4 ms·

Apple having that information doesn't mean they don't care about protecting consumer privacy...they still have to KYC (Know Your Customer). The reason you can

Apple having that information doesn't mean they don't care about protecting consumer privacy...they still have to KYC (Know Your Customer). The reason you can trust Apple (for now) about protecting consumer privacy is that they aren't selling it to unknown third-parties make MORE money off of you. If Apple has your data its going to ONLY be used by Apple and only in ways you understand (at least that's the marketing push)

sneak 6y ago
> they still have to KYC (Know Your Customer). This is false. KYC regulations do not apply to app stores, only banking and financial services: regulated industries. Furthermore, nothing requires Apple restrict App Store downloads of free apps to logged in/registered users only. This is a hoop they make people jump through so that there is less friction at time of purchase of a paid app or (more importantly) a "free" app's IAP. It's a signupwall hustle. > The reason you can trust Apple (for now) about protecting consumer privacy is that they aren't selling it to unknown third-parties make MORE money off of you. Apple sent the data of over 30,000 users to the US government last year without a warrant or probable cause, per Apple's own transparency report (look under the FISA orders category—this is the stuff that Ed Snowden disclosed under the internal/classified codename PRISM). Data brokers can't cause federal prosecutors to harass me because I said something they didn't like. The federal government can.
- zepto 6y ago
  “Apple sent the data of over 30,000 users to the US government last year without a warrant or probable cause” When you say ‘the data’ - what do you mean? Taken at face value it sounds like you are saying all of the data Apple has relating to this user, but that doesn’t sound right to me. Is it all of the data? If not, what data was actually provided? When you say: “without a warrant or probable cause”, you make it sound as though Apple wasn’t legally compelled to do this. Is this true?
  - sneak 6y ago
    I think it is safe to assume that when Apple complies with a FISA demand for user data from the US military intelligence community, they are expected to produce 100% of the data that they have for the requested user. I made no such claim about Apple not being compelled. I did strongly imply, however, that being aware of this gaping privacy issue that is pointed at them, gun to the head style, that it is massively irresponsible for them to collect as much user data as they do, pretending it will be safe, when in reality they function as a repository of a tremendous amount user data that is available to the government at any time without a warrant. It is fair to say that as a result of these laws they are part of the vertically integrated surveillance state. They know this, and the fact that they continue to collect and store as much data about their users and their users activity and travel as they do makes them complicit in the surveillance. If Apple cared about the privacy of their users, they wouldn't have failed to fix their encryption backdoor (iCloud Backup), and they wouldn't be building a giant trove of activity history for every single Apple user that can be accessed on demand without a warrant. They also wouldn't have put special iCloud servers where the CCP can easily spy on them. "Compelled by law" is a dodge. They didn't have to create the circumstance where they had the data in the first place. On a side note: would you please stop cross-examining so many of my comments? It feels like you've singled me out for harassment. Your comment history doesn't indicate you do this to anyone else. In this instance you seem to be arguing against something I didn't even say. Please stop.
    - zepto 6y ago
      1. My understanding is that FISA requests data using warrants. So your statement that Apple divulges this information without a ‘warrant’ would be false if this is correct. 2. You once again repeat the outright lie that Apple is collecting a person’s travel history. All you are actually referring to is that they receive TCP connections and so know people’s IP addresses. Just like anyone else who operates any web service. In an earlier comment on this thread, you more honestly state that IP addresses can be used to infer coarse location data. This is correct. As we have discussed before, it’s a lie to claim that Apple is recording people’s travel history, because you have no evidence that these recordings are in fact being made. Only that they could be. It’s entirely possible that they never actually do perform geolocation on the log data, and that they scrub or anonymize IP addresses before storing them longer term. They state that they use such practices in general. I can’t prove that they use these practices with this data, so it would be a lie to say I know they don’t record people’s travel history, just as it is a lie every time you say they do. Please either provide evidence or stop repeating this lie. As far your comment that “Compelled By law is a dodge”. It’s not a dodge - either they are compelled by law, or they are not. You didn’t actually answer that question, I note. Not answering a question seems more obviously like a dodge! You gave the impression that they are not compelled by law, but I don’t think that is true. Also, this raises the question, what is being dodged? If Apple were giving out information about users without being compelled by law, then that would be a strong indicator that they didn’t care about privacy, but I don’t think this is true. As to ‘building a giant trove of activity history” about users - Aside from your lie about Apple recording people’s travel history, what ‘Activity History’ are you referring to here? It’s true that there could be a more sophisticated E2E mechanism to place most user data beyond Apple’s ability to provide it when compelled. It’s also true that iCloud backups are not secure. Users who have reason to be concerned about this should not opt-in to these backups. Apple should definitely provide a way for backups to be E2E encrypted. There is an unproven assertion that they haven’t done this due to pressure from the FBI. This may be true. It’s also true that your complaint about holding user data applies to almost every single YC company, and almost every single web service* . Perhaps you have some examples of companies that handle things the way I think we’d both like? I can’t think of a good one. There are obvious usability issues and technical challenges that need to be overcome in order to apply E2E to all data at rest. Even when they do roll it out, I expect it to be opt-in and progressive, much as FDE was rolled out slowly over many years. Users will need to make decisions to sacrifice things like the web versions of apps. The risk of data loss if handled incorrectly is much higher than the chance of innocently being one of the 30,000 people you say are targeted by FISA. This is not to downplay the concern. I think it’s very important that this problem be solved and I think Apple should be one of the leaders in solving it. Again, if you have an example of someone who has already solved all of these problems, that would be helpful Let’s not pretend this is trivial to do at scale. The fact that they haven’t solved problems that nobody else has solved either, is really evidence of very little. Also you say it’s safe to assume that FISA warrants require all data a provider has on a user. Is it? Do we have any evidence of that? I’m sure some requests are blanket requests, but do we know that they all are? Many could be superficial requests to eliminate or include people from one pool or another.

sneak 6y ago

> they still have to KYC (Know Your Customer). This is false. KYC regulations do not apply to app stores, only banking and financial services: regulated industries. Furthermore, nothing requires Apple restrict App Store downloads of free apps to logged in/registered users only. This is a hoop they make people jump through so that there is less friction at time of purchase of a paid app or (more importantly) a "free" app's IAP. It's a signupwall hustle. > The reason you can trust Apple (for now) about protecting consumer privacy is that they aren't selling it to unknown third-parties make MORE money off of you. Apple sent the data of over 30,000 users to the US government last year without a warrant or probable cause, per Apple's own transparency report (look under the FISA orders category—this is the stuff that Ed Snowden disclosed under the internal/classified codename PRISM). Data brokers can't cause federal prosecutors to harass me because I said something they didn't like. The federal government can.

zepto 6y ago
“Apple sent the data of over 30,000 users to the US government last year without a warrant or probable cause” When you say ‘the data’ - what do you mean? Taken at face value it sounds like you are saying all of the data Apple has relating to this user, but that doesn’t sound right to me. Is it all of the data? If not, what data was actually provided? When you say: “without a warrant or probable cause”, you make it sound as though Apple wasn’t legally compelled to do this. Is this true?
- sneak 6y ago
  I think it is safe to assume that when Apple complies with a FISA demand for user data from the US military intelligence community, they are expected to produce 100% of the data that they have for the requested user. I made no such claim about Apple not being compelled. I did strongly imply, however, that being aware of this gaping privacy issue that is pointed at them, gun to the head style, that it is massively irresponsible for them to collect as much user data as they do, pretending it will be safe, when in reality they function as a repository of a tremendous amount user data that is available to the government at any time without a warrant. It is fair to say that as a result of these laws they are part of the vertically integrated surveillance state. They know this, and the fact that they continue to collect and store as much data about their users and their users activity and travel as they do makes them complicit in the surveillance. If Apple cared about the privacy of their users, they wouldn't have failed to fix their encryption backdoor (iCloud Backup), and they wouldn't be building a giant trove of activity history for every single Apple user that can be accessed on demand without a warrant. They also wouldn't have put special iCloud servers where the CCP can easily spy on them. "Compelled by law" is a dodge. They didn't have to create the circumstance where they had the data in the first place. On a side note: would you please stop cross-examining so many of my comments? It feels like you've singled me out for harassment. Your comment history doesn't indicate you do this to anyone else. In this instance you seem to be arguing against something I didn't even say. Please stop.
  - zepto 6y ago
    1. My understanding is that FISA requests data using warrants. So your statement that Apple divulges this information without a ‘warrant’ would be false if this is correct. 2. You once again repeat the outright lie that Apple is collecting a person’s travel history. All you are actually referring to is that they receive TCP connections and so know people’s IP addresses. Just like anyone else who operates any web service. In an earlier comment on this thread, you more honestly state that IP addresses can be used to infer coarse location data. This is correct. As we have discussed before, it’s a lie to claim that Apple is recording people’s travel history, because you have no evidence that these recordings are in fact being made. Only that they could be. It’s entirely possible that they never actually do perform geolocation on the log data, and that they scrub or anonymize IP addresses before storing them longer term. They state that they use such practices in general. I can’t prove that they use these practices with this data, so it would be a lie to say I know they don’t record people’s travel history, just as it is a lie every time you say they do. Please either provide evidence or stop repeating this lie. As far your comment that “Compelled By law is a dodge”. It’s not a dodge - either they are compelled by law, or they are not. You didn’t actually answer that question, I note. Not answering a question seems more obviously like a dodge! You gave the impression that they are not compelled by law, but I don’t think that is true. Also, this raises the question, what is being dodged? If Apple were giving out information about users without being compelled by law, then that would be a strong indicator that they didn’t care about privacy, but I don’t think this is true. As to ‘building a giant trove of activity history” about users - Aside from your lie about Apple recording people’s travel history, what ‘Activity History’ are you referring to here? It’s true that there could be a more sophisticated E2E mechanism to place most user data beyond Apple’s ability to provide it when compelled. It’s also true that iCloud backups are not secure. Users who have reason to be concerned about this should not opt-in to these backups. Apple should definitely provide a way for backups to be E2E encrypted. There is an unproven assertion that they haven’t done this due to pressure from the FBI. This may be true. It’s also true that your complaint about holding user data applies to almost every single YC company, and almost every single web service* . Perhaps you have some examples of companies that handle things the way I think we’d both like? I can’t think of a good one. There are obvious usability issues and technical challenges that need to be overcome in order to apply E2E to all data at rest. Even when they do roll it out, I expect it to be opt-in and progressive, much as FDE was rolled out slowly over many years. Users will need to make decisions to sacrifice things like the web versions of apps. The risk of data loss if handled incorrectly is much higher than the chance of innocently being one of the 30,000 people you say are targeted by FISA. This is not to downplay the concern. I think it’s very important that this problem be solved and I think Apple should be one of the leaders in solving it. Again, if you have an example of someone who has already solved all of these problems, that would be helpful Let’s not pretend this is trivial to do at scale. The fact that they haven’t solved problems that nobody else has solved either, is really evidence of very little. Also you say it’s safe to assume that FISA warrants require all data a provider has on a user. Is it? Do we have any evidence of that? I’m sure some requests are blanket requests, but do we know that they all are? Many could be superficial requests to eliminate or include people from one pool or another.