4 ms·

The keys exist on machines managed by the third party, which is controlled by the state. Therefore, the state has access to the data. Edit: Apple itself has st

The keys exist on machines managed by the third party, which is controlled by the state. Therefore, the state has access to the data. Edit: Apple itself has stated that the keys are in China. The option of having Apple devices talk through the Great Firewall to servers in the US that then encrypt the data for storage in China (and on the querying end, request encrypted data from China to decrypt and process in the US to serve back to devices through the Great Firewall) that Apple apologists wishfully theorize is every bit as ridiculous as it sounds. https://www.reuters.com/article/china-apple-icloud/rpt-insight-apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSL2N1QG01R https://www.reuters.com/article/china-apple-icloud/rpt-insig...

scarface74 7y ago
The private keys don’t in fact “exist on machines managed by a third party”. That’s kind of the entire concept of public/private key encryption.
- djohnston 7y ago
  Nothing about assymetric crypto mandates that a 3rd party cant manage the key. In this case, CCP has the key.
  - scarface74 7y ago
    Do you have any proof that Apple rearchitected their system to send private keys that were only stored on their device back to Apple?
    - lern_too_spel 7y ago
      The iCloud keys exist on the iCloud servers (which are under CCP control in China). That's how you can search your mail and documents from any device. If you want to change the subject and talk about iMessage instead of iCloud, the architecture of that system allows for the government to intercept all messages as well. https://www.wired.com/2015/09/apple-fighting-privacy-imessage-still-problems/ https://www.wired.com/2015/09/apple-fighting-privacy-imessag...
      - scarface74 7y ago
        I have not changed the subject. Apple clearly delineates which data is e2e encrypted and which data is not. Those same standards apply in the US and China - unless you have evidence otherwise. I no more trust my privacy to the US government than a Chinese citizen should trust China.
        lern_too_spel 7y ago
        > I have not changed the subject. You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data, but you changed the subject to talk about systems where the private key is on device, which does not apply to iCloud. You absolutely did change the subject. > Those same standards apply in the US and China - unless you have evidence otherwise. Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. In the US, that is Apple, so Apple has access to that data. In China, that is the Chinese government. Therefore, the Chinese government has access to all Chinese iCloud and iMessage data. > I no more trust my privacy to the US government than a Chinese citizen should trust China. Then you are unfamiliar with the laws of both countries.
        scarface74 7y ago
        You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. If the private key is generated by the same entity or “key server” that generates the public key, and then transmitted to the client. That kind of defeats the entire purpose of public/private key encryption. I’ve never seen an implementation of public/private key encryption where the client device doesn’t create the key pair and send only the public key to encrypt data.
        lern_too_spel 7y ago

scarface74 7y ago

The private keys don’t in fact “exist on machines managed by a third party”. That’s kind of the entire concept of public/private key encryption.

djohnston 7y ago
Nothing about assymetric crypto mandates that a 3rd party cant manage the key. In this case, CCP has the key.
- scarface74 7y ago
  Do you have any proof that Apple rearchitected their system to send private keys that were only stored on their device back to Apple?
  - lern_too_spel 7y ago
    The iCloud keys exist on the iCloud servers (which are under CCP control in China). That's how you can search your mail and documents from any device. If you want to change the subject and talk about iMessage instead of iCloud, the architecture of that system allows for the government to intercept all messages as well. https://www.wired.com/2015/09/apple-fighting-privacy-imessage-still-problems/ https://www.wired.com/2015/09/apple-fighting-privacy-imessag...
    - scarface74 7y ago
      I have not changed the subject. Apple clearly delineates which data is e2e encrypted and which data is not. Those same standards apply in the US and China - unless you have evidence otherwise. I no more trust my privacy to the US government than a Chinese citizen should trust China.
      - lern_too_spel 7y ago
        > I have not changed the subject. You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data, but you changed the subject to talk about systems where the private key is on device, which does not apply to iCloud. You absolutely did change the subject. > Those same standards apply in the US and China - unless you have evidence otherwise. Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. In the US, that is Apple, so Apple has access to that data. In China, that is the Chinese government. Therefore, the Chinese government has access to all Chinese iCloud and iMessage data. > I no more trust my privacy to the US government than a Chinese citizen should trust China. Then you are unfamiliar with the laws of both countries.
        scarface74 7y ago
        You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. If the private key is generated by the same entity or “key server” that generates the public key, and then transmitted to the client. That kind of defeats the entire purpose of public/private key encryption. I’ve never seen an implementation of public/private key encryption where the client device doesn’t create the key pair and send only the public key to encrypt data.
        lern_too_spel 7y ago