5 ms·

Apple may still be controlling the encryption keys but this says nothing about sharing the keys if compelled to do so. > Can you quote the part of the article

Apple may still be controlling the encryption keys but this says nothing about sharing the keys if compelled to do so. > Can you quote the part of the article that states that Apple must give China private keys? Can you find a citation where a third party has found proof that Apple changed the iMessage architecture? Apple is smarter than to put some text on their official website saying that the Chinese government has access to all your data. The key here is that their Terms and Conditions state that they operate "...in accordance to local laws". This is a cop-out legalese way of saying "We abide by whatever the Chinese government tells us to do".

scarface74 7y ago
How can Apple share private keys it doesn’t have access to? Apple doesn’t control “private keys” you use to encrypt data. The keys wouldn’t be very private if that were the case. The entire idea behind public/private keys is that you keep access to your private key.
- president 7y ago
  You need to take a step back, take off your engineering hat, and realize that the issue is not about private keys. This is about a company (Apple) needing to follow the laws of the country that it operates in or else it is banned. It doesn't matter if Apple was selling bread or handbags, they MUST provide the government with data about their customers when compelled. This is the case with all companies operating in China, foreign or domestic.
  - scarface74 7y ago
    The only way it could follow the laws of the country would be to rearchitect its entire system and somehow send the private keys to its servers and save them. While technically they could do that, do you realize how much legal trouble they would be in in the US if they did so without disclosing it? Alternatively, they would have to have a special build of iOS for China. Also, none of the “citations” make mention that the Chinese law forces Apple to give private keys to China.
    - president 7y ago
      The questions you are posing make it clear that you don't understand the issue at hand, much less the broader context behind these data laws. Companies have invested much more $$$ and resources for much less reward. Also, everything is legal as long as your lawyers sign off.
      - scarface74 7y ago
        I perfectly understand how public/private key encryption works. Can you find any citations to support your specific claims that Apple is sending user’s private keys from their devices and giving those keys to China?
        president 7y ago
        Tell me how you think public/private keys helps Apple from skirting Chinese law that stipulates that they must provide access to user data.
        scarface74 7y ago
        It doesn’t by itself - but you have neither shown that Apple has surreptitiously uploaded user’s private keys in China or that it was required to do so.
        resfirestar 7y ago
        I think the overlooked answer in this conversation is that Apple doesn't need to modify their service for China at all. In in all countries, they hold the encryption keys for most user data. Only these things are E2E encrypted[1]: Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information QuickType Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords You might say "what about iMessage". The link has that answer, too: >Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. This means Apple can produce the data a government is looking for in virtually all cases, and that's probably good enough for China. [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

scarface74 7y ago

How can Apple share private keys it doesn’t have access to? Apple doesn’t control “private keys” you use to encrypt data. The keys wouldn’t be very private if that were the case. The entire idea behind public/private keys is that you keep access to your private key.

president 7y ago
You need to take a step back, take off your engineering hat, and realize that the issue is not about private keys. This is about a company (Apple) needing to follow the laws of the country that it operates in or else it is banned. It doesn't matter if Apple was selling bread or handbags, they MUST provide the government with data about their customers when compelled. This is the case with all companies operating in China, foreign or domestic.
- scarface74 7y ago
  The only way it could follow the laws of the country would be to rearchitect its entire system and somehow send the private keys to its servers and save them. While technically they could do that, do you realize how much legal trouble they would be in in the US if they did so without disclosing it? Alternatively, they would have to have a special build of iOS for China. Also, none of the “citations” make mention that the Chinese law forces Apple to give private keys to China.
  - president 7y ago
    The questions you are posing make it clear that you don't understand the issue at hand, much less the broader context behind these data laws. Companies have invested much more $$$ and resources for much less reward. Also, everything is legal as long as your lawyers sign off.
    - scarface74 7y ago
      I perfectly understand how public/private key encryption works. Can you find any citations to support your specific claims that Apple is sending user’s private keys from their devices and giving those keys to China?
      - president 7y ago
        Tell me how you think public/private keys helps Apple from skirting Chinese law that stipulates that they must provide access to user data.
        scarface74 7y ago
        It doesn’t by itself - but you have neither shown that Apple has surreptitiously uploaded user’s private keys in China or that it was required to do so.
        resfirestar 7y ago
        I think the overlooked answer in this conversation is that Apple doesn't need to modify their service for China at all. In in all countries, they hold the encryption keys for most user data. Only these things are E2E encrypted[1]: Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information QuickType Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords You might say "what about iMessage". The link has that answer, too: >Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. This means Apple can produce the data a government is looking for in virtually all cases, and that's probably good enough for China. [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303