3 ms·

As long as iCloud backup is a) on by default, and b) isn’t clearly marked as being readable to Apple, it is a back door in practice, especially since the FBI is

by nr2x 4y ago

As long as iCloud backup is a) on by default, and b) isn’t clearly marked as being readable to Apple, it is a back door in practice, especially since the FBI is the reason that they did this. Let’s not even talk about Chinese users, as apparently Apple bending over to store all their data in CCP data centers doesn’t count.

aaaaaaaaata 4y ago
> As long as iCloud backup is a) on by default, and b) isn’t clearly marked as being readable to Apple, it is a back door in practice Tough to disagree.
natch 4y ago
Agree and it's not just Chinese users. Just talking about that one country (there are others, let's set that aside) it's Chinese users, and anyone who happens to be in China, and it would seem to be also anyone who, knowingly or unknowingly, anywhere around the world… in the US, the UK, the EU, etc… anywhere, has so much as a one-time interaction with such a user. I feel like that paragraph would lose most people because it's a long chain of connections. It's hard to do a TL;DR but here, I'll try: Basically "If you message someone in China, Apple sees to it that your identity and content is handed to the Chinese government." I don't know this for a fact. But as far as I can tell (and they aren't saying anything) this is exactly what is going on.
- nr2x 4y ago
  Interesting point! The thing with Apple that annoys me is they believe their own marketing, but if you say "Privacy is a Human Right" and deny it to Chinese citizens, you either don't consider Chinese people human, or you are full of shit. Honestly, not sure where Apple stands given their labor practices in China, the people who assemble the widgets certainly haven't been treated like human beings.
xoa 4y ago
No, you're just wrong, even if your statements were right which they aren't either. Again, by your logic every single communication system on iOS is "backdoored" simply because iCloud Backup exists. Or for that matter any comms method on Linux or FreeBSD or macOS or Windows if someone makes unencrypted backups. That's horse shit, and it degrades the specificity and value of the term "backdoor" in the same way as "bricked" has become. Backdooring is a specific part of a given product/stack, a covert method of bypassing regular authentication. There is no convert status here, Apple clearly lays out exactly what components of iCloud are encrypted and how in their "iCloud security overview" [0]. And it's not as if E2EE backups have no downsides mass market, it means that users are fully responsible for their data with zero recovery possible. I still think Apple is wrong to not offer even the capability to do better wirelessly/networked and in fact that should be against the law, but it's not a "backdoor" and if there were options I'm sure lots of people would still pick the "recoverable in an emergency" one. Think, if it turns out there actually is a backdoor in iMessage, like a secret second key that can be applied to any MITM'd data to decrypt it, how would you even describe that pray tell as different from "choosing to use a non-E2EE backup method"? Or do you not think any differentiation there would matter, that such a thing would be identical to you saying right now that "Signal has a backdoor"? All that said: >a) on by default I've never seen it on by default, it's a toggle. I can't find anything to support this assertion, and Apple's docs seem to indicate too it must be turned on [1]. How would it even be possible for this to work? Apple only gives you 5GB by default, and backups absolutely count against the quota. >and b) isn’t clearly marked as being readable to Apple As I linked they do clearly convey that. If you think it should be some extra warning dialog on enabling it, maybe that's a criticism, but there's certainly no standard around that across software industry-wide including on computers. Whether something is E2EE or not is usually something those that care need to look up. Maybe that should change. But no, it's not a "backdoor in practice". >Let’s not even talk about Chinese users, as apparently Apple bending over to store all their data in CCP data centers doesn’t count. No let's not, and no it doesn't here. That's a case with a lot more complexity then tends to come out on HN where instead people like you use it as a lazy bit of whataboutism. Apple is in the wrong there, and the US for allowing/encouraging it as well, but not for the same reasons as with the FBI and the path away from it is very different and harder as well. They deserve major blame in both cases, but why they deserve blame differs, and that matters. ---- 0: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 1: https://support.apple.com/guide/iphone/back-up-iphone-iph3ecf67d29/ios https://support.apple.com/guide/iphone/back-up-iphone-iph3ec...
- sneak 4y ago
  > Again, by your logic every single communication system on iOS is "backdoored" simply because iCloud Backup exists. You seem to be unfamiliar with the concept of iOS storage classes. The iOS security overview pdf from Apple will explain better than I can. > I've never seen it on by default, it's a toggle. I set up dozens of iOS devices per year. Logging into even the App Store (after declining to log in during initial setup) silently enables iCloud, and iCloud Backup. It is on by default and most users are never once presented with the toggle. You can accidentally enable it just by installing an app.

by nr2x 4y ago

aaaaaaaaata 4y ago

> As long as iCloud backup is a) on by default, and b) isn’t clearly marked as being readable to Apple, it is a back door in practice Tough to disagree.

natch 4y ago

Agree and it's not just Chinese users. Just talking about that one country (there are others, let's set that aside) it's Chinese users, and anyone who happens to be in China, and it would seem to be also anyone who, knowingly or unknowingly, anywhere around the world… in the US, the UK, the EU, etc… anywhere, has so much as a one-time interaction with such a user. I feel like that paragraph would lose most people because it's a long chain of connections. It's hard to do a TL;DR but here, I'll try: Basically "If you message someone in China, Apple sees to it that your identity and content is handed to the Chinese government." I don't know this for a fact. But as far as I can tell (and they aren't saying anything) this is exactly what is going on.

nr2x 4y ago
Interesting point! The thing with Apple that annoys me is they believe their own marketing, but if you say "Privacy is a Human Right" and deny it to Chinese citizens, you either don't consider Chinese people human, or you are full of shit. Honestly, not sure where Apple stands given their labor practices in China, the people who assemble the widgets certainly haven't been treated like human beings.

xoa 4y ago

No, you're just wrong, even if your statements were right which they aren't either. Again, by your logic every single communication system on iOS is "backdoored" simply because iCloud Backup exists. Or for that matter any comms method on Linux or FreeBSD or macOS or Windows if someone makes unencrypted backups. That's horse shit, and it degrades the specificity and value of the term "backdoor" in the same way as "bricked" has become. Backdooring is a specific part of a given product/stack, a covert method of bypassing regular authentication. There is no convert status here, Apple clearly lays out exactly what components of iCloud are encrypted and how in their "iCloud security overview" [0]. And it's not as if E2EE backups have no downsides mass market, it means that users are fully responsible for their data with zero recovery possible. I still think Apple is wrong to not offer even the capability to do better wirelessly/networked and in fact that should be against the law, but it's not a "backdoor" and if there were options I'm sure lots of people would still pick the "recoverable in an emergency" one. Think, if it turns out there actually is a backdoor in iMessage, like a secret second key that can be applied to any MITM'd data to decrypt it, how would you even describe that pray tell as different from "choosing to use a non-E2EE backup method"? Or do you not think any differentiation there would matter, that such a thing would be identical to you saying right now that "Signal has a backdoor"? All that said: >a) on by default I've never seen it on by default, it's a toggle. I can't find anything to support this assertion, and Apple's docs seem to indicate too it must be turned on [1]. How would it even be possible for this to work? Apple only gives you 5GB by default, and backups absolutely count against the quota. >and b) isn’t clearly marked as being readable to Apple As I linked they do clearly convey that. If you think it should be some extra warning dialog on enabling it, maybe that's a criticism, but there's certainly no standard around that across software industry-wide including on computers. Whether something is E2EE or not is usually something those that care need to look up. Maybe that should change. But no, it's not a "backdoor in practice". >Let’s not even talk about Chinese users, as apparently Apple bending over to store all their data in CCP data centers doesn’t count. No let's not, and no it doesn't here. That's a case with a lot more complexity then tends to come out on HN where instead people like you use it as a lazy bit of whataboutism. Apple is in the wrong there, and the US for allowing/encouraging it as well, but not for the same reasons as with the FBI and the path away from it is very different and harder as well. They deserve major blame in both cases, but why they deserve blame differs, and that matters. ---- 0: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 1: https://support.apple.com/guide/iphone/back-up-iphone-iph3ecf67d29/ios https://support.apple.com/guide/iphone/back-up-iphone-iph3ec...

sneak 4y ago
> Again, by your logic every single communication system on iOS is "backdoored" simply because iCloud Backup exists. You seem to be unfamiliar with the concept of iOS storage classes. The iOS security overview pdf from Apple will explain better than I can. > I've never seen it on by default, it's a toggle. I set up dozens of iOS devices per year. Logging into even the App Store (after declining to log in during initial setup) silently enables iCloud, and iCloud Backup. It is on by default and most users are never once presented with the toggle. You can accidentally enable it just by installing an app.