4 ms·

Nothing about assymetric crypto mandates that a 3rd party cant manage the key. In this case, CCP has the key.

scarface74 7y ago
Do you have any proof that Apple rearchitected their system to send private keys that were only stored on their device back to Apple?
- lern_too_spel 7y ago
  The iCloud keys exist on the iCloud servers (which are under CCP control in China). That's how you can search your mail and documents from any device. If you want to change the subject and talk about iMessage instead of iCloud, the architecture of that system allows for the government to intercept all messages as well. https://www.wired.com/2015/09/apple-fighting-privacy-imessage-still-problems/ https://www.wired.com/2015/09/apple-fighting-privacy-imessag...
  - scarface74 7y ago
    I have not changed the subject. Apple clearly delineates which data is e2e encrypted and which data is not. Those same standards apply in the US and China - unless you have evidence otherwise. I no more trust my privacy to the US government than a Chinese citizen should trust China.
    - lern_too_spel 7y ago
      > I have not changed the subject. You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data, but you changed the subject to talk about systems where the private key is on device, which does not apply to iCloud. You absolutely did change the subject. > Those same standards apply in the US and China - unless you have evidence otherwise. Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. In the US, that is Apple, so Apple has access to that data. In China, that is the Chinese government. Therefore, the Chinese government has access to all Chinese iCloud and iMessage data. > I no more trust my privacy to the US government than a Chinese citizen should trust China. Then you are unfamiliar with the laws of both countries.
      - scarface74 7y ago
        You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. If the private key is generated by the same entity or “key server” that generates the public key, and then transmitted to the client. That kind of defeats the entire purpose of public/private key encryption. I’ve never seen an implementation of public/private key encryption where the client device doesn’t create the key pair and send only the public key to encrypt data.
        lern_too_spel 7y ago
        > If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” You have two mistakes in this sentence. 1. None of the iCloud data (mail, docs, drive, etc.) is E2E encrypted. Some of the data stored in iCloud (like keychain backups) is encrypted prior to being sent to iCloud (using symmetric encryption, not with asymmetric key pairs). China has access to the data that was ultimately sent to iCloud. 2. The way Apple implements E2E encryption for services like iMessage that are E2E encrypted allows China access to that data. > If the private key is generated by the same entity or “key server” that generates the public key, and then transmitted to the client. That's the point. Since Apple's implementation relies on a key server to distribute public keys, it is straightforward for the key server to generate its own key pair and serve a fraudulent public key to the recipient, decrypting and re-encrypting messages that the iMessage servers relay. Apple relies on the technical illiteracy of its users to get away with its deceptive and often plain false marketing claims. Now you know better.
        scarface74 7y ago
        The “key server” does not in fact “generate public keys”. It distributes public keys. But you can’t decrypt a message with public keys - that’s kind of the point... But after reading research from security experts you have found a citation where Apple is generating a key pair from its servers and sending the private key to the client?

Do you have any proof that Apple rearchitected their system to send private keys that were only stored on their device back to Apple?

lern_too_spel 7y ago
The iCloud keys exist on the iCloud servers (which are under CCP control in China). That's how you can search your mail and documents from any device. If you want to change the subject and talk about iMessage instead of iCloud, the architecture of that system allows for the government to intercept all messages as well. https://www.wired.com/2015/09/apple-fighting-privacy-imessage-still-problems/ https://www.wired.com/2015/09/apple-fighting-privacy-imessag...
- scarface74 7y ago
  I have not changed the subject. Apple clearly delineates which data is e2e encrypted and which data is not. Those same standards apply in the US and China - unless you have evidence otherwise. I no more trust my privacy to the US government than a Chinese citizen should trust China.
  - lern_too_spel 7y ago
    > I have not changed the subject. You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data, but you changed the subject to talk about systems where the private key is on device, which does not apply to iCloud. You absolutely did change the subject. > Those same standards apply in the US and China - unless you have evidence otherwise. Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. In the US, that is Apple, so Apple has access to that data. In China, that is the Chinese government. Therefore, the Chinese government has access to all Chinese iCloud and iMessage data. > I no more trust my privacy to the US government than a Chinese citizen should trust China. Then you are unfamiliar with the laws of both countries.
    - scarface74 7y ago
      You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. If the private key is generated by the same entity or “key server” that generates the public key, and then transmitted to the client. That kind of defeats the entire purpose of public/private key encryption. I’ve never seen an implementation of public/private key encryption where the client device doesn’t create the key pair and send only the public key to encrypt data.
      - lern_too_spel 7y ago
        > If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” You have two mistakes in this sentence. 1. None of the iCloud data (mail, docs, drive, etc.) is E2E encrypted. Some of the data stored in iCloud (like keychain backups) is encrypted prior to being sent to iCloud (using symmetric encryption, not with asymmetric key pairs). China has access to the data that was ultimately sent to iCloud. 2. The way Apple implements E2E encryption for services like iMessage that are E2E encrypted allows China access to that data. > If the private key is generated by the same entity or “key server” that generates the public key, and then transmitted to the client. That's the point. Since Apple's implementation relies on a key server to distribute public keys, it is straightforward for the key server to generate its own key pair and serve a fraudulent public key to the recipient, decrypting and re-encrypting messages that the iMessage servers relay. Apple relies on the technical illiteracy of its users to get away with its deceptive and often plain false marketing claims. Now you know better.
        scarface74 7y ago
        The “key server” does not in fact “generate public keys”. It distributes public keys. But you can’t decrypt a message with public keys - that’s kind of the point... But after reading research from security experts you have found a citation where Apple is generating a key pair from its servers and sending the private key to the client?