6 ms·

Of course iCloud is exempt. And now I am stuck. Either I shell out $ for their backup, or I need to enter my pin at random moments... And when I don't wish to

Of course iCloud is exempt. And now I am stuck. Either I shell out $ for their backup, or I need to enter my pin at random moments... And when I don't wish to spend money, I am stuck with a bug(?) where my iCloud backup is > 5GB even when I uncheck _ALL_ things. It's a ruse to make me spend money.

scarface74 4y ago
You really don’t see the security threat of not requiring a passcode before allowing a backup to a computer?
- georgyo 4y ago
  Your argument is the same for iCloud backup, which does not require a passcode. A simple method is to make the backup encrypted, where it leaves your device encrypted. This is once again Apple forcing people to pay for more Apple products under the guise of security.
  - scarface74 4y ago
    How is the argument in any way similar? iCloud is a known destination that the iPhone can easily verify.
    - pxmpxm 4y ago
      As opposed to the computer you've set up to trust? MITM is a vector for either.
      - scarface74 4y ago
        You might have set your computer to trust. But there is nothing stopping someone else from making your phone think it’s a trusted computer. That’s the entire point.
        gruez 4y ago
        > But there is nothing stopping someone else from making your phone think it’s a trusted computer. That's non-trivial because the computer that you've trusted identifies itself to the iphone cryptographically.
        scarface74 4y ago
        That’s just the issue. There is a security issue on the Mac side that doesn’t make it possible to securely identify itself and it can be spoofed. https://theevilbit.github.io/posts/cve-2022-32929/ https://theevilbit.github.io/posts/cve-2022-32929/
        gruez 4y ago
        The exploit in question doesn't "spoof" anything. The iphone is still talking to the same computer, that part hasn't been bypassed. You can't use this exploit to plug an iphone into a new computer and make a backup. The only thing that changed is that previously the iphone could be assured that random apps on the computer couldn't access the backup data, but now it couldn't. However, I don't think this difference is meaningful. For one, you could bypass TCC by whitelisting apps, unbeknownst to the iphone, so there's no real expectation that the backup data is kept 100% confidential. Furthermore, iphones could be backed up to windows machines, which don't have such protections at all.
pxmpxm 4y ago
Not shocking - between the "use icloud" nag screen when attaching photos in Messages and basic stuff not porting over with local backups instead of icloud (weather, health, stocks etc), this is another yet another customer-adverse step that substitutes montly sub for "just works". This past month I migrated from iphone 12 to 13 and it involved manually reloading/resetting virtually everything, despite making a local backup of the old phone. It would seem that the apple builtin apps specifically just don't restore without icloud - it's almost as if there's a product manager somewhere that's using icloud utilization in GB as their OKR benchmark, and that's one way to hit it. Apple discontinuing TimeCapsule and disbanding the team couple years back isn't lost on me either.
CoastalCoder 4y ago
> And now I am stuck. Either I shell out $ for their backup, or I need to enter my pin at random moments... I don't know the nuances of U.S. antitrust law. Would this likely qualify as illegal anticompetitive / monopolistic behavior?
crossroadsguy 4y ago
And if you do you can’t really just buy extra storage. It comes bundled in iCloud+ or Apple One. And not to mention the complete opaque “System Data” usage of iPhone Storage. One day it’s 1GB and next day it’s 20GB. Without any way of knowing what exactly is taking that space. Of course you can’t clear those up since you are on an Apple device.

scarface74 4y ago

You really don’t see the security threat of not requiring a passcode before allowing a backup to a computer?

georgyo 4y ago
Your argument is the same for iCloud backup, which does not require a passcode. A simple method is to make the backup encrypted, where it leaves your device encrypted. This is once again Apple forcing people to pay for more Apple products under the guise of security.
- scarface74 4y ago
  How is the argument in any way similar? iCloud is a known destination that the iPhone can easily verify.
  - pxmpxm 4y ago
    As opposed to the computer you've set up to trust? MITM is a vector for either.
    - scarface74 4y ago
      You might have set your computer to trust. But there is nothing stopping someone else from making your phone think it’s a trusted computer. That’s the entire point.
      - gruez 4y ago
        > But there is nothing stopping someone else from making your phone think it’s a trusted computer. That's non-trivial because the computer that you've trusted identifies itself to the iphone cryptographically.
        scarface74 4y ago
        That’s just the issue. There is a security issue on the Mac side that doesn’t make it possible to securely identify itself and it can be spoofed. https://theevilbit.github.io/posts/cve-2022-32929/ https://theevilbit.github.io/posts/cve-2022-32929/
        gruez 4y ago
        The exploit in question doesn't "spoof" anything. The iphone is still talking to the same computer, that part hasn't been bypassed. You can't use this exploit to plug an iphone into a new computer and make a backup. The only thing that changed is that previously the iphone could be assured that random apps on the computer couldn't access the backup data, but now it couldn't. However, I don't think this difference is meaningful. For one, you could bypass TCC by whitelisting apps, unbeknownst to the iphone, so there's no real expectation that the backup data is kept 100% confidential. Furthermore, iphones could be backed up to windows machines, which don't have such protections at all.

pxmpxm 4y ago

Not shocking - between the "use icloud" nag screen when attaching photos in Messages and basic stuff not porting over with local backups instead of icloud (weather, health, stocks etc), this is another yet another customer-adverse step that substitutes montly sub for "just works". This past month I migrated from iphone 12 to 13 and it involved manually reloading/resetting virtually everything, despite making a local backup of the old phone. It would seem that the apple builtin apps specifically just don't restore without icloud - it's almost as if there's a product manager somewhere that's using icloud utilization in GB as their OKR benchmark, and that's one way to hit it. Apple discontinuing TimeCapsule and disbanding the team couple years back isn't lost on me either.

CoastalCoder 4y ago

> And now I am stuck. Either I shell out $ for their backup, or I need to enter my pin at random moments... I don't know the nuances of U.S. antitrust law. Would this likely qualify as illegal anticompetitive / monopolistic behavior?

crossroadsguy 4y ago

And if you do you can’t really just buy extra storage. It comes bundled in iCloud+ or Apple One. And not to mention the complete opaque “System Data” usage of iPhone Storage. One day it’s 1GB and next day it’s 20GB. Without any way of knowing what exactly is taking that space. Of course you can’t clear those up since you are on an Apple device.