5 ms·

If the email is genuine, then we are officially lost. Apple has gone from the company that refused to break into the San Bernadino shooter's phone (Anyone remem

If the email is genuine, then we are officially lost. Apple has gone from the company that refused to break into the San Bernadino shooter's phone (Anyone remember the feature by Last Week Tonight and Tim Cook talking about writing "the software equivalent of cancer"?) to the company that dutifully does what the authorities demand when they bring down the hammer over copyright claims.

pc86 5y ago
This comment shows a gross misunderstanding of the technical differences between 1) basically breaking encryption for all iPhones on the market simultaneously, and 2) copying a file.
- shockeychap 5y ago
  Only if the file contents are accessible. Why isn't end-to-end encryption utilized for storage of email on Apple's servers, the same way they do for iMessaging?
  - thinkmassive 5y ago
    Because 99.9999999% of emails are not encrypted before being sent.
    - shockeychap 5y ago
      True. But I’m not talking about end-to-end between sender and receiver. I’m just talking about using public key encryption to encrypt received contents with one key and decrypt with another. There are a lot of technical challenges - particularly with maintaining compatibility with email clients - but it can be done. The inability of MTAs to negotiate and utilize any kind of SSL-style encryption when relaying messages is also a gross travesty in the year 2021.
      - thinkmassive 5y ago
        According to Google, 82% of outbound email to other providers, and 93% of inbound from other providers, is encrypted in transit. https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview
  - vorticalbox 5y ago
    I read somewhere that Apple were going to encrypt backups but that would mean if a user lost their key the data would be lost and as such decided that for usability they would keep back ups as is.
justinclift 5y ago
And apparently the request to Apple happened in Feb 2019. So, not a recent change?
- titoCA321 5y ago
  No, not a recent change, except now she decided to post this letter on Twitter.
aeontech 5y ago
Apple has always been subject to US law, and as such, was always required to provide information that they do have access to. If it's in iCloud, most of it can be extracted by the law enforcement with court order. Nothing changed between now and the San Bernardino case. The difference was that FBI wanted Apple to compromise device encryption, which capability does _not_ exist now.
- shockeychap 5y ago
  So why hasn't end-to-end encryption been utilized for years with the storage of email and other files, like they do with iMessage content?
  - aeontech 5y ago
    You can certainly use E2E encryption (ie, S/MIME) for your email, whether it's using Apple Mail or not. I'm not sure what you suggest Apple can do about it if you don't use PGP/GPG on your side though (and yes, you can use S/MIME for email both with iOS and macOS). How Apple CloudKit security works is documented [0] and what Apple can provide to the law enforcement is pretty easily googleable [1], and has been subject to much media coverage over the years. All I was saying is that this is not some recent change. [0]: https://support.apple.com/en-gb/guide/security/sec3cac31735/web https://support.apple.com/en-gb/guide/security/sec3cac31735/... [1]: https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...
    - CRConrad 5y ago
      > You can certainly use E2E encryption (ie, S/MIME) for your email, whether it's using Apple Mail or not. I'm not sure what you suggest Apple can do about it if you don't use PGP/GPG on your side though (and yes, you can use S/MIME for email both with iOS and macOS). What Apple could do seems fairly obvious: Build it into their mail client and enable it by default, no?
      - aeontech 5y ago

pc86 5y ago

This comment shows a gross misunderstanding of the technical differences between 1) basically breaking encryption for all iPhones on the market simultaneously, and 2) copying a file.

shockeychap 5y ago
Only if the file contents are accessible. Why isn't end-to-end encryption utilized for storage of email on Apple's servers, the same way they do for iMessaging?
- thinkmassive 5y ago
  Because 99.9999999% of emails are not encrypted before being sent.
  - shockeychap 5y ago
    True. But I’m not talking about end-to-end between sender and receiver. I’m just talking about using public key encryption to encrypt received contents with one key and decrypt with another. There are a lot of technical challenges - particularly with maintaining compatibility with email clients - but it can be done. The inability of MTAs to negotiate and utilize any kind of SSL-style encryption when relaying messages is also a gross travesty in the year 2021.
    - thinkmassive 5y ago
      According to Google, 82% of outbound email to other providers, and 93% of inbound from other providers, is encrypted in transit. https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview
- vorticalbox 5y ago
  I read somewhere that Apple were going to encrypt backups but that would mean if a user lost their key the data would be lost and as such decided that for usability they would keep back ups as is.

justinclift 5y ago

And apparently the request to Apple happened in Feb 2019. So, not a recent change?

titoCA321 5y ago
No, not a recent change, except now she decided to post this letter on Twitter.

aeontech 5y ago

Apple has always been subject to US law, and as such, was always required to provide information that they do have access to. If it's in iCloud, most of it can be extracted by the law enforcement with court order. Nothing changed between now and the San Bernardino case. The difference was that FBI wanted Apple to compromise device encryption, which capability does _not_ exist now.

shockeychap 5y ago
So why hasn't end-to-end encryption been utilized for years with the storage of email and other files, like they do with iMessage content?
- aeontech 5y ago
  You can certainly use E2E encryption (ie, S/MIME) for your email, whether it's using Apple Mail or not. I'm not sure what you suggest Apple can do about it if you don't use PGP/GPG on your side though (and yes, you can use S/MIME for email both with iOS and macOS). How Apple CloudKit security works is documented [0] and what Apple can provide to the law enforcement is pretty easily googleable [1], and has been subject to much media coverage over the years. All I was saying is that this is not some recent change. [0]: https://support.apple.com/en-gb/guide/security/sec3cac31735/web https://support.apple.com/en-gb/guide/security/sec3cac31735/... [1]: https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...
  - CRConrad 5y ago
    > You can certainly use E2E encryption (ie, S/MIME) for your email, whether it's using Apple Mail or not. I'm not sure what you suggest Apple can do about it if you don't use PGP/GPG on your side though (and yes, you can use S/MIME for email both with iOS and macOS). What Apple could do seems fairly obvious: Build it into their mail client and enable it by default, no?
    - aeontech 5y ago