3 ms·

The fact that we have to call it "their firmware and secure enclaves" is a bit telling, though. The majority of consumer-facing devices today have a layer of in

The fact that we have to call it "their firmware and secure enclaves" is a bit telling, though. The majority of consumer-facing devices today have a layer of inscrutability that we leave up to the manufacturer to implement properly. For instance, Microsoft has Bitlocker, but I couldn't confidently say that isn't backdoored either. Apple has whitepapers, but they're about as verifiable as LK-99 in-practice. Their security model entirely revolves around the Apple-issued root of trust, and if you can't trust them then you have to hit the bricks. If you don't own both ends, the end-to-end encryption shtick is a theatrical farce.

gochi 3y ago
It can potentially be a theatrical farce, but you've only created hypothetical scenarios in your mind for why that might be the case. Even if you did "own both ends", you still have to rely on other parties to contribute the pieces that you don't watch over, unless you're going to be E2EE from scratch (again, because you can hypothetically just say "well what if the encryption scheme itself is backdoored").
- smoldesu 3y ago
  Both of those conceits apply to Apple's scheme as well, though. Transparency enforces accountability, Apple themselves wouldn't be using things like OpenSSL and bash if they weren't open enough to scrutinize and modify.
kanbara 3y ago
sure, all clouds are other people’s computers; laypeople just want things to work and don’t really care about whose root of trust they use. living in a world where you run everything yourself sounds good in practice but then you can’t communicate with anyone else. i’d like for the firmware to be open source and for the cloud to be federated, but it’s a pipe dream and i’m busy so i just gotta trust apple in the end
zirgs 3y ago
If Bitlocker had a backdoor it would have leaked by now. I don't believe that they could keep an "alphabet boys only" backdoor secret for that long. How would that backdoor even look like? A some sort of master key that can decrypt every Bitlocker encrypted drive? Imagine if something like THAT got leaked. Who would have access to that key? Microsoft themselves? NSA? FBI? What about the UK, Australia or other US allies? Do their alphabet boys also get access to this? Do small town cops also get access? And I'm pretty sure lots of security researchers have tried to find vulnerabilities of Bitlocker. If there was something fishy going on - they would have noticed.

gochi 3y ago

It can potentially be a theatrical farce, but you've only created hypothetical scenarios in your mind for why that might be the case. Even if you did "own both ends", you still have to rely on other parties to contribute the pieces that you don't watch over, unless you're going to be E2EE from scratch (again, because you can hypothetically just say "well what if the encryption scheme itself is backdoored").

smoldesu 3y ago
Both of those conceits apply to Apple's scheme as well, though. Transparency enforces accountability, Apple themselves wouldn't be using things like OpenSSL and bash if they weren't open enough to scrutinize and modify.

kanbara 3y ago

sure, all clouds are other people’s computers; laypeople just want things to work and don’t really care about whose root of trust they use. living in a world where you run everything yourself sounds good in practice but then you can’t communicate with anyone else. i’d like for the firmware to be open source and for the cloud to be federated, but it’s a pipe dream and i’m busy so i just gotta trust apple in the end

zirgs 3y ago

If Bitlocker had a backdoor it would have leaked by now. I don't believe that they could keep an "alphabet boys only" backdoor secret for that long. How would that backdoor even look like? A some sort of master key that can decrypt every Bitlocker encrypted drive? Imagine if something like THAT got leaked. Who would have access to that key? Microsoft themselves? NSA? FBI? What about the UK, Australia or other US allies? Do their alphabet boys also get access to this? Do small town cops also get access? And I'm pretty sure lots of security researchers have tried to find vulnerabilities of Bitlocker. If there was something fishy going on - they would have noticed.