5 ms·

I see a lot of pessimism in the comments. But I think this is a great step in the right direction. Other companies should take note. More of this, please!

by BluSyn 5y ago

varjag 5y ago
Google does this for some time at least. I received an imminent advanced security threat notification back in January 2019. Urging me to get one of those 2fa dongles (which I did). And just as well, because the next month my account was locked due to an attempted unathorized access. (whoever works on this at Google, thank you)
- Shank 5y ago
  The Google warning page can be viewed by anyone, but they do specifically tell targeted individuals through other channels (a big red warning message at the top of Gmail, for example): https://myaccount.google.com/stateattackwarning https://myaccount.google.com/stateattackwarning
jsnell 5y ago
Apple is like the last company in that space to do this. Google has had these warnings since 2012. Facebook, Microsoft and Twitter since 2015. (I agree that it's great that Apple is finally doing this. But it seems entirely par for the course for them to be a decade late and still get the credit.)
- punnerud 5y ago
  I have never seen any warnings from Google or Facebook if I automate against my own accounts, and dumping the data. Only on sign-in attempts. That kind of warning is very limited, and Apple also have them. It seems like Apple now have introduced ‘honey pots’ and other techniques to discover if there already is someone with access to your account/device, and that is a big deal and good news. And something I have never seen from any of the other big companies.
  - concinds 5y ago
    The warning is for government-sponsored attacks, not any kind of automation. https://blog.google/threat-analysis-group/updates-about-government-backed-hacking-and-disinformation/ https://blog.google/threat-analysis-group/updates-about-gove...
smoldesu 5y ago
I might care if Apple had a history of protecting US citizens from their own government, or shielding Chinese users from their own tyrannical surveillance systems.
- onethought 5y ago
  ??? Are you referring to the storing of encryption keys for iCloud in country?
  - smoldesu 5y ago
    No, I'm referring to Apple's continued cooperation with surveillance agencies across the United States and all associated governments through the FIVE EYES program. The fact that your Macbook's security keys are trivial for the government to acquire is besides the point, but potentially germane if you, well, trusted your laptop in the first place.
    - onethought 5y ago
      Can you provide citation for this? Also how they are different from any other tech company? My MacBooks security keys are not trivial to acquire because they aren’t in icloud. In some of the countries in five eyes nations, you don’t have a choice about cooperating or not. But what do 5 eyes have to do with Chinese users?
      - smoldesu 5y ago
        > Can you provide citation for this? Apple's cooperation with PRISM[0] is well documented[1], but if you want to find the particularly damning details you'll need to do your own research. The dust has settled since the Snowden revelations, and many mentions of the program have been sterilized. > Also how they are different from any other tech company? It's not. But the claim that Apple puts extra effort into protecting you from your government is comical, especially if you live in a first-world country. It's also a false dichotomy, since there are definitely more secure devices you could be using. They're just not being manufactured by the largest, most valuable companies in the world. > My MacBooks security keys are not trivial to acquire because they aren’t in icloud. That is indeed what the US would like you to think. It's no coincidence that Macbooks force you to use NIST-designed crypto for all of their services though, and if you've got a healthy degree of skepticism towards the same institute that backdoored Dual_EC_DRBG, it's safe to assume the rest of these ciphers are also vulnerable to differential cryptanalysis. Or just take what the NSA says at face value, that certainly won't cause any problems in the future. /s > But what do 5 eyes have to do with Chinese users? Also nothing, they have their own bespoke surveillance program since China cannot cooperate with the US like Britain or Canada can. In lieu of being able to break their encryption, China demanded that all of Apple's domestic data get stored on domestic servers. While Google, Microsoft, Yahoo and every other big tech company shied away from that kind of compliance with a known abuser of human rights, Apple happily complied with the request. [0] https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... [1] https://web.archive.org/web/20130609061546/https://www.cultofmac.com/230358/everything-you-need-to-know-about-apple-and-prism/ https://web.archive.org/web/20130609061546/https://www.culto...
Terry_Roll 5y ago
I think you can spot when your phone has been hacked, for example the mobile phone carriers can spot the traffic and slow down the communication making it obvious things are not working properly. Take using the AirBnB app, you put in a criteria, the results come back then the spooky hackers wipe the results and give you a list of their "safehouse" Airbnb locations meaning all you can do is book into one of their safe houses. The fact you see the AirBnB results get wiped and then slowly other results not really matching your criteria appearing should tell you, you could be booking into a safe house. Dating apps/websites is another way to get into a relationship with "undercover" investigators and I dont think most people are aware that any crime ever committed since birth can be prosecuted so as no one can predict what legislation might be hitting the books in the future, it might be hard to keep your nose clean. I think most people are aware of dodgy text messages which tends to be the start of malware entering your phone.
ridaj 5y ago
Google's been doing this since at least 2012 http://arstechnica.com/information-technology/2012/06/google-state-sponsored-attack-warnings/ http://arstechnica.com/information-technology/2012/06/google...

I see a lot of pessimism in the comments. But I think this is a great step in the right direction. Other companies should take note. More of this, please!

by BluSyn 5y ago

I see a lot of pessimism in the comments. But I think this is a great step in the right direction. Other companies should take note. More of this, please!

varjag 5y ago

Google does this for some time at least. I received an imminent advanced security threat notification back in January 2019. Urging me to get one of those 2fa dongles (which I did). And just as well, because the next month my account was locked due to an attempted unathorized access. (whoever works on this at Google, thank you)

Shank 5y ago
The Google warning page can be viewed by anyone, but they do specifically tell targeted individuals through other channels (a big red warning message at the top of Gmail, for example): https://myaccount.google.com/stateattackwarning https://myaccount.google.com/stateattackwarning

jsnell 5y ago

Apple is like the last company in that space to do this. Google has had these warnings since 2012. Facebook, Microsoft and Twitter since 2015. (I agree that it's great that Apple is finally doing this. But it seems entirely par for the course for them to be a decade late and still get the credit.)

punnerud 5y ago
I have never seen any warnings from Google or Facebook if I automate against my own accounts, and dumping the data. Only on sign-in attempts. That kind of warning is very limited, and Apple also have them. It seems like Apple now have introduced ‘honey pots’ and other techniques to discover if there already is someone with access to your account/device, and that is a big deal and good news. And something I have never seen from any of the other big companies.
- concinds 5y ago
  The warning is for government-sponsored attacks, not any kind of automation. https://blog.google/threat-analysis-group/updates-about-government-backed-hacking-and-disinformation/ https://blog.google/threat-analysis-group/updates-about-gove...

smoldesu 5y ago

I might care if Apple had a history of protecting US citizens from their own government, or shielding Chinese users from their own tyrannical surveillance systems.

onethought 5y ago
??? Are you referring to the storing of encryption keys for iCloud in country?
- smoldesu 5y ago
  No, I'm referring to Apple's continued cooperation with surveillance agencies across the United States and all associated governments through the FIVE EYES program. The fact that your Macbook's security keys are trivial for the government to acquire is besides the point, but potentially germane if you, well, trusted your laptop in the first place.
  - onethought 5y ago
    Can you provide citation for this? Also how they are different from any other tech company? My MacBooks security keys are not trivial to acquire because they aren’t in icloud. In some of the countries in five eyes nations, you don’t have a choice about cooperating or not. But what do 5 eyes have to do with Chinese users?
    - smoldesu 5y ago
      > Can you provide citation for this? Apple's cooperation with PRISM[0] is well documented[1], but if you want to find the particularly damning details you'll need to do your own research. The dust has settled since the Snowden revelations, and many mentions of the program have been sterilized. > Also how they are different from any other tech company? It's not. But the claim that Apple puts extra effort into protecting you from your government is comical, especially if you live in a first-world country. It's also a false dichotomy, since there are definitely more secure devices you could be using. They're just not being manufactured by the largest, most valuable companies in the world. > My MacBooks security keys are not trivial to acquire because they aren’t in icloud. That is indeed what the US would like you to think. It's no coincidence that Macbooks force you to use NIST-designed crypto for all of their services though, and if you've got a healthy degree of skepticism towards the same institute that backdoored Dual_EC_DRBG, it's safe to assume the rest of these ciphers are also vulnerable to differential cryptanalysis. Or just take what the NSA says at face value, that certainly won't cause any problems in the future. /s > But what do 5 eyes have to do with Chinese users? Also nothing, they have their own bespoke surveillance program since China cannot cooperate with the US like Britain or Canada can. In lieu of being able to break their encryption, China demanded that all of Apple's domestic data get stored on domestic servers. While Google, Microsoft, Yahoo and every other big tech company shied away from that kind of compliance with a known abuser of human rights, Apple happily complied with the request. [0] https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... [1] https://web.archive.org/web/20130609061546/https://www.cultofmac.com/230358/everything-you-need-to-know-about-apple-and-prism/ https://web.archive.org/web/20130609061546/https://www.culto...

Terry_Roll 5y ago

I think you can spot when your phone has been hacked, for example the mobile phone carriers can spot the traffic and slow down the communication making it obvious things are not working properly. Take using the AirBnB app, you put in a criteria, the results come back then the spooky hackers wipe the results and give you a list of their "safehouse" Airbnb locations meaning all you can do is book into one of their safe houses. The fact you see the AirBnB results get wiped and then slowly other results not really matching your criteria appearing should tell you, you could be booking into a safe house. Dating apps/websites is another way to get into a relationship with "undercover" investigators and I dont think most people are aware that any crime ever committed since birth can be prosecuted so as no one can predict what legislation might be hitting the books in the future, it might be hard to keep your nose clean. I think most people are aware of dodgy text messages which tends to be the start of malware entering your phone.

ridaj 5y ago

Google's been doing this since at least 2012 http://arstechnica.com/information-technology/2012/06/google-state-sponsored-attack-warnings/ http://arstechnica.com/information-technology/2012/06/google...