all companies foreign or not must provide unencrypted access to data to the Chinese government and must do so in secrecy either plainly stated or implied. Can you provide a source for this claim? I don't doubt that this may occur, but I'd like to speak with _my own_ managers about my china & encryption concerns in an informed way. [1] http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm [2]https://www.insideprivacy.com/data-security/china-enacts-encryption-law/ https://www.insideprivacy.com/data-security/china-enacts-enc... [3]https://thediplomat.com/2019/10/decoding-chinas-cryptography-law/ https://thediplomat.com/2019/10/decoding-chinas-cryptography... [4]https://www.iflr.com/Article/3907570/PRIMER-Chinas-cryptography-law.html https://www.iflr.com/Article/3907570/PRIMER-Chinas-cryptogra...
    - president 7y ago
      This is the most in-depth article I've seen on the topic: https://www.chinalawblog.com/2019/11/chinas-new-cryptography-law-still-no-place-to-hide.html https://www.chinalawblog.com/2019/11/chinas-new-cryptography....
      - scarface74 7y ago
        Care to post which part of the article says that companies must give Chins user’s private keys?
- xvector 7y ago
  It would be trivial for the Chinese gov't to sniff RAM or the bus and get everything they need anyways.
  - scarface74 7y ago
    What exactly are they going to “sniff”? Private keys never leave your device.
    - lern_too_spel 7y ago
      The keys that encrypt the iCloud data are never on your device. They don't even need to sniff the keys. They control them.
      - scarface74 7y ago
        Apple clearly lists which data is e2e encrypted and which isn’t. The keys that encrypt e2e data is not stored on Apple’s servers.
        lern_too_spel 7y ago
        And we were talking about iCloud data here. So why were you claiming the keys were on the device?
        scarface74 7y ago
        And that doesn’t make the statement untrue. Apple clearly lists which data stored on its servers are e2e encrypted. Those are all considered “iCloud data”.
- lern_too_spel 7y ago
  The keys exist on machines managed by the third party, which is controlled by the state. Therefore, the state has access to the data. Edit: Apple itself has stated that the keys are in China. The option of having Apple devices talk through the Great Firewall to servers in the US that then encrypt the data for storage in China (and on the querying end, request encrypted data from China to decrypt and process in the US to serve back to devices through the Great Firewall) that Apple apologists wishfully theorize is every bit as ridiculous as it sounds. https://www.reuters.com/article/china-apple-icloud/rpt-insight-apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSL2N1QG01R https://www.reuters.com/article/china-apple-icloud/rpt-insig...
  - scarface74 7y ago
    The private keys don’t in fact “exist on machines managed by a third party”. That’s kind of the entire concept of public/private key encryption.
    - djohnston 7y ago
      Nothing about assymetric crypto mandates that a 3rd party cant manage the key. In this case, CCP has the key.
      - scarface74 7y ago
        Do you have any proof that Apple rearchitected their system to send private keys that were only stored on their device back to Apple?
        lern_too_spel 7y ago
        The iCloud keys exist on the iCloud servers (which are under CCP control in China). That's how you can search your mail and documents from any device. If you want to change the subject and talk about iMessage instead of iCloud, the architecture of that system allows for the government to intercept all messages as well. https://www.wired.com/2015/09/apple-fighting-privacy-imessage-still-problems/ https://www.wired.com/2015/09/apple-fighting-privacy-imessag...
- commoner 7y ago
  > On Wednesday, Apple officially handed over its iCloud operation in China to a local state-run company, along with all encryption keys to unlock local user data. The switch will give the Chinese government unfettered access to the photos, emails and contacts of over 240 million iPhone users in China. https://observer.com/2018/03/apple-grants-china-full-control-icloud-data/ https://observer.com/2018/03/apple-grants-china-full-control... > "The simple fact is that once the encryption keys are stored on Chinese servers, they will be easier for Chinese authorities to access — with or without legal requests," says Sharon Hom, executive director of Human Rights in China, a US-based NGO. "Since Apple has declared its willingness to 'comply with Chinese law,' its reassurance that it, not its Chinese partner, would control the encryption keys is not exactly reassuring. In addition, Chinese authorities could bypass Apple to address their requests directly to Apple’s Chinese partner, a state-owned enterprise that, of course, would have to cooperate with Chinese authorities." https://www.wired.co.uk/article/apple-icloud-china-iphone-data-privacy https://www.wired.co.uk/article/apple-icloud-china-iphone-da...

scarface74 7y ago

Apple uses third party data centers, if it can't host encrypted data on a Chinese server without China having access to the data, there is something wrong with the encryption.

president 7y ago
I would urge you to read up on the Chinese cryptography law [1] which took effect on the 1st of this year. Essentially all companies foreign or not must provide unencrypted access to data to the Chinese government and must do so in secrecy. Prior to this, companies were being compelled to give up their data anyways but this just makes things easier. By the way, the source below is an official Chinese government media source. [1] http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm
- scarface74 7y ago
  Do you have any evidence that Apple rearchitected their system to have access to private keys that it doesn’t have access to anywhere, to have access to give it to China?
  - president 7y ago
    Technology is irrelevant here. Laws (or in China, the Chinese Communist Party) govern these things.
    - scarface74 7y ago
      So technology is irrelevant when it comes to the entire architecture of how public/private key encryption works?
      - president 7y ago
        No. How the technology works is irrelevant when the end result is that the government wants the data. If your boss asks you to build a machine that produces a widget, does he really care what your code looks like? Probably not. In the same vein, Apple can figure out whatever solution they want, whether it involves conventional use of encryption keys or not, to provide a system where the Chinese government can get access to their users' data. It's really not that hard.
        scarface74 7y ago
        Do you have any proof? Any citations from security experts?
        president 7y ago
        It doesn't take Bruce Schneier to understand how laws work.
        scarface74 7y ago
        And you still haven’t provided proof that it is required or that Apple has uploaded users private keys or given up private keys.
        president 7y ago
        At this point, you're either a shill or a troll or did not earn your high school GED.
  - DevKoala 7y ago
    > It is the latest development in a pattern of Apple acquiescing to Beijing’s demands. Last July, Apple deleted VPN apps from the App Store that let mainland Chinese internet users evade censorship. Apple’s lawyers have also added a clause in the Chinese terms of service that states both Apple and GCBD may access all user data. Apple has not responded to requests for comment. > Meanwhile, Chinese laws do not protect internet users’ privacy from government intrusion. In 2015, China passed a National Security Law, which included a provision to give police the authority to demand companies let them bypass encryption or other security tools to access personal data. The National People’s Congress was not available to comment. https://www.theverge.com/2018/2/28/17055088/apple-chinese-icloud-accounts-government-privacy-speed https://www.theverge.com/2018/2/28/17055088/apple-chinese-ic...
    - scarface74 7y ago
      Well, after actually reading the Reuter’s article that the verge citation is based on... Apple says the joint venture does not mean that China has any kind of “backdoor” into user data and that Apple alone – not its Chinese partner – will control the encryption keys. But Chinese customers will notice some differences from the start: their iCloud accounts will now be co-branded with the name of the local partner, a first for Apple.
  - commoner 7y ago
    > And even though Chinese iPhones will retain the security features that can make it all but impossible for anyone, even Apple, to get access to the phone itself, that will not apply to the iCloud accounts. Any information in the iCloud account could be accessible to Chinese authorities who can present Apple with a legal order. > Apple said it will only respond to valid legal requests in China, but China’s domestic legal process is very different than that in the U.S., lacking anything quite like an American “warrant” reviewed by an independent court, Chinese legal experts said. Court approval isn’t required under Chinese law and police can issue and execute warrants. https://www.reuters.com/article/us-china-apple-icloud-insight/apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSKCN1G8060 https://www.reuters.com/article/us-china-apple-icloud-insigh...
    - scarface74 7y ago
      Apple says the joint venture does not mean that China has any kind of “backdoor” into user data and that Apple alone – not its Chinese partner – will control the encryption keys. But Chinese customers will notice some differences from the start: their iCloud accounts will now be co-branded with the name of the local partner, a first for Apple.
      - commoner 7y ago
        From the same article: > That means Chinese authorities will no longer have to use the U.S. courts to seek information on iCloud users and can instead use their own legal system to ask Apple to hand over iCloud data for Chinese users, legal experts said. U.S. courts are highly unlikely to order Apple to release iCloud data to Chinese officials. Any cases would be public and attract international media attention. For Chinese iCloud users, that makes all the difference.
        scarface74 7y ago
        How many countries have laws that state user data must not be in foreign data centers? Every company in the US has to comply when it’s ordered by the court to give up user data. The US justice system is not exactly a shining light on the hill when it comes to needing a high bar to give investigators search warrants. All someone has to do is say “terrorism”, “drugs” or “protect the children” and courts will fall over backwards. Also from the same article: Until now, Apple appears to have handed over very little data about Chinese users. From mid-2013 to mid-2017, Apple said it did not give customer account content to Chinese authorities, despite having received 176 requests, according to transparency reports published by the company. By contrast, Apple has given the United States customer account content in response to 2,366 out of 8,475 government requests. You have much more faith in the US justice system than I do.
- mdjasper 7y ago
  I've just read the article you linked[1], as well as several others [2][3][4] and cannot find any information about this: >all companies foreign or not must provide unencrypted access to data to the Chinese government and must do so in secrecy either plainly stated or implied. Can you provide a source for this claim? I don't doubt that this may occur, but I'd like to speak with _my own_ managers about my china & encryption concerns in an informed way. [1] http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm [2]https://www.insideprivacy.com/data-security/china-enacts-encryption-law/ https://www.insideprivacy.com/data-security/china-enacts-enc... [3]https://thediplomat.com/2019/10/decoding-chinas-cryptography-law/ https://thediplomat.com/2019/10/decoding-chinas-cryptography... [4]https://www.iflr.com/Article/3907570/PRIMER-Chinas-cryptography-law.html https://www.iflr.com/Article/3907570/PRIMER-Chinas-cryptogra...
  - president 7y ago
    This is the most in-depth article I've seen on the topic: https://www.chinalawblog.com/2019/11/chinas-new-cryptography-law-still-no-place-to-hide.html https://www.chinalawblog.com/2019/11/chinas-new-cryptography....
    - scarface74 7y ago
      Care to post which part of the article says that companies must give Chins user’s private keys?
xvector 7y ago
It would be trivial for the Chinese gov't to sniff RAM or the bus and get everything they need anyways.
- scarface74 7y ago
  What exactly are they going to “sniff”? Private keys never leave your device.
  - lern_too_spel 7y ago
    The keys that encrypt the iCloud data are never on your device. They don't even need to sniff the keys. They control them.
    - scarface74 7y ago
      Apple clearly lists which data is e2e encrypted and which isn’t. The keys that encrypt e2e data is not stored on Apple’s servers.
      - lern_too_spel 7y ago
        And we were talking about iCloud data here. So why were you claiming the keys were on the device?
        scarface74 7y ago
        And that doesn’t make the statement untrue. Apple clearly lists which data stored on its servers are e2e encrypted. Those are all considered “iCloud data”.
lern_too_spel 7y ago
The keys exist on machines managed by the third party, which is controlled by the state. Therefore, the state has access to the data. Edit: Apple itself has stated that the keys are in China. The option of having Apple devices talk through the Great Firewall to servers in the US that then encrypt the data for storage in China (and on the querying end, request encrypted data from China to decrypt and process in the US to serve back to devices through the Great Firewall) that Apple apologists wishfully theorize is every bit as ridiculous as it sounds. https://www.reuters.com/article/china-apple-icloud/rpt-insight-apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSL2N1QG01R https://www.reuters.com/article/china-apple-icloud/rpt-insig...
- scarface74 7y ago
  The private keys don’t in fact “exist on machines managed by a third party”. That’s kind of the entire concept of public/private key encryption.
  - djohnston 7y ago
    Nothing about assymetric crypto mandates that a 3rd party cant manage the key. In this case, CCP has the key.
    - scarface74 7y ago
      Do you have any proof that Apple rearchitected their system to send private keys that were only stored on their device back to Apple?
      - lern_too_spel 7y ago
        The iCloud keys exist on the iCloud servers (which are under CCP control in China). That's how you can search your mail and documents from any device. If you want to change the subject and talk about iMessage instead of iCloud, the architecture of that system allows for the government to intercept all messages as well. https://www.wired.com/2015/09/apple-fighting-privacy-imessage-still-problems/ https://www.wired.com/2015/09/apple-fighting-privacy-imessag...
commoner 7y ago
> On Wednesday, Apple officially handed over its iCloud operation in China to a local state-run company, along with all encryption keys to unlock local user data. The switch will give the Chinese government unfettered access to the photos, emails and contacts of over 240 million iPhone users in China. https://observer.com/2018/03/apple-grants-china-full-control-icloud-data/ https://observer.com/2018/03/apple-grants-china-full-control... > "The simple fact is that once the encryption keys are stored on Chinese servers, they will be easier for Chinese authorities to access — with or without legal requests," says Sharon Hom, executive director of Human Rights in China, a US-based NGO. "Since Apple has declared its willingness to 'comply with Chinese law,' its reassurance that it, not its Chinese partner, would control the encryption keys is not exactly reassuring. In addition, Chinese authorities could bypass Apple to address their requests directly to Apple’s Chinese partner, a state-owned enterprise that, of course, would have to cooperate with Chinese authorities." https://www.wired.co.uk/article/apple-icloud-china-iphone-data-privacy https://www.wired.co.uk/article/apple-icloud-china-iphone-da...