4 ms·

Wonder what Apple's rationale is for acquiescing to requests for iCloud data while staunchly refusing to unlock physical devices. Could it simply be the idea t

by branon 6y ago

Wonder what Apple's rationale is for acquiescing to requests for iCloud data while staunchly refusing to unlock physical devices. Could it simply be the idea that data stored on iCloud is Apple's property and not yours, while a physical device is treated the other way around?

matthewdgreen 6y ago
Refusing to unlock physical devices is good publicity, since it helps with Apple's image as a privacy company. Cooperating with law enforcement to hand over iCloud backups means they don't pay much of a price for that publicity. I'm sure Apple justifies this around their iCloud user agreements and the fact that third-party stored data doesn't deserve as much protection, but: Android has deployed end-to-end encrypted backup based on a user-controlled PIN [1] and Apple has explicitly refused to do this despite having the tech in place [3], allegedly at the behest of the FBI [2]. Hard to look at this as anything but a deliberate business decision. [1] https://security.googleblog.com/2018/10/google-and-android-have-your-back-by.html https://security.googleblog.com/2018/10/google-and-android-h... [2] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT?il=0 https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... [3] https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.p...
- valuearb 6y ago
  Apple has already paid a far higher price than Google ever has for protecting their customers security.
  - matthewdgreen 6y ago
    My (small) dog once had a fight with a squirrel. She paid a high price at the time, and so she learned not to do that anymore. I'm certainly ok with her decision, but I would suggest that -- unlike my dog -- Apple has end-users who really need them to keep fighting. They can't sit back and revel in past glories.
    - valuearb 6y ago
      Not disagreeing, just offering a reason but not a justification for their reluctance to fully encrypt iCloud backups.
valuearb 6y ago
iCloud data is only secured by Apple controlled passwords. Your iDevice data is secured by your passcode which Apple does not possess, and it does not want to create backdoors on your iPhone to enable access. In the San Bernardino terrorist incident, the cops screwed up the procedure to recover iCloud backups on the device, then blamed Apple for refusing to hack the device security.
- jsiepkes 6y ago
  If Apple wanted they could implement iCloud in such a way that they couldn't decrypt the data. For example Tresorit ( https://tresorit.com/ https://tresorit.com/ ) works like that. It is kinda odd that for the iPhone they chose to implement it in such a way they can't access the data yet iCloud was designed in such a way they can. I guess one could argue that the phone is really property of the customer and Apple's servers obviously not. Though I would argue in both cases the data is the property of the customer.
  - valuearb 6y ago
    I think it’s fear of a government response, or possibly to give customers a last ditch way of recovering lost data. Either way it’s a hole they should address.
photoGrant 6y ago
One requires you to upload a non encrypted version of your data. So whilst it might mostly appear as optics of good faith, it’s actually two extremely different requests and goals. If you want your data private and to remain encrypted, you don’t enable icloud backups and Apple remain helpless to the government. At least as far as we know and are willing to ‘trust’.

by branon 6y ago

matthewdgreen 6y ago

Refusing to unlock physical devices is good publicity, since it helps with Apple's image as a privacy company. Cooperating with law enforcement to hand over iCloud backups means they don't pay much of a price for that publicity. I'm sure Apple justifies this around their iCloud user agreements and the fact that third-party stored data doesn't deserve as much protection, but: Android has deployed end-to-end encrypted backup based on a user-controlled PIN [1] and Apple has explicitly refused to do this despite having the tech in place [3], allegedly at the behest of the FBI [2]. Hard to look at this as anything but a deliberate business decision. [1] https://security.googleblog.com/2018/10/google-and-android-have-your-back-by.html https://security.googleblog.com/2018/10/google-and-android-h... [2] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT?il=0 https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... [3] https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.p...

valuearb 6y ago
Apple has already paid a far higher price than Google ever has for protecting their customers security.
- matthewdgreen 6y ago
  My (small) dog once had a fight with a squirrel. She paid a high price at the time, and so she learned not to do that anymore. I'm certainly ok with her decision, but I would suggest that -- unlike my dog -- Apple has end-users who really need them to keep fighting. They can't sit back and revel in past glories.
  - valuearb 6y ago
    Not disagreeing, just offering a reason but not a justification for their reluctance to fully encrypt iCloud backups.

valuearb 6y ago

iCloud data is only secured by Apple controlled passwords. Your iDevice data is secured by your passcode which Apple does not possess, and it does not want to create backdoors on your iPhone to enable access. In the San Bernardino terrorist incident, the cops screwed up the procedure to recover iCloud backups on the device, then blamed Apple for refusing to hack the device security.

jsiepkes 6y ago
If Apple wanted they could implement iCloud in such a way that they couldn't decrypt the data. For example Tresorit ( https://tresorit.com/ https://tresorit.com/ ) works like that. It is kinda odd that for the iPhone they chose to implement it in such a way they can't access the data yet iCloud was designed in such a way they can. I guess one could argue that the phone is really property of the customer and Apple's servers obviously not. Though I would argue in both cases the data is the property of the customer.
- valuearb 6y ago
  I think it’s fear of a government response, or possibly to give customers a last ditch way of recovering lost data. Either way it’s a hole they should address.

photoGrant 6y ago

One requires you to upload a non encrypted version of your data. So whilst it might mostly appear as optics of good faith, it’s actually two extremely different requests and goals. If you want your data private and to remain encrypted, you don’t enable icloud backups and Apple remain helpless to the government. At least as far as we know and are willing to ‘trust’.