12 ms·

"But [Apple executives] said they expected any [implication by malicious actors] attacks to be very rare and that in any case a review would then look for other

"But [Apple executives] said they expected any [implication by malicious actors] attacks to be very rare and that in any case a review would then look for other signs of criminal hacking." Oh, all right: Apple, already being in possession of hard evidence of a hideous crime and already being required by law to forward such evidence to proper authorities, will also - pro bono publico! - sacrifice significant amount of time of a significant number of their in-house computer forensics experts, each enjoying a significant billing rate, to relentlessly look for "other signs of criminal hacking", until there is no significant doubt that the accused is, indeed, guilty. We're all safe, then. I don't know whether to laugh or cry.

zionic 5y ago
It's going to take NSO spyware putting CP on apple execs personal devices to get them to understand... isn't it? Not that I would ever advocate for such a thing of course.
- deleted 5y ago
  [deleted]
tenpies 5y ago
I just don't understand how a 60 year old gay man doesn't see how insidious this all is, and somehow trusts law enforcement to be such a benevolent actor.
- adventured 5y ago
  Tim Cook isn't in charge. They're starting the process of complying with, acquiescing to, the multitudes of politicians in the West that are demanding a change in the super structure of online privacy and how it's treated. Anyone here think Yahoo executives actually decided whether the company joined PRISM or not? Those executives also were not in charge. There is a bigger boss in DC, radically more powerful, and most everybody here knows what they're after. They're sick of waiting, they're going to attempt to make another big surveillence move during the relative calm of the Biden Admin (they couldn't do it effectively under Trump, there was too much chaos, the government wasn't functioning very well). What program is actually being put into place right now - that Apple is probably joining up to, as with PRISM - that we won't find out about for many years? It's going to get a lot worse across the board over the coming decade.
  - notheretoo 5y ago
    Hell go back and check out what happened to quest over the carnivore shit. “Our” government has been pulling this shit since the 90s.
  - devwastaken 5y ago
    Apple hasn't made this argument, so this isn't why they're doing it. Don't create artificial reasons. If we were to base this on hypothetical law requirements apple might as well remove all forms of encryption too. But they're not.
    - thatguy0900 5y ago
      I mean, if it's true of course they wouldn't. No company was saying they were doing things because of prism, either. If there is a forced government cooperation they will be under a gag order.
    - cronix 5y ago
      Has Apple even once admitted knowing of, or that they participated in PRISM even when official documents were released showing that Apple joined PRISM just after Jobs died? Nope. None of the companies listed did, in fact they all publicly denied it because they are not allowed to by national security "law". So, how can Apple make any argument when they legally aren't allowed to talk about it? Do you think Cook believes in your privacy so much he will go to prison for revealing it? Nope, he's the one who let them in Apple to begin with and "privacy" is a sales pitch everyone laps up. They've been compromised for over a decade. There is no security. It's all lies on top of lies. Have you ever heard of what happens to people when they reveal top secret government spying programs? Snowden? Drake? Binney? Manning?
    - aksss 5y ago
      The presence or lack of an argument by Apple that they're being coerced by intelligence/LE agencies is not demonstrative of anything. You know that gag orders are a thing. You know that the programs revealed by Snowden were not the subject of disclosures by the participant organizations or any argument such as you're expecting Apple to make under the same conditions. All we know is what they do. It's not a stretch by any means to suspect that when an American corporation adopts uncharacteristic policies that violate their customers' privacy, the government is probably involved. Difference here is that unlike TrueCrypt, Apple can't just shut down. Hell, even the rumor of Apple doing this has beneficial impact to law enforcement. The press release may be the product. Let's take the effort at the most altruistic face value - defeating child porn mongers. If you're trying to herd such people to a very narrow set of solutions that you can monitor and/or control, simply undermining trust in the alternative options may be enough without actually implementing invasive tools being discussed. The comedy in some of this is how hammy the next act can get - if I were a cynical man, I'd expect a technology to come out in response to Apple's move, or maybe it's out there already but suddenly gets a new push for mindshare. I'm sure the security world has a term for solutions like this. Not really honey pots, but more like fly paper. A product the agencies have either straight up owned or surreptitiously gained control over, marketed to people who would use it for ill.
- lagadu 5y ago
  The privilege that comes from being as rich as he is overpowers anything else. From his perspective the system is always on his side (the good guy side), so that's his perspective for society in general.
- buttholesurfer 5y ago
  Maybe he just wanted to identify others like him?
- justinzollars 5y ago
  Maybe he has no choice. Maybe the government has threatened Apple? We don't see anything behind the curtain. One thing is certain. I've lost trust that the iphone is my device.
  - NotChina 5y ago
    It seems like a different Apple than the one that was previously so defiant to authoritarian abuses from the last administration.
    - nomel 5y ago
      If that's true, then doesn't that act as evidence that they are being forced in some way? Yahoo [1], and others, were forced with other programs, with threads of treason for talking about it [2]. 1. https://news.ycombinator.com/item?id=8305925 https://news.ycombinator.com/item?id=8305925 2. https://www.businessinsider.com/marissa-mayer-its-treason-to-ignore-the-nsa-2013-9 https://www.businessinsider.com/marissa-mayer-its-treason-to... Wow, very different search results when using google vs duckduckgo.
- res0nat0r 5y ago
  Apple being a trillion dollar company overrides all of that in the end.
- radicaldreamer 5y ago
  Do you think Tim Cook uses iCloud? They keep encrypted local backups over WiFi around as an iOS feature for a reason...
  - ornornor 5y ago
    How do you do that? It sounds very interesting.
    - finiteseries 5y ago
      Good old fashioned syncing with a Mac on the same local network. Don’t even have to use iTunes anymore, it’s all been moved to the Finder where the iPhone or iPad shows up as an external device.
- quickthrowman 5y ago
  It’s almost certainly his billion dollar net worth insulating him from the worries of the plebs, it’s my standard assumption when someone asks: “Why is (billionaire) seemingly out of touch?”
ren_engineer 5y ago
Apple is basically admitting their system is vulnerable to abuse but wishing/praying/hoping that people won't abuse it. Optimism isn't a security measure. This is like leaving your production database with default credentials and saying it's OK because people will do the right thing and follow the rules. seems like it almost confirms this system was created to make it easy to ruin people's lives, because you know plenty of bad actors will take advantage of this
- jonplackett 5y ago
  I read all the pitfalls of this and am convinced it's a bad idea, but what do you mean about people using it to ruin people's lives? How would someone misuse it in this way?
  - Arrath 5y ago
    Imagine one of these no-click zero-day iMessage exploits, but instead of taking over your phone it opens a share link and adds a gallery of illegal photos to your own device or cloud storage.
    - loriverkutya 5y ago
      They not going to go through Apple if they planted CP on your device, they going to take you to custody saying they got an anonymous tip or something along this line or just tip off the police to do the job for them because it worked in the past, requires less effort and maybe I'm wrong on this but there is no additional gain from going though all the hops when you can do it with an anonymous call. Also, if you have full access to somebody's phone, it does not matter if Apple is scanning for CP or not, you can do much more sophisticated things. Also 0-day non click exploits are not something random scriptkiddies running around with dropping CP on random phones as they are way too valuable.
      - Arrath 5y ago
        Certainly, twitch pranksters and 4chan trolls have shown its practically frictionless to SWAT someone and get the cops to raid their house, much easier than any convoluted hacking exercise engineered by a hollywood script writer. > there is no additional gain from going though all the hops The only thing I could see would be getting the victim locked out of their iCloud etc accounts with little/no immediate recourse, as from what I have read the process seems to be to lock their accounts as the CP detection alert is sent to law enforcement. > Also 0-day non click exploits are not something random scriptkiddies running around with dropping CP on random phones as they are way too valuable. I agree, 0-days are the far high end and wouldn't be used for things like this especially by trolls, but I have to imagine there are methods in the lower-hanging fruit levels available to malcontents to sneak content like this onto unsuspecting users devices. Like, custom ringtone/emoji apps and download packs, random QR codes that lead to downloading a place's menu but also a suspect image, or other usual suspects.
ianmiers 5y ago
This is a harmful distraction from the massive issues with Apple's proposal. If you wanted to frame someone for possession of CSAM, similar stunts can be pulled with Google, Facebook, Instagram, and Microsoft today. Yes, the scope here is broader and some people don't use any of those, but ....It's silly, and it makes the tech community look like a fringe minority of screeching conspiracy theorists. And this is a problem because Apple's proposal is really really awful. Apple is normalizing scanning your private phone for files and reporting them. They built the technical capability to do it for any photo, and they will be under enormous pressure to expand it both in the US and abroad. And the fact that they did it will be used to pressure other companies into doing the same and to legitimize laws that require scanning for any content the government can justify. Apple built a surveillance mechanism that is incredibly powerful. One no government could ever force a company to design and build. But once it's built, the only thing stoping it from being abused is Apple's pinky promise they won't let it happen. If you believe that legal norms, big tech companies and some quasi governmental nonprofit like NCMEC will stop such an abuse if it happens .... where have you been living the past few years? Because it sure isn't the US, the UK, Turkey, or China.
- skybrian 5y ago
  Is this actually different from other cloud photo apps? If you use Google Photos then your photos will likely be scanned by Google. If you use Apple’s photo app then their app will do the scanning. There seems to be a vague idea floating around that this is built into the OS or the device just because the scanning happens on the device, but it’s not clear that’s the case. Apple doesn’t make the distinction between OS and app clear either.
  - shadowgovt 5y ago
    Ironically, the difference is that Apple is doing it at the client layer so that they can't do it at the server layer; the user's iCloud [edit: photos, not all of iCloud] is encrypted at rest against Apple accessing it. This approach makes mass-sweeping of all server-side stored data harder to accomplish (whereas in, say, Google Photos, Google can break-glass server side to get into someone's private data, so they could hypothetically do a mass-scan if the government demanded it).

zionic 5y ago

It's going to take NSO spyware putting CP on apple execs personal devices to get them to understand... isn't it? Not that I would ever advocate for such a thing of course.

deleted 5y ago
[deleted]

tenpies 5y ago

I just don't understand how a 60 year old gay man doesn't see how insidious this all is, and somehow trusts law enforcement to be such a benevolent actor.

adventured 5y ago
Tim Cook isn't in charge. They're starting the process of complying with, acquiescing to, the multitudes of politicians in the West that are demanding a change in the super structure of online privacy and how it's treated. Anyone here think Yahoo executives actually decided whether the company joined PRISM or not? Those executives also were not in charge. There is a bigger boss in DC, radically more powerful, and most everybody here knows what they're after. They're sick of waiting, they're going to attempt to make another big surveillence move during the relative calm of the Biden Admin (they couldn't do it effectively under Trump, there was too much chaos, the government wasn't functioning very well). What program is actually being put into place right now - that Apple is probably joining up to, as with PRISM - that we won't find out about for many years? It's going to get a lot worse across the board over the coming decade.
- notheretoo 5y ago
  Hell go back and check out what happened to quest over the carnivore shit. “Our” government has been pulling this shit since the 90s.
- devwastaken 5y ago
  Apple hasn't made this argument, so this isn't why they're doing it. Don't create artificial reasons. If we were to base this on hypothetical law requirements apple might as well remove all forms of encryption too. But they're not.
  - thatguy0900 5y ago
    I mean, if it's true of course they wouldn't. No company was saying they were doing things because of prism, either. If there is a forced government cooperation they will be under a gag order.
  - cronix 5y ago
    Has Apple even once admitted knowing of, or that they participated in PRISM even when official documents were released showing that Apple joined PRISM just after Jobs died? Nope. None of the companies listed did, in fact they all publicly denied it because they are not allowed to by national security "law". So, how can Apple make any argument when they legally aren't allowed to talk about it? Do you think Cook believes in your privacy so much he will go to prison for revealing it? Nope, he's the one who let them in Apple to begin with and "privacy" is a sales pitch everyone laps up. They've been compromised for over a decade. There is no security. It's all lies on top of lies. Have you ever heard of what happens to people when they reveal top secret government spying programs? Snowden? Drake? Binney? Manning?
  - aksss 5y ago
    The presence or lack of an argument by Apple that they're being coerced by intelligence/LE agencies is not demonstrative of anything. You know that gag orders are a thing. You know that the programs revealed by Snowden were not the subject of disclosures by the participant organizations or any argument such as you're expecting Apple to make under the same conditions. All we know is what they do. It's not a stretch by any means to suspect that when an American corporation adopts uncharacteristic policies that violate their customers' privacy, the government is probably involved. Difference here is that unlike TrueCrypt, Apple can't just shut down. Hell, even the rumor of Apple doing this has beneficial impact to law enforcement. The press release may be the product. Let's take the effort at the most altruistic face value - defeating child porn mongers. If you're trying to herd such people to a very narrow set of solutions that you can monitor and/or control, simply undermining trust in the alternative options may be enough without actually implementing invasive tools being discussed. The comedy in some of this is how hammy the next act can get - if I were a cynical man, I'd expect a technology to come out in response to Apple's move, or maybe it's out there already but suddenly gets a new push for mindshare. I'm sure the security world has a term for solutions like this. Not really honey pots, but more like fly paper. A product the agencies have either straight up owned or surreptitiously gained control over, marketed to people who would use it for ill.
lagadu 5y ago
The privilege that comes from being as rich as he is overpowers anything else. From his perspective the system is always on his side (the good guy side), so that's his perspective for society in general.
buttholesurfer 5y ago
Maybe he just wanted to identify others like him?
justinzollars 5y ago
Maybe he has no choice. Maybe the government has threatened Apple? We don't see anything behind the curtain. One thing is certain. I've lost trust that the iphone is my device.
- NotChina 5y ago
  It seems like a different Apple than the one that was previously so defiant to authoritarian abuses from the last administration.
  - nomel 5y ago
    If that's true, then doesn't that act as evidence that they are being forced in some way? Yahoo [1], and others, were forced with other programs, with threads of treason for talking about it [2]. 1. https://news.ycombinator.com/item?id=8305925 https://news.ycombinator.com/item?id=8305925 2. https://www.businessinsider.com/marissa-mayer-its-treason-to-ignore-the-nsa-2013-9 https://www.businessinsider.com/marissa-mayer-its-treason-to... Wow, very different search results when using google vs duckduckgo.
res0nat0r 5y ago
Apple being a trillion dollar company overrides all of that in the end.
radicaldreamer 5y ago
Do you think Tim Cook uses iCloud? They keep encrypted local backups over WiFi around as an iOS feature for a reason...
- ornornor 5y ago
  How do you do that? It sounds very interesting.
  - finiteseries 5y ago
    Good old fashioned syncing with a Mac on the same local network. Don’t even have to use iTunes anymore, it’s all been moved to the Finder where the iPhone or iPad shows up as an external device.
quickthrowman 5y ago
It’s almost certainly his billion dollar net worth insulating him from the worries of the plebs, it’s my standard assumption when someone asks: “Why is (billionaire) seemingly out of touch?”

ren_engineer 5y ago

Apple is basically admitting their system is vulnerable to abuse but wishing/praying/hoping that people won't abuse it. Optimism isn't a security measure. This is like leaving your production database with default credentials and saying it's OK because people will do the right thing and follow the rules. seems like it almost confirms this system was created to make it easy to ruin people's lives, because you know plenty of bad actors will take advantage of this

jonplackett 5y ago
I read all the pitfalls of this and am convinced it's a bad idea, but what do you mean about people using it to ruin people's lives? How would someone misuse it in this way?
- Arrath 5y ago
  Imagine one of these no-click zero-day iMessage exploits, but instead of taking over your phone it opens a share link and adds a gallery of illegal photos to your own device or cloud storage.
  - loriverkutya 5y ago
    They not going to go through Apple if they planted CP on your device, they going to take you to custody saying they got an anonymous tip or something along this line or just tip off the police to do the job for them because it worked in the past, requires less effort and maybe I'm wrong on this but there is no additional gain from going though all the hops when you can do it with an anonymous call. Also, if you have full access to somebody's phone, it does not matter if Apple is scanning for CP or not, you can do much more sophisticated things. Also 0-day non click exploits are not something random scriptkiddies running around with dropping CP on random phones as they are way too valuable.
    - Arrath 5y ago
      Certainly, twitch pranksters and 4chan trolls have shown its practically frictionless to SWAT someone and get the cops to raid their house, much easier than any convoluted hacking exercise engineered by a hollywood script writer. > there is no additional gain from going though all the hops The only thing I could see would be getting the victim locked out of their iCloud etc accounts with little/no immediate recourse, as from what I have read the process seems to be to lock their accounts as the CP detection alert is sent to law enforcement. > Also 0-day non click exploits are not something random scriptkiddies running around with dropping CP on random phones as they are way too valuable. I agree, 0-days are the far high end and wouldn't be used for things like this especially by trolls, but I have to imagine there are methods in the lower-hanging fruit levels available to malcontents to sneak content like this onto unsuspecting users devices. Like, custom ringtone/emoji apps and download packs, random QR codes that lead to downloading a place's menu but also a suspect image, or other usual suspects.

ianmiers 5y ago

This is a harmful distraction from the massive issues with Apple's proposal. If you wanted to frame someone for possession of CSAM, similar stunts can be pulled with Google, Facebook, Instagram, and Microsoft today. Yes, the scope here is broader and some people don't use any of those, but ....It's silly, and it makes the tech community look like a fringe minority of screeching conspiracy theorists. And this is a problem because Apple's proposal is really really awful. Apple is normalizing scanning your private phone for files and reporting them. They built the technical capability to do it for any photo, and they will be under enormous pressure to expand it both in the US and abroad. And the fact that they did it will be used to pressure other companies into doing the same and to legitimize laws that require scanning for any content the government can justify. Apple built a surveillance mechanism that is incredibly powerful. One no government could ever force a company to design and build. But once it's built, the only thing stoping it from being abused is Apple's pinky promise they won't let it happen. If you believe that legal norms, big tech companies and some quasi governmental nonprofit like NCMEC will stop such an abuse if it happens .... where have you been living the past few years? Because it sure isn't the US, the UK, Turkey, or China.

skybrian 5y ago
Is this actually different from other cloud photo apps? If you use Google Photos then your photos will likely be scanned by Google. If you use Apple’s photo app then their app will do the scanning. There seems to be a vague idea floating around that this is built into the OS or the device just because the scanning happens on the device, but it’s not clear that’s the case. Apple doesn’t make the distinction between OS and app clear either.
- shadowgovt 5y ago
  Ironically, the difference is that Apple is doing it at the client layer so that they can't do it at the server layer; the user's iCloud [edit: photos, not all of iCloud] is encrypted at rest against Apple accessing it. This approach makes mass-sweeping of all server-side stored data harder to accomplish (whereas in, say, Google Photos, Google can break-glass server side to get into someone's private data, so they could hypothetically do a mass-scan if the government demanded it).