4 ms·

The problem with this kind of "we don't do it" disclaimer, is that they send the information in a way that can be intercepted (OCSP is over HTTP). Even if the i

by vertis 6y ago

The problem with this kind of "we don't do it" disclaimer, is that they send the information in a way that can be intercepted (OCSP is over HTTP). Even if the information from those requests is only a partial picture, you can be certain that entities like the US intelligence services can slurp it and combine it with other data. If Snowden taught us anything it's that seemingly innocent metadata can be used at scale for a variety of unexpected things. This combined with Apple system services avoiding Little Snitch / Lulu and VPN software in Big Sur is a very dangerous step. How long is it going to be a until a journalist/activist is arrested or killed in an Authoritarian state because the VPN was sending most of the information except the Apple information?

totalZero 6y ago
I'm not even worried about US intelligence. They're deep in all of our butts anyway. What concerns me is that I can't travel with confidence that my non-web activity is obscured from host governments and ISPs.
- vertis 6y ago
  Ah, but I'm not from the US. The US intelligence is just an example anyway. You could insert any relatively competent and well resourced nation state.
mlindner 6y ago
It's more than a "we don't do it" disclaimer. They said they're changing the revocation detection to an encrypted protocol later this year and also giving users an option to opt out entirely. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 (See section "Privacy protections")
- vertis 6y ago
  It's good that they are making these changes, but they're only making them to save face, rather than proactively. Also (nitpick) it's 'over the next year' not 'later this year' given how late we are in the year those are two very different things. It could be 12 months of being vulnerable. This also does nothing for privilege they are affording their own apps to avoid VPNs and Firewalls, which has already been shown to be a security flaw (malicious software will then masquerade as the privileged software).

by vertis 6y ago

totalZero 6y ago

I'm not even worried about US intelligence. They're deep in all of our butts anyway. What concerns me is that I can't travel with confidence that my non-web activity is obscured from host governments and ISPs.

vertis 6y ago
Ah, but I'm not from the US. The US intelligence is just an example anyway. You could insert any relatively competent and well resourced nation state.

mlindner 6y ago

It's more than a "we don't do it" disclaimer. They said they're changing the revocation detection to an encrypted protocol later this year and also giving users an option to opt out entirely. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 (See section "Privacy protections")

vertis 6y ago
It's good that they are making these changes, but they're only making them to save face, rather than proactively. Also (nitpick) it's 'over the next year' not 'later this year' given how late we are in the year those are two very different things. It could be 12 months of being vulnerable. This also does nothing for privilege they are affording their own apps to avoid VPNs and Firewalls, which has already been shown to be a security flaw (malicious software will then masquerade as the privileged software).