5 ms·

End-to-end encryption only means something if you and whoever you intend to communicate with control the endpoints. With an iOS device, you don't: Apple control

End-to-end encryption only means something if you and whoever you intend to communicate with control the endpoints. With an iOS device, you don't: Apple controls the endpoint. You may have paid for the device, but Apple has exclusive control of the software. You don't have the ability to replace it with third-party software or even to audit the source code for the software Apple supplies and verify that it matches the binaries. Consequently, you have to assume that anything you put on the device has already been shared with Apple, simply because Apple's software has access to it. This move just makes their control over the operation of "your" device more explicit. The best for privacy would be E2EE where the backup software never even has access to the unencrypted data. In other words, the backup image(s) are created locally by auditable open-source (or at least source-available) software, encrypted and signed using a key or password known only to the device owner, and provided to the backup service as opaque blob(s). The backup service never has access to the raw data and is incapable of accessing or tampering with the content of the backup. Untrusted services would be restricted to have access to either plaintext data or the network—never both. Any network application wanting access to local photos, e.g. for sharing, would need to go through a privileged photo-choosing interface and would only be granted access to the selected photo(s). Even this has some concerns since the local photo software could embed information into unrelated photos to exfiltrate data to the network when those photos are shared, but you could at least compartmentalize the data to limit the potential for cross-contamination. Or, you know, just use a fully open device and open source software in the first place so you're not playing silly adversarial games with a device you rely on for everything.

ummonk 5y ago
> Or, you know, just use a fully open device and open source software in the first place so you're not playing silly adversarial games with a device you rely on for everything. Are you using open source hardware? And then how are you auditing the supply chain to ensure the hardware you're receiving matches the open sourced design?
- nybble41 5y ago
  Fully open source hardware with an audited supply chain would be ideal, yes. We're not quite there yet, though some groups are working on it, and a device like the PinePhone is a big step in the right direction. There is still a risk that components may be unknowingly compromised but at least you're not stuck running software on "your" device which is publicly acknowledged to place the manufacturer's interests above your own. It's still a good ideal to enforce compartmentalization and privilege separation, of course. That last sentence was aimed at knowingly running untrusted proprietary software and relying on compartmentalization alone—I didn't mean to imply that one should forego proper security architecture just because the hardware and software are a bit more open.

ummonk 5y ago

> Or, you know, just use a fully open device and open source software in the first place so you're not playing silly adversarial games with a device you rely on for everything. Are you using open source hardware? And then how are you auditing the supply chain to ensure the hardware you're receiving matches the open sourced design?

nybble41 5y ago
Fully open source hardware with an audited supply chain would be ideal, yes. We're not quite there yet, though some groups are working on it, and a device like the PinePhone is a big step in the right direction. There is still a risk that components may be unknowingly compromised but at least you're not stuck running software on "your" device which is publicly acknowledged to place the manufacturer's interests above your own. It's still a good ideal to enforce compartmentalization and privilege separation, of course. That last sentence was aimed at knowingly running untrusted proprietary software and relying on compartmentalization alone—I didn't mean to imply that one should forego proper security architecture just because the hardware and software are a bit more open.