7 ms·

> But I agree with Ben Thompson's point in that blog post, that it's OK to not have strong, unbreakable encryption be the default, and that it's still possible

> But I agree with Ben Thompson's point in that blog post, that it's OK to not have strong, unbreakable encryption be the default, and that it's still possible to use an iPhone without iCloud and get full E2E. I disagree completely on this. For one, users aren't aware that using iCloud means that Apple has your decryption key and can thereby read and share all of your phone's data. And two, opt-out is a dark pattern. Particularly if you surround it with other hurdles, like long click-wrap and confusing UI, it's no longer a fair choice, but psychological manipulation to have users concede and accept. Third, as it's hinted, smarter criminals, the ones the FBI should actually worry about, will know to opt-out. So instead the vast majority of innocent users have their privacy violated in order to help authorities catch "dumb" criminals who could have very well been caught through countless other avenues. disclaimer: I just read Bruce Schneier's "Click Here To Kill Everybody" after the pipeline ransomware attack, and these points come straight from it.

cheschire 5y ago
I dunno, when I read the choices in iTunes about backups, I didn’t feel particularly manipulated. It seemed straight forward. Trade offs were clear to me. I guess some people just see dark patterns where I don’t.
- ElFitz 5y ago
  The least of the biases at play, here, is the change aversion bias. Making things "opt-out", without even making it hard, dramatically increases the number of people who opt-in. It can be used for many reasons. For example, the UK switched it’s organ donation laws from opt-in to opt-out. Another example, my government has decided that them selling their citizen's personal information to garages, insurance companies, etc, when we buy cars, should also be opt-out. So they freely sell the car make, acquisition date, buyer's name,… [1][2] Unless it has changed with GDPR. I’ve never bought a car. While we're on the topic of GDPR, that is exactly why it insists on making cookies, tracking, and the "sharing of information with partners" opt-in. And that is without hiding what you’re doing, making it unclear or confusing, or requiring multiple actions to change it. (Links in French, sorry) [1]: https://mobile.interieur.gouv.fr/Repertoire-des-informations-publiques/La-reutilisation-des-donnees-du-systeme-d-immatriculation-des-vehicules https://mobile.interieur.gouv.fr/Repertoire-des-informations... [2]: https://www.carte-grise.org/actus/2014/05-12-L-Etat-vends-les-donnees-des-cartes-grises.php https://www.carte-grise.org/actus/2014/05-12-L-Etat-vends-le...
  - jjgreen 5y ago
    For example, the UK switched its organ donation laws from opt-in to opt-out. We have, yet oddly, it's still called "organ donation".
    - grkvlt 5y ago
      don't be disingenuous - fairly obviously it is a donation because it is optional, voluntary and non-compensated.
      - mulmen 5y ago
        Is it really voluntary if it is opt-out?
        ElFitz 5y ago
        There’s a reason why they strongly encourage people to make their preference clearly known to family & friends. Because most often, when there’s even the sliver of a doubt on the deceased one's wishes, the corpse will keep all it’s organs to the grave / incinerator.
      - jjgreen 5y ago
        voluntary (adjective) done, made, or given willingly, without being forced or paid to do it (Cambridge) How is my will involved here?
        ElFitz 5y ago
        Because you only have to express it for it to be respected. Which is the bare minimum if you want others to be able to even consider respecting it. The default choice being, in the absence of any information, the one that increases chances of survival of actually living humans doesn’t seem misguided to me. —— If you want compulsory and overreaching (although not necessarily bad. Got no opinion on that aspect) rules, over here we: - can’t disinherit a descendant. The state decides the minimum each one of your genetic or legal relatives can get from your assets - have to financially support our adult children until an arbitrary time decided by the law - have to support and assist our parents and grand-parents if they can’t provide for themselves - basically can be legally compelled to financially assist any ascendant or descendant - may end up having to pay up after a divorce, even if you had an iron-clad contract, to compensate for the loss of QoL of the spouse with a lesser income
y7 5y ago
I agree. If Apple wants to go this route, they should abstain from pushing the user towards using iCloud as they currently do, and instead just present a clear opt-in choice. "Do you want to enable iCloud photos? Your private photos will be uploaded encrypted to Apple's servers, so that only you can access them. Before uploading, your photos will be locally scanned on your device for any illegal content. Apple will only be notified once a sufficient volume of illegal content is detected."
- bbarnett 5y ago
  Yes, but... An option like this, after the lawyers get at it, will be 14 pages long. "We can change this at any time", "except by court order", "no guarantee", "not liable", and on and on and on...
- oarsinsync 5y ago
  > Your private photos will be uploaded encrypted to Apple's servers, so that only you can access them. This would be a large change from the way it works today, where Apple can view your iCloud photos. They’ve not made any statements indicating that is going to change.
  - Nextgrid 5y ago
    I don't see any reason to implement CSAM scanning on-device as opposed to doing it on the server if it wasn't to switch to a model where the server doesn't have access to the data.
- mulmen 5y ago
  They moved away from the TimeCapsule model. If they were really committed to privacy there would be a small box you can put in your closet that provides iCloud storage functionality.
speleding 5y ago
As someone who frequently has to help older family members recover from lost passwords and broken phones, I sincerely hope they leave strong encryption of backups to be "opt out". It's fine if you know you want to be the sole person in the world who can get to your data and have the discipline to store master passwords, and you accept Apple support cannot help you even if you have a purchase receipt for the device. But for the average older person that's not a good default.
- londons_explore 5y ago
  > help older family members recover from lost passwords and broken phones, Apple just needs to design good UX to help these people. Perhaps a large cardboard 'key' comes with every phone. When first setting up the phone, you scan a QR code on it to encrypt your data with the key, and then you tell the owner that of they ever lose the key to their phone, they won't be able to get in again. People understand that - it's like losing the only key to a safe. From time to time you require them to rescan the key to verify they haven't lost it, and if they have, let them generate a new one.
  - WastingMyTime89 5y ago
    So you are suggesting making everyone life more cumbersome with the very likely potential of losing all the data on your phone because you lost a piece of cardboard or forgot a key for which benefit exactly? Being hypothetically safe for government scrutiny concerning information they could a dozen other way? I really like E2E encryption of messages with proper backups on my end. It's good to know the carrier of my messages can't scan them for advertising purpose. But for my phone if I know there is no way to easily get the data back if I have an issue that seems like a major hassle with very little upsides.
  - cameronbrown 5y ago
    Far easier to develop a culture of using something physical like yubikeys - over flimsy cardboard QR codes. The key metaphor makes a lot more sense that way, too.
  - 5y ago
kirillzubovsky 5y ago
Indeed, up until reading these comments I had no idea that iCloud wasn’t encrypted. Everything about Apples messaging makes you believe otherwise. That seems pretty disingenuous. Then again, 99% of consumers have very little choice that doesn’t include huddles and complicated setup. We all get the same moon goo, under a differ different brands. Good, bad, or just the fact of life?
- porpoisemonkey 5y ago
  > Indeed, up until reading these comments I had no idea that iCloud wasn’t encrypted. iCloud data is encrypted at rest (edit: except for Mail apparently). The type of encryption (service or end-to-end [E2E]) is specified here: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 It can be argued that from a user's viewpoint not having E2E encryption is tantamount to not having encryption at all, but from a technical standpoint the data is encrypted.
  - heavyset_go 5y ago
    It's encrypted at rest, but Apple has the decryption keys, and will give up your customer data when asked to by the government[1]. Also, iCloud photos are not encrypted[2]. [1] https://www.apple.com/legal/transparency/us.html https://www.apple.com/legal/transparency/us.html [2] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - porpoisemonkey 5y ago
      > Also, iCloud photos are not encrypted[2]. According to the table on the second link iCloud Photos are encrypted on the server (at rest). Am I missing something?
      - mulmen 5y ago
        They are encrypted at rest. This protects from someone hacking in to Apple, getting the data on disk but somehow not getting the keys, which Apple also possesses. Apple (and thus, LEO) absolutely can look at your photos on iCloud. What you are missing is that "encrypted at rest" is essentially "not encrypted in any meaningful way".

cheschire 5y ago

I dunno, when I read the choices in iTunes about backups, I didn’t feel particularly manipulated. It seemed straight forward. Trade offs were clear to me. I guess some people just see dark patterns where I don’t.

ElFitz 5y ago
The least of the biases at play, here, is the change aversion bias. Making things "opt-out", without even making it hard, dramatically increases the number of people who opt-in. It can be used for many reasons. For example, the UK switched it’s organ donation laws from opt-in to opt-out. Another example, my government has decided that them selling their citizen's personal information to garages, insurance companies, etc, when we buy cars, should also be opt-out. So they freely sell the car make, acquisition date, buyer's name,… [1][2] Unless it has changed with GDPR. I’ve never bought a car. While we're on the topic of GDPR, that is exactly why it insists on making cookies, tracking, and the "sharing of information with partners" opt-in. And that is without hiding what you’re doing, making it unclear or confusing, or requiring multiple actions to change it. (Links in French, sorry) [1]: https://mobile.interieur.gouv.fr/Repertoire-des-informations-publiques/La-reutilisation-des-donnees-du-systeme-d-immatriculation-des-vehicules https://mobile.interieur.gouv.fr/Repertoire-des-informations... [2]: https://www.carte-grise.org/actus/2014/05-12-L-Etat-vends-les-donnees-des-cartes-grises.php https://www.carte-grise.org/actus/2014/05-12-L-Etat-vends-le...
- jjgreen 5y ago
  For example, the UK switched its organ donation laws from opt-in to opt-out. We have, yet oddly, it's still called "organ donation".
  - grkvlt 5y ago
    don't be disingenuous - fairly obviously it is a donation because it is optional, voluntary and non-compensated.
    - mulmen 5y ago
      Is it really voluntary if it is opt-out?
      - ElFitz 5y ago
        There’s a reason why they strongly encourage people to make their preference clearly known to family & friends. Because most often, when there’s even the sliver of a doubt on the deceased one's wishes, the corpse will keep all it’s organs to the grave / incinerator.
    - jjgreen 5y ago
      voluntary (adjective) done, made, or given willingly, without being forced or paid to do it (Cambridge) How is my will involved here?
      - ElFitz 5y ago
        Because you only have to express it for it to be respected. Which is the bare minimum if you want others to be able to even consider respecting it. The default choice being, in the absence of any information, the one that increases chances of survival of actually living humans doesn’t seem misguided to me. —— If you want compulsory and overreaching (although not necessarily bad. Got no opinion on that aspect) rules, over here we: - can’t disinherit a descendant. The state decides the minimum each one of your genetic or legal relatives can get from your assets - have to financially support our adult children until an arbitrary time decided by the law - have to support and assist our parents and grand-parents if they can’t provide for themselves - basically can be legally compelled to financially assist any ascendant or descendant - may end up having to pay up after a divorce, even if you had an iron-clad contract, to compensate for the loss of QoL of the spouse with a lesser income

y7 5y ago

I agree. If Apple wants to go this route, they should abstain from pushing the user towards using iCloud as they currently do, and instead just present a clear opt-in choice. "Do you want to enable iCloud photos? Your private photos will be uploaded encrypted to Apple's servers, so that only you can access them. Before uploading, your photos will be locally scanned on your device for any illegal content. Apple will only be notified once a sufficient volume of illegal content is detected."

bbarnett 5y ago
Yes, but... An option like this, after the lawyers get at it, will be 14 pages long. "We can change this at any time", "except by court order", "no guarantee", "not liable", and on and on and on...
oarsinsync 5y ago
> Your private photos will be uploaded encrypted to Apple's servers, so that only you can access them. This would be a large change from the way it works today, where Apple can view your iCloud photos. They’ve not made any statements indicating that is going to change.
- Nextgrid 5y ago
  I don't see any reason to implement CSAM scanning on-device as opposed to doing it on the server if it wasn't to switch to a model where the server doesn't have access to the data.
mulmen 5y ago
They moved away from the TimeCapsule model. If they were really committed to privacy there would be a small box you can put in your closet that provides iCloud storage functionality.

speleding 5y ago

As someone who frequently has to help older family members recover from lost passwords and broken phones, I sincerely hope they leave strong encryption of backups to be "opt out". It's fine if you know you want to be the sole person in the world who can get to your data and have the discipline to store master passwords, and you accept Apple support cannot help you even if you have a purchase receipt for the device. But for the average older person that's not a good default.

londons_explore 5y ago
> help older family members recover from lost passwords and broken phones, Apple just needs to design good UX to help these people. Perhaps a large cardboard 'key' comes with every phone. When first setting up the phone, you scan a QR code on it to encrypt your data with the key, and then you tell the owner that of they ever lose the key to their phone, they won't be able to get in again. People understand that - it's like losing the only key to a safe. From time to time you require them to rescan the key to verify they haven't lost it, and if they have, let them generate a new one.
- WastingMyTime89 5y ago
  So you are suggesting making everyone life more cumbersome with the very likely potential of losing all the data on your phone because you lost a piece of cardboard or forgot a key for which benefit exactly? Being hypothetically safe for government scrutiny concerning information they could a dozen other way? I really like E2E encryption of messages with proper backups on my end. It's good to know the carrier of my messages can't scan them for advertising purpose. But for my phone if I know there is no way to easily get the data back if I have an issue that seems like a major hassle with very little upsides.
- cameronbrown 5y ago
  Far easier to develop a culture of using something physical like yubikeys - over flimsy cardboard QR codes. The key metaphor makes a lot more sense that way, too.
- 5y ago

kirillzubovsky 5y ago

Indeed, up until reading these comments I had no idea that iCloud wasn’t encrypted. Everything about Apples messaging makes you believe otherwise. That seems pretty disingenuous. Then again, 99% of consumers have very little choice that doesn’t include huddles and complicated setup. We all get the same moon goo, under a differ different brands. Good, bad, or just the fact of life?

porpoisemonkey 5y ago
> Indeed, up until reading these comments I had no idea that iCloud wasn’t encrypted. iCloud data is encrypted at rest (edit: except for Mail apparently). The type of encryption (service or end-to-end [E2E]) is specified here: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 It can be argued that from a user's viewpoint not having E2E encryption is tantamount to not having encryption at all, but from a technical standpoint the data is encrypted.
- heavyset_go 5y ago
  It's encrypted at rest, but Apple has the decryption keys, and will give up your customer data when asked to by the government[1]. Also, iCloud photos are not encrypted[2]. [1] https://www.apple.com/legal/transparency/us.html https://www.apple.com/legal/transparency/us.html [2] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - porpoisemonkey 5y ago
    > Also, iCloud photos are not encrypted[2]. According to the table on the second link iCloud Photos are encrypted on the server (at rest). Am I missing something?
    - mulmen 5y ago
      They are encrypted at rest. This protects from someone hacking in to Apple, getting the data on disk but somehow not getting the keys, which Apple also possesses. Apple (and thus, LEO) absolutely can look at your photos on iCloud. What you are missing is that "encrypted at rest" is essentially "not encrypted in any meaningful way".