7 ms·

A better headline - users willing to give up privacy for convenience. Reality - there was a period where the icloud backups created backups that apple did not

A better headline - users willing to give up privacy for convenience. Reality - there was a period where the icloud backups created backups that apple did not have access to. Critically, this mean that if you had any of a wide variety of things happen - unless you were very good about key management - your content was lost for good. ALL your photos (which could be heartbreaking) etc. It turns out this is NOT what people want. They want apple to have access to their content, so when they have a device stolen and don't have a super long recovery key properly saved, they are not hosed. Same issue BTW with bitlocker on windows. People DO NOT save those recovery keys, even if they should. Microsoft added a way to force a backup into an account admins and others would have access to, thank goodness, because otherwise users there would be hosed as well.

gxs 5y ago
This is an insightful comment. Whenever someone loses their account the first thing they do is run to the vendor and flip their shit when the vendor is unable to do anything. I imagine from a business perspective it’s just better to keep access to data, sometimes without nefarious reasons like advertising, rather just keeping customers happy.
- threatofrain 5y ago
  A bit of a tangent, but I happened to flip my shit when my folks laptop was stolen, and the thief placed a password protection on it that Apple refused to lift, despite Apple having the technical capability to do so. They had records of my folks purchasing the laptop, but they argued that state ID's and credit cards can be faked and stolen, and were thus inadequate for their internal security purposes.
  - judge2020 5y ago
    Your post is very light on details. Did they just place a new password on the device itself? If so, you can still use the laptop if you reinstall MacOS. It is only is rendered a brick if the attacker signed into their own iCloud account and enabled Find My, OR the attacker enabled Find My & enabled the recovery key feature on the existing Apple ID (meaning Apple can't let you log into the account without the key).
    - threatofrain 5y ago
      This was on OS X with one of the older touchbar Macbook Pro models, but there's some kind of password protection which can prompt you for a password before the usual visuals of the OS booting up.
      - threeseed 5y ago
        Pretty sure this is FileVault full disk encryption. And so you can still use the computer just not keep your data.
        Wowfunhappy 5y ago
        No, it's also possible to set a firmware password, which pops up if you try to boot from any disk other than the startup disk. If you also can't log into any user accounts on the startup disk, there's no way in!
  - threeseed 5y ago
    Apple is right here though. Those cards are easily forged and there is nothing you can realistically do to prove the laptop is yours without also allowing thieves/criminals to prove it's theirs. And so they have to err on the side of caution. The onus lies on you to keep backups.
    - threatofrain 5y ago
      You can't backup a laptop, only your data. The laptop costs a lot. What Apple was "protecting" is the hardware value of the laptop, not any data. Also, Apple eventually unlocked the laptop.
      - threeseed 5y ago
        But you can always boot into Recovery mode and wipe the disk. In this case you are wanting to keep the data as well.
        threatofrain 5y ago
        There was no interest to keep the data, only the hardware, which Apple initially refused to unlock. I wanted my parents to be able to do this via Apple support, and not by themselves.
    - webmobdev 5y ago
      My experience has been different - Apple support asked me to email them the invoice copy of purchase to verify ownership of an Apple device.
- dylan604 5y ago
  >I imagine from a business perspective Regardless of the reasoning, if you have this ability, you can and will be compelled to give up that information. Therefore, it is best to not have that information or STFU about being concerned about privacy.
- PhantomGremlin 5y ago
  Whenever someone loses their account the first thing they do is run to the vendor and flip their shit when the vendor is unable to do anything. They certainly turn to Apple for help, but I think it's sometimes simply despair and not flipping their shit. E.g. I was once in an Apple store and the Genius was trying to help someone who, for some inexplicable reason, did everything in the Guest account of her laptop. The laptop rebooted for some reason (maybe she said OK to install updates?), and she lost the contents of Guest. Which means she lost everything. Vendors like Apple need to be prepared for all sorts of data loss scenarios. Ordinary users simply don't think about computers the same way as engineers do.
akomtu 5y ago
That's essentially a "Switzerland bank" from the movies that keeps a box on your behalf and doesn't ask silly questions. So I wonder if there's an unfilled niche of such "data storage bank" where you give them a blob of data, they store it for you and you trust them not to look inside. This could be also a useful application of those NFTs: an NFT contains a key and by nature of NFTs, the key has one owner at a time and the key is also transferrable.
amelius 5y ago
They should at least offer users the possibility to get true privacy if they so wish. Blaming the existence of this backdoor on the behavior of the average user is not correct. What's next, selling my data to the highest bidder because the average user doesn't care? Also, calling this "E2EE" is against the unwritten rules of the profession.
- ummonk 5y ago
  That option is there, and very simple. You just turn off iCloud backup to get true privacy.
  - hash872 5y ago
    No, because if the party you're messaging has iCloud backup on (a good chance), or is on Android, or has their device physically accessed somehow- a third party can read all of the messages that you sent them. There is no 'true privacy'
    - JadeNB 5y ago
      > No, because if the party you're messaging has iCloud backup on (a good chance), or is on Android, or has their device physically accessed somehow- a third party can read all of the messages that you sent them. There is no 'true privacy' This is surely true no matter how strong the encryption scheme, though. If you share your content with anyone else, then your security is only as strong as theirs.
    - threeseed 5y ago
      Messages are not stored in iCloud Backup by default. You have to explicitly enable it.
      - ummonk 5y ago
        They are actually. iCloud backup stores the messages by default. If you go and set Messages to use iCloud sync, then they're synced end to end encrypted. Apple then removes the messages from the iCloud backup, and instead stores a backup of the end to end encryption key for Messages. If you want your messages to be truly inaccessible to Apple / agencies with warrants (and also unrecoverable after losing end to end encryption access), then you have to turn off iCloud backup. Apple's documentation needs to be a little clearer on this but the system is basically designed with the accurate notion that the biggest footgun for 90% of users is not "the government was able to access my messages with a warrant" but rather "I lost access to my end to end encrypted messages".
upbeat_general 5y ago
You're conflating the convenience of backing up vs being able to access data even with lost recovery keys. People are certainly choosing convenience over privacy in that any backup is preferable to no backup. However, Apple does not give the option to choose E2E or not so users cannot make that choice of privacy vs convenience. You're assuming that people choosing iCloud over not-iCloud means people do not want E2E. It may be the case that people prefer E2E but this is not evidence of it. Furthermore, I don't believe iCloud backups were ever E2E and that it was a feature that was removed. Apple states which iCloud services are E2E[0] and these services I'd argue are pretty straightforward to setup and not lose. Most of the time you don't need a recovery key, just to be logged in on another device. Even if it is the case that most users do not want E2E, there's certainly a large audience (outside of just the HN bubble) that do want it. They could make it optional. [0]: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
phreack 5y ago
I once saw the kind of support emails a friend got while working CS for an encrypted media storage service. Every single day, someone new was demanding, many times threatening legal action, that the company recovered their encrypted media. It was set up so only the user had the keys, and there was literally no way for the company to recover data without them - something that was a particular selling point of the service, constantly made explicit in many different ways and places. I wouldn't have believed that things were this bad had I not seen it first hand.
- XorNot 5y ago
  Given that Shamir secret sharing exists, it seems like this should be a problem you can turn around on the user though: instead of just "we'll keep your keys escrowed" it should be "please nominate N trusted friends to recover your keys" with an option (that is highlighted) to let the company be able to do this too. There's a heck of a lot here which generally feels like a problem where the user isn't ever adequately briefed on what's happening and why, and isn't given reasonable options. People are very familiar with the idea of giving a house key to a friend, but for some reason we don't offer the substantially better options we have in this regard when it comes to encryption.
deleted 5y ago
[deleted]
- frosted-flakes 5y ago
  "Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - deleted 5y ago
    [deleted]
deleted 5y ago
[deleted]
ksec 5y ago
>Reality - there was a period where the icloud backups created backups that apple did not have access to. If my memory serves me correct iCloud Backup was designed as such since Day 1 ( iOS 5 ) so Apple could help its customer when they loss their phone. Is there any links to suggest Apple changed their Backup access?
- treesprite82 5y ago
  Apple did once plan to allow encrypting backups, but dropped the plan when the FBI complained: https://www.bbc.co.uk/news/technology-51207744 https://www.bbc.co.uk/news/technology-51207744 I don't think whoknowswhat11's account (that there was a period where backups were encrypted but it was removed because users didn't want it) is accurate.
  - beermonster 5y ago
    I dropped my plan to use Cloud Backups when Apple dropped their plan to protect their users. If you want to know it’s safe, either don’t share it with a third party and hang onto that data yourself. Or alternatively, client-side encrypt it to be sure.
    - ksec 5y ago
      I still remember why I had to use iCloud Backup. It was the safest way to restore my data between iPhone upgrade. I had seen more than a dozen iTunes Backup corruption where the backup is completely useless. And this problem exist even today. And it seems the chances of happening is higher on Windows PC. iCloud isn't without flaws I have seen three iCloud Backup suggesting it is corrupted. But there is often a backup from previous days as iCloud dont overwrite backup. Given the lower chances of happening I had to use iCloud.
      - beermonster 5y ago
        I’ve never once used an iCloud Backup or even local backup between iPhone upgrades. I always set it up as a new phone and don’t migrate any old settings across. I make the odd encrypted local backup just as a recovery point but my RTO is measured in years TBH.
donmcronald 5y ago
> Same issue BTW with bitlocker on windows. People DO NOT save those recovery keys, even if they should. Microsoft added a way to force a backup into an account admins and others would have access to, thank goodness, because otherwise users there would be hosed as well. I know someone that got a drive recovered once and they had no idea what BitLocker is. They were pretty happy to have the key saved in their MS account.
- brewdad 5y ago
  I had this happen to me once on my Surface Go tablet. I had no idea that BitLocker was enabled, whether I did it at initial setup and didn't remember or it was on by default. One day it refused to boot until I entered a key that I had no idea even existed. Fortunately, I was able to log in to my MS account and retrieve the key.
Threeve303 5y ago
> Users willing to give up privacy for convenience. It’s not possible to give up that which you do not have. And the convenience isn’t for the users
lodonnell9213 5y ago
Bitlocker (enterprise setup) is different, you can backup into AD, and also have network unlock (requires a connection to dc that’s wired) However I agree, I heavily use iMessage, it’s convenient because when I used signal I didn’t get notifications. However, Apple has had the decryption keys server side for ages, and I believe the reason they don’t have E2EE is purely because users don’t store their backup keys, and kick off when they loose all their life that’s stored in iCloud, and it’s just not worth the hassle to the support team, my family is the same with 1Password, they don’t backup their secret key thing, so I have to either store it or restore their account. Bitlocker doesn’t help in this regard either, you can bypass the mandatory saving section by using print to PDF to store the recovery file to the encrypted drive, essentially locking a safe with the key inside.

gxs 5y ago

This is an insightful comment. Whenever someone loses their account the first thing they do is run to the vendor and flip their shit when the vendor is unable to do anything. I imagine from a business perspective it’s just better to keep access to data, sometimes without nefarious reasons like advertising, rather just keeping customers happy.

threatofrain 5y ago
A bit of a tangent, but I happened to flip my shit when my folks laptop was stolen, and the thief placed a password protection on it that Apple refused to lift, despite Apple having the technical capability to do so. They had records of my folks purchasing the laptop, but they argued that state ID's and credit cards can be faked and stolen, and were thus inadequate for their internal security purposes.
- judge2020 5y ago
  Your post is very light on details. Did they just place a new password on the device itself? If so, you can still use the laptop if you reinstall MacOS. It is only is rendered a brick if the attacker signed into their own iCloud account and enabled Find My, OR the attacker enabled Find My & enabled the recovery key feature on the existing Apple ID (meaning Apple can't let you log into the account without the key).
  - threatofrain 5y ago
    This was on OS X with one of the older touchbar Macbook Pro models, but there's some kind of password protection which can prompt you for a password before the usual visuals of the OS booting up.
    - threeseed 5y ago
      Pretty sure this is FileVault full disk encryption. And so you can still use the computer just not keep your data.
      - Wowfunhappy 5y ago
        No, it's also possible to set a firmware password, which pops up if you try to boot from any disk other than the startup disk. If you also can't log into any user accounts on the startup disk, there's no way in!
- threeseed 5y ago
  Apple is right here though. Those cards are easily forged and there is nothing you can realistically do to prove the laptop is yours without also allowing thieves/criminals to prove it's theirs. And so they have to err on the side of caution. The onus lies on you to keep backups.
  - threatofrain 5y ago
    You can't backup a laptop, only your data. The laptop costs a lot. What Apple was "protecting" is the hardware value of the laptop, not any data. Also, Apple eventually unlocked the laptop.
    - threeseed 5y ago
      But you can always boot into Recovery mode and wipe the disk. In this case you are wanting to keep the data as well.
      - threatofrain 5y ago
        There was no interest to keep the data, only the hardware, which Apple initially refused to unlock. I wanted my parents to be able to do this via Apple support, and not by themselves.
  - webmobdev 5y ago
    My experience has been different - Apple support asked me to email them the invoice copy of purchase to verify ownership of an Apple device.
dylan604 5y ago
>I imagine from a business perspective Regardless of the reasoning, if you have this ability, you can and will be compelled to give up that information. Therefore, it is best to not have that information or STFU about being concerned about privacy.
PhantomGremlin 5y ago
Whenever someone loses their account the first thing they do is run to the vendor and flip their shit when the vendor is unable to do anything. They certainly turn to Apple for help, but I think it's sometimes simply despair and not flipping their shit. E.g. I was once in an Apple store and the Genius was trying to help someone who, for some inexplicable reason, did everything in the Guest account of her laptop. The laptop rebooted for some reason (maybe she said OK to install updates?), and she lost the contents of Guest. Which means she lost everything. Vendors like Apple need to be prepared for all sorts of data loss scenarios. Ordinary users simply don't think about computers the same way as engineers do.

akomtu 5y ago

That's essentially a "Switzerland bank" from the movies that keeps a box on your behalf and doesn't ask silly questions. So I wonder if there's an unfilled niche of such "data storage bank" where you give them a blob of data, they store it for you and you trust them not to look inside. This could be also a useful application of those NFTs: an NFT contains a key and by nature of NFTs, the key has one owner at a time and the key is also transferrable.

amelius 5y ago

They should at least offer users the possibility to get true privacy if they so wish. Blaming the existence of this backdoor on the behavior of the average user is not correct. What's next, selling my data to the highest bidder because the average user doesn't care? Also, calling this "E2EE" is against the unwritten rules of the profession.

ummonk 5y ago
That option is there, and very simple. You just turn off iCloud backup to get true privacy.
- hash872 5y ago
  No, because if the party you're messaging has iCloud backup on (a good chance), or is on Android, or has their device physically accessed somehow- a third party can read all of the messages that you sent them. There is no 'true privacy'
  - JadeNB 5y ago
    > No, because if the party you're messaging has iCloud backup on (a good chance), or is on Android, or has their device physically accessed somehow- a third party can read all of the messages that you sent them. There is no 'true privacy' This is surely true no matter how strong the encryption scheme, though. If you share your content with anyone else, then your security is only as strong as theirs.
  - threeseed 5y ago
    Messages are not stored in iCloud Backup by default. You have to explicitly enable it.
    - ummonk 5y ago
      They are actually. iCloud backup stores the messages by default. If you go and set Messages to use iCloud sync, then they're synced end to end encrypted. Apple then removes the messages from the iCloud backup, and instead stores a backup of the end to end encryption key for Messages. If you want your messages to be truly inaccessible to Apple / agencies with warrants (and also unrecoverable after losing end to end encryption access), then you have to turn off iCloud backup. Apple's documentation needs to be a little clearer on this but the system is basically designed with the accurate notion that the biggest footgun for 90% of users is not "the government was able to access my messages with a warrant" but rather "I lost access to my end to end encrypted messages".

upbeat_general 5y ago

You're conflating the convenience of backing up vs being able to access data even with lost recovery keys. People are certainly choosing convenience over privacy in that any backup is preferable to no backup. However, Apple does not give the option to choose E2E or not so users cannot make that choice of privacy vs convenience. You're assuming that people choosing iCloud over not-iCloud means people do not want E2E. It may be the case that people prefer E2E but this is not evidence of it. Furthermore, I don't believe iCloud backups were ever E2E and that it was a feature that was removed. Apple states which iCloud services are E2E[0] and these services I'd argue are pretty straightforward to setup and not lose. Most of the time you don't need a recovery key, just to be logged in on another device. Even if it is the case that most users do not want E2E, there's certainly a large audience (outside of just the HN bubble) that do want it. They could make it optional. [0]: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

phreack 5y ago

I once saw the kind of support emails a friend got while working CS for an encrypted media storage service. Every single day, someone new was demanding, many times threatening legal action, that the company recovered their encrypted media. It was set up so only the user had the keys, and there was literally no way for the company to recover data without them - something that was a particular selling point of the service, constantly made explicit in many different ways and places. I wouldn't have believed that things were this bad had I not seen it first hand.

XorNot 5y ago
Given that Shamir secret sharing exists, it seems like this should be a problem you can turn around on the user though: instead of just "we'll keep your keys escrowed" it should be "please nominate N trusted friends to recover your keys" with an option (that is highlighted) to let the company be able to do this too. There's a heck of a lot here which generally feels like a problem where the user isn't ever adequately briefed on what's happening and why, and isn't given reasonable options. People are very familiar with the idea of giving a house key to a friend, but for some reason we don't offer the substantially better options we have in this regard when it comes to encryption.

deleted 5y ago

[deleted]

frosted-flakes 5y ago
"Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 5y ago
  [deleted]

deleted 5y ago

[deleted]

ksec 5y ago

>Reality - there was a period where the icloud backups created backups that apple did not have access to. If my memory serves me correct iCloud Backup was designed as such since Day 1 ( iOS 5 ) so Apple could help its customer when they loss their phone. Is there any links to suggest Apple changed their Backup access?

treesprite82 5y ago
Apple did once plan to allow encrypting backups, but dropped the plan when the FBI complained: https://www.bbc.co.uk/news/technology-51207744 https://www.bbc.co.uk/news/technology-51207744 I don't think whoknowswhat11's account (that there was a period where backups were encrypted but it was removed because users didn't want it) is accurate.
- beermonster 5y ago
  I dropped my plan to use Cloud Backups when Apple dropped their plan to protect their users. If you want to know it’s safe, either don’t share it with a third party and hang onto that data yourself. Or alternatively, client-side encrypt it to be sure.
  - ksec 5y ago
    I still remember why I had to use iCloud Backup. It was the safest way to restore my data between iPhone upgrade. I had seen more than a dozen iTunes Backup corruption where the backup is completely useless. And this problem exist even today. And it seems the chances of happening is higher on Windows PC. iCloud isn't without flaws I have seen three iCloud Backup suggesting it is corrupted. But there is often a backup from previous days as iCloud dont overwrite backup. Given the lower chances of happening I had to use iCloud.
    - beermonster 5y ago
      I’ve never once used an iCloud Backup or even local backup between iPhone upgrades. I always set it up as a new phone and don’t migrate any old settings across. I make the odd encrypted local backup just as a recovery point but my RTO is measured in years TBH.

donmcronald 5y ago

> Same issue BTW with bitlocker on windows. People DO NOT save those recovery keys, even if they should. Microsoft added a way to force a backup into an account admins and others would have access to, thank goodness, because otherwise users there would be hosed as well. I know someone that got a drive recovered once and they had no idea what BitLocker is. They were pretty happy to have the key saved in their MS account.

brewdad 5y ago
I had this happen to me once on my Surface Go tablet. I had no idea that BitLocker was enabled, whether I did it at initial setup and didn't remember or it was on by default. One day it refused to boot until I entered a key that I had no idea even existed. Fortunately, I was able to log in to my MS account and retrieve the key.

Threeve303 5y ago

> Users willing to give up privacy for convenience. It’s not possible to give up that which you do not have. And the convenience isn’t for the users

lodonnell9213 5y ago

Bitlocker (enterprise setup) is different, you can backup into AD, and also have network unlock (requires a connection to dc that’s wired) However I agree, I heavily use iMessage, it’s convenient because when I used signal I didn’t get notifications. However, Apple has had the decryption keys server side for ages, and I believe the reason they don’t have E2EE is purely because users don’t store their backup keys, and kick off when they loose all their life that’s stored in iCloud, and it’s just not worth the hassle to the support team, my family is the same with 1Password, they don’t backup their secret key thing, so I have to either store it or restore their account. Bitlocker doesn’t help in this regard either, you can bypass the mandatory saving section by using print to PDF to store the recovery file to the encrypted drive, essentially locking a safe with the key inside.