4 ms·

How do you know that apple is logging GeoIPs and performing this association with appleIDs? Or are you just saying it’s possible to do so?

novok 6y ago
With a datetime and IP, you can geoIP any time in the future. It's a single ETL operation. So you treat it like they do, one way or another.
- zepto 6y ago
  This assumes they don’t scrub it before storing it, which we know they do for some services, and we have no information about others. We can’t in fact treat it like they do. We can only treat it like they might be able to.
  - sneak 6y ago
    Anyone monitoring the traffic outside of Apple can do it, as well. IIRC TLS client certificate information is not encrypted on the wire, but I'd need to review modern TLS protocol negotiation to confirm. This would allow anyone monitoring Apple's upstream, passively, to perform this same location logging that Apple does. Apple knows this, so shipping systems that leak information in this way is tacit acceptance of the military spying going on on the networks to which Apple's servers are connected.
    - zepto 6y ago
      “Anyone monitoring the traffic outside of Apple can do it, as well” Well this is true of every single connection made by every single app on every single device, for every upstream. That means everyone is tacitly accepting the military spying going on on the networks to which their servers are connected. That’s not actually an unreasonable position as far as I’m concerned, and you previous comments about this being true unless Tor is embedded have some validity. I say some because I’m unconvinced that Tor is quite ready to handle all traffic yet. What is unreasonable is your focus on Apple. By excluding the fact that your complaints are a general problem with TCP/IP and apply to essentially any service, you don’t seem to be doing a great job of informing people about the reality of the problem. It’s also worth noting that if your position has now moved to how the tracking could be being done by someone monitoring Apple’s network rather than Apple themselves, you are tacitly acknowledging that your claim that Apple is keeping records of your location are just speculation.
MikeUt 6y ago
"There's a camera in your bathroom, but how do you know it's recording?"
zepto 6y ago
He’s just saying it’s possible to do so. This claim that Apple are tracking your location because they use TCP/IP to receive connections, has been made many times now. Nobody has so far presented evidence that Apple does in fact geolocate people or even that they persistently store IP address information related to user accounts. I don’t know for sure that they do not, but I do know that they are aware that keeping IP addresses is a potential privacy leak, and so at least some of their services are definitely designed to scrub ip addresses from records at the point of ingestion and replace them with anonymized keys before they are passed on to services within the company. So they know that keeping IP address logs is a potential privacy issue and are working to alleviate that. I would be surprised if they do this for everything yet, but as far as I can see Sneak is making only a theoretical accusation, and not one which he has more than speculation about. As far as I can see, statements like these... “Apple knows when you leave home, or arrive at the office, or travel to a different city, all with no Apple ID, no iCloud, and no location services. This has always been the case on all devices using iOS, too.”.. ...are complete bullshit as written, even though we can’t rule out the possibility. “ Apple doesn’t retain a history of what you’ve searched for or where you’ve been.” is on Apple’s privacy page here: https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/ So if someone can find evidence for such accusations, perhaps there is some legal liability for Apple.
- hu3 6y ago
  Perhaps Apple doesn't log your hardware UUID + IP. You'll have to take their word for it. But there's even less guarantee that the government doesn't log that information. After all, Apple dropped plans of implementing E2E encryption of iCloud backups after the FBI asked them [1]. So "Apple doesn't retain that info" might boil down to semantics since it might be allowing someone else to do it. [1] https://www.cnbc.com/2020/01/21/apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-say.html https://www.cnbc.com/2020/01/21/apple-dropped-plan-for-encry...
  - zepto 6y ago
    Well the iCloud backups not being encrypted yet is a serious problem. Weirdly, this isn’t news - anonymous sources have said before that it was due to FBI pressure. But this doesn’t have anything to do with Apple logging locations. If sneak’s claim was correct, there would be nothing we could do about it. If we’re talking about iCloud backups, at the very least you can turn those off and do them locally. I’m pretty sure that even if e2e backups do come, they won’t be on by default because of the problem of users managing their own keys.
sneak 6y ago
Apple has to log client IPs on these systems to prevent abuse, to stop people doing things like scraping every public key for every iMessage user and then publishing the diffs. IP to ISP/Location mapping is just a lookup table, and can be done at any time now or in the future.

novok 6y ago

With a datetime and IP, you can geoIP any time in the future. It's a single ETL operation. So you treat it like they do, one way or another.

zepto 6y ago
This assumes they don’t scrub it before storing it, which we know they do for some services, and we have no information about others. We can’t in fact treat it like they do. We can only treat it like they might be able to.
- sneak 6y ago
  Anyone monitoring the traffic outside of Apple can do it, as well. IIRC TLS client certificate information is not encrypted on the wire, but I'd need to review modern TLS protocol negotiation to confirm. This would allow anyone monitoring Apple's upstream, passively, to perform this same location logging that Apple does. Apple knows this, so shipping systems that leak information in this way is tacit acceptance of the military spying going on on the networks to which Apple's servers are connected.
  - zepto 6y ago
    “Anyone monitoring the traffic outside of Apple can do it, as well” Well this is true of every single connection made by every single app on every single device, for every upstream. That means everyone is tacitly accepting the military spying going on on the networks to which their servers are connected. That’s not actually an unreasonable position as far as I’m concerned, and you previous comments about this being true unless Tor is embedded have some validity. I say some because I’m unconvinced that Tor is quite ready to handle all traffic yet. What is unreasonable is your focus on Apple. By excluding the fact that your complaints are a general problem with TCP/IP and apply to essentially any service, you don’t seem to be doing a great job of informing people about the reality of the problem. It’s also worth noting that if your position has now moved to how the tracking could be being done by someone monitoring Apple’s network rather than Apple themselves, you are tacitly acknowledging that your claim that Apple is keeping records of your location are just speculation.

MikeUt 6y ago

"There's a camera in your bathroom, but how do you know it's recording?"

zepto 6y ago

He’s just saying it’s possible to do so. This claim that Apple are tracking your location because they use TCP/IP to receive connections, has been made many times now. Nobody has so far presented evidence that Apple does in fact geolocate people or even that they persistently store IP address information related to user accounts. I don’t know for sure that they do not, but I do know that they are aware that keeping IP addresses is a potential privacy leak, and so at least some of their services are definitely designed to scrub ip addresses from records at the point of ingestion and replace them with anonymized keys before they are passed on to services within the company. So they know that keeping IP address logs is a potential privacy issue and are working to alleviate that. I would be surprised if they do this for everything yet, but as far as I can see Sneak is making only a theoretical accusation, and not one which he has more than speculation about. As far as I can see, statements like these... “Apple knows when you leave home, or arrive at the office, or travel to a different city, all with no Apple ID, no iCloud, and no location services. This has always been the case on all devices using iOS, too.”.. ...are complete bullshit as written, even though we can’t rule out the possibility. “ Apple doesn’t retain a history of what you’ve searched for or where you’ve been.” is on Apple’s privacy page here: https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/ So if someone can find evidence for such accusations, perhaps there is some legal liability for Apple.

hu3 6y ago
Perhaps Apple doesn't log your hardware UUID + IP. You'll have to take their word for it. But there's even less guarantee that the government doesn't log that information. After all, Apple dropped plans of implementing E2E encryption of iCloud backups after the FBI asked them [1]. So "Apple doesn't retain that info" might boil down to semantics since it might be allowing someone else to do it. [1] https://www.cnbc.com/2020/01/21/apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-say.html https://www.cnbc.com/2020/01/21/apple-dropped-plan-for-encry...
- zepto 6y ago
  Well the iCloud backups not being encrypted yet is a serious problem. Weirdly, this isn’t news - anonymous sources have said before that it was due to FBI pressure. But this doesn’t have anything to do with Apple logging locations. If sneak’s claim was correct, there would be nothing we could do about it. If we’re talking about iCloud backups, at the very least you can turn those off and do them locally. I’m pretty sure that even if e2e backups do come, they won’t be on by default because of the problem of users managing their own keys.

sneak 6y ago

Apple has to log client IPs on these systems to prevent abuse, to stop people doing things like scraping every public key for every iMessage user and then publishing the diffs. IP to ISP/Location mapping is just a lookup table, and can be done at any time now or in the future.