4 ms·

i simply prefer not to believe anything that any government or any trillion dollar company says about encryption and privacy. Apple: > "We have never heard of

i simply prefer not to believe anything that any government or any trillion dollar company says about encryption and privacy. Apple: > "We have never heard of PRISM", "We do not provide any government agency with direct access to our servers" https://web.archive.org/web/20130609061546/https://www.cultofmac.com/230358/everything-you-need-to-know-about-apple-and-prism/ https://web.archive.org/web/20130609061546/https://www.culto... ..some things are just not discussed on public forums.

gjsman-1000 3y ago
That could be true? IIRC, PRISM was less about direct access, and more about abusing every potential method of gaining information. For example, imagine a Login page that said, "Password incorrect," versus "User does not exist." If you have "User does not exist," you could use that to figure out whether a given email address has an account with a service. That could be useful information to PRISM when looking for a target to subpoena or monitor. (This is also why it's now best practice to just say "Login incorrect" or something vague that doesn't say whether the username, or the password, was wrong.) Though, I could be wrong, I'd love more info.
- realusername 3y ago
  > That could be true? IIRC, PRISM was less about direct access, and more about abusing every potential method of gaining information. Direct access to the data was mentioned in the Guardian and other newspapers
  - KerrAvon 3y ago
    Newspapers often get details wrong.
    - peoplefromibiza 3y ago
      And mega-corporations often lie.
    - realusername 3y ago
      They got that from the leaked documents though
  - lern_too_spel 3y ago
    It was not mentioned in the leaked documents that the Guardian published. Instead, it said that the data came "directly from" the tech companies (who responded to wiretap requests on specific accounts). Greenwald couldn't be bothered to understand what the documents said and hallucinated the phrase "direct access" like a low capacity language model, but we on HN are functionally literate.
- prettyStandard 3y ago
  More info? It goes further than just the error message. I think the original exploit was based on how quickly Unix would fail to login. (Bad user failed faster than bad password) and that allowed you to enumerate the user names.
sidewndr46 3y ago
As far as "We have never heard of PRISM", that could be true. When you receive a national security letter it isn't like they give you detailed info about the specific operation and why you are receiving it. It's more along the lines of "you're going to do this pursuant to US code section..."
- mcpackieh 3y ago
  What's more, a National Security Letter is not necessarily addressed to the company's executives and lawyers. A National Security Letter could be send to somebody lower in the organization, closer to the targeted data (for instance a sysadmin) with a clause threatening them with prison time if they tell anybody, even their boss or company lawyers about it. They can essentially conscript anybody in the company to work as a spy using (probably bullshit but still intimidating) legal threats to keep them quiet.
  - sidewndr46 3y ago
    I didn't consider that, but it aligns with my experience as well. From a C-Level perspective that is probably desirable as they don't want to get involved with that sort of thing in the first place.
    - deleted 3y ago
      [deleted]
  - owenmarshall 3y ago
    Is there any evidence that low-level people have been targeted, or is this just speculation around what could happen? Yes, "evidence for a secret program" is a bit tricky to produce, but the one I know of - Doe v. Ashcroft - the president of the company was compelled to produce data. I'd be very surprised if this wasn't the universal approach.
  - lolinder 3y ago
    This sounds scary, but unlikely. Do you have a source that this tactic is used and effective? My immediate reaction to such a letter would be to contact the company legal department regardless of whether the letter said not to, simply because I'd assume unless given very good evidence (and originating from a .gov domain isn't good enough) that it was a scam. Edit: According to the EFF you can talk to an attorney about an NSL. https://www.eff.org/issues/national-security-letters/faq#24 https://www.eff.org/issues/national-security-letters/faq#24
snowwrestler 3y ago
We now know that PRISM was (is?) the NSA internal source designation for data acquired through FISA warrants executed by the FBI. So actually Apple was being honest. They had not heard of PRISM, because that term was only used inside the NSA. And they were not allowing direct government access to their servers, they were responding to FISA warrants.
- mrtksn 3y ago
  While technically true, it's also a complete BS. It's in the same vain as Torrent websites are not hosting copyrighted content - technically true but complete BS.
  - PartiallyTyped 3y ago
    But they are actually not hosting it. If we are being pedantic, one can claim that all data, can be very well anything because there is always a "one-time pad" transforming all communication into something malicious. If the law is not precise, then it is on the government to improve it.
    - imoverclocked 3y ago
      I agree. If we stated that torrent sites are hosting it then what other systems are implicated? eg: DNS itself provides a pointer to the torrent sites which then have a pointer to the data.
411111111111111 3y ago
Apple has perfected their virtue signaling game and all the simps love it. I don't really mind it either anymore, a lot of people have this hero worship fetish and they can't help painting everything in black and white, even though they're all just different shades of gray. Apple is definitively brighter on that scale then Google or Meta, but they're all corrupt multinational corporations that will do everything they can get away with to increase their bottom line.
- GoofballJones 3y ago
  You knowing this, by the tone of your writing, what do YOU do about it? What computer are you working on right now? Are you sure every component on it is legit? I take it you're using some for of Linux because they're not "corrupt" (well, depending on what distro as even that is a big debate). Or do you live and operate like RMS?
- dang 3y ago
  Can you please not post in the flamewar style? We're trying for something else here, and you can make your substantive points without any of that. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
ralfd 3y ago
Prism also involved an NSA program that was done without the knowledge of the tech companies. They inserted a splitter on the fiber lines leaving data centers to copy all the traffic.
detourdog 3y ago
Does anybody remember one December where Apple shut down all the developer systems. It had the feel to me at the time that it was a hack by it's suddenness. I have always associated that period with the discovery of Prism. I would love to hear if anybody knows what I'm talking about.

gjsman-1000 3y ago

That could be true? IIRC, PRISM was less about direct access, and more about abusing every potential method of gaining information. For example, imagine a Login page that said, "Password incorrect," versus "User does not exist." If you have "User does not exist," you could use that to figure out whether a given email address has an account with a service. That could be useful information to PRISM when looking for a target to subpoena or monitor. (This is also why it's now best practice to just say "Login incorrect" or something vague that doesn't say whether the username, or the password, was wrong.) Though, I could be wrong, I'd love more info.

realusername 3y ago
> That could be true? IIRC, PRISM was less about direct access, and more about abusing every potential method of gaining information. Direct access to the data was mentioned in the Guardian and other newspapers
- KerrAvon 3y ago
  Newspapers often get details wrong.
  - peoplefromibiza 3y ago
    And mega-corporations often lie.
  - realusername 3y ago
    They got that from the leaked documents though
- lern_too_spel 3y ago
  It was not mentioned in the leaked documents that the Guardian published. Instead, it said that the data came "directly from" the tech companies (who responded to wiretap requests on specific accounts). Greenwald couldn't be bothered to understand what the documents said and hallucinated the phrase "direct access" like a low capacity language model, but we on HN are functionally literate.
prettyStandard 3y ago
More info? It goes further than just the error message. I think the original exploit was based on how quickly Unix would fail to login. (Bad user failed faster than bad password) and that allowed you to enumerate the user names.

sidewndr46 3y ago

As far as "We have never heard of PRISM", that could be true. When you receive a national security letter it isn't like they give you detailed info about the specific operation and why you are receiving it. It's more along the lines of "you're going to do this pursuant to US code section..."

mcpackieh 3y ago
What's more, a National Security Letter is not necessarily addressed to the company's executives and lawyers. A National Security Letter could be send to somebody lower in the organization, closer to the targeted data (for instance a sysadmin) with a clause threatening them with prison time if they tell anybody, even their boss or company lawyers about it. They can essentially conscript anybody in the company to work as a spy using (probably bullshit but still intimidating) legal threats to keep them quiet.
- sidewndr46 3y ago
  I didn't consider that, but it aligns with my experience as well. From a C-Level perspective that is probably desirable as they don't want to get involved with that sort of thing in the first place.
  - deleted 3y ago
    [deleted]
- owenmarshall 3y ago
  Is there any evidence that low-level people have been targeted, or is this just speculation around what could happen? Yes, "evidence for a secret program" is a bit tricky to produce, but the one I know of - Doe v. Ashcroft - the president of the company was compelled to produce data. I'd be very surprised if this wasn't the universal approach.
- lolinder 3y ago
  This sounds scary, but unlikely. Do you have a source that this tactic is used and effective? My immediate reaction to such a letter would be to contact the company legal department regardless of whether the letter said not to, simply because I'd assume unless given very good evidence (and originating from a .gov domain isn't good enough) that it was a scam. Edit: According to the EFF you can talk to an attorney about an NSL. https://www.eff.org/issues/national-security-letters/faq#24 https://www.eff.org/issues/national-security-letters/faq#24

snowwrestler 3y ago

We now know that PRISM was (is?) the NSA internal source designation for data acquired through FISA warrants executed by the FBI. So actually Apple was being honest. They had not heard of PRISM, because that term was only used inside the NSA. And they were not allowing direct government access to their servers, they were responding to FISA warrants.

mrtksn 3y ago
While technically true, it's also a complete BS. It's in the same vain as Torrent websites are not hosting copyrighted content - technically true but complete BS.
- PartiallyTyped 3y ago
  But they are actually not hosting it. If we are being pedantic, one can claim that all data, can be very well anything because there is always a "one-time pad" transforming all communication into something malicious. If the law is not precise, then it is on the government to improve it.
  - imoverclocked 3y ago
    I agree. If we stated that torrent sites are hosting it then what other systems are implicated? eg: DNS itself provides a pointer to the torrent sites which then have a pointer to the data.

411111111111111 3y ago

Apple has perfected their virtue signaling game and all the simps love it. I don't really mind it either anymore, a lot of people have this hero worship fetish and they can't help painting everything in black and white, even though they're all just different shades of gray. Apple is definitively brighter on that scale then Google or Meta, but they're all corrupt multinational corporations that will do everything they can get away with to increase their bottom line.

GoofballJones 3y ago
You knowing this, by the tone of your writing, what do YOU do about it? What computer are you working on right now? Are you sure every component on it is legit? I take it you're using some for of Linux because they're not "corrupt" (well, depending on what distro as even that is a big debate). Or do you live and operate like RMS?
dang 3y ago
Can you please not post in the flamewar style? We're trying for something else here, and you can make your substantive points without any of that. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

ralfd 3y ago

Prism also involved an NSA program that was done without the knowledge of the tech companies. They inserted a splitter on the fiber lines leaving data centers to copy all the traffic.

detourdog 3y ago

Does anybody remember one December where Apple shut down all the developer systems. It had the feel to me at the time that it was a hack by it's suddenness. I have always associated that period with the discovery of Prism. I would love to hear if anybody knows what I'm talking about.