3 ms·

Personal Data Is Under Siege. End-to-End Encryption Is Our Most Powerful Defense

13 points by pulisse 3y ago

1vuio0pswjnm7 3y ago
"Ivan Krstic has headed Apple Security Engineering and Architecture (SEAR), the group responsible for end-to-end security of all Apple products, since its inception. He has led the design and implementation of key security mechanisms across Apple platforms, including Lockdown Mode, Two-factor authentication for Apple ID, and Advanced Data Protection for iCloud." The author works for Apple. Should personal data should be "in the cloud" under the control of third parties like Apple. Why does Apple want this data. The company competes with the likes of Facebook and other privacy-destroying "tech" companies. We know why Facebook wants such data. Apple's advertising revenue continues to increase. Unfortunately, this submission reads like PR for Apple. And it coincides with similar propaganda from Facebook: https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/ https://engineering.fb.com/2023/12/06/security/building-end-... We know that Zuckerberg actually wanted to break WhatsApp encryption. Encryption is a good idea if person A wants to protect against someon stealing their computer or storage device, or if person A wants to send data to persona B over the internet. But if all storage is on Apple's computers, and if sending data to person B requires sending it through Apple's computers, then Apple is the one controlling encryption, not persons A or B. Given that Apple is in the business of collecting people's personal data and metadata for profit, ideally below the user's awareness, e.g., encrypted in a way that the user cannot view their own traffic, that's not a good idea.
devwastaken 3y ago
The article states that current practices don't serve the company or the people. This is false. Good security is very expensive. The board knowingly bets that the damage will be far less than the cost. Meaning it's a non tangible effect to them. It's mostly noise in the form of drama. If we want security we have to fix government. No other industry can just expose SSN's, credit cards, personal details, and get a slap on the wrist. Software must be treated like an engineering profession and have the responsibility to uphold standards. If not, they get big fines that go into paying the victims and research into security. This will not happen in the U.S. because bribery is legal and tech corps are all in on using it to make the world worse for everyone except themselves. You need a different country to have a properly functioning industry. The EU is doing very well at this.

13 points by pulisse 3y ago

"Ivan Krstic has headed Apple Security Engineering and Architecture (SEAR), the group responsible for end-to-end security of all Apple products, since its inception. He has led the design and implementation of key security mechanisms across Apple platforms, including Lockdown Mode, Two-factor authentication for Apple ID, and Advanced Data Protection for iCloud." The author works for Apple. Should personal data should be "in the cloud" under the control of third parties like Apple. Why does Apple want this data. The company competes with the likes of Facebook and other privacy-destroying "tech" companies. We know why Facebook wants such data. Apple's advertising revenue continues to increase. Unfortunately, this submission reads like PR for Apple. And it coincides with similar propaganda from Facebook: https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/ https://engineering.fb.com/2023/12/06/security/building-end-... We know that Zuckerberg actually wanted to break WhatsApp encryption. Encryption is a good idea if person A wants to protect against someon stealing their computer or storage device, or if person A wants to send data to persona B over the internet. But if all storage is on Apple's computers, and if sending data to person B requires sending it through Apple's computers, then Apple is the one controlling encryption, not persons A or B. Given that Apple is in the business of collecting people's personal data and metadata for profit, ideally below the user's awareness, e.g., encrypted in a way that the user cannot view their own traffic, that's not a good idea.

devwastaken 3y ago

The article states that current practices don't serve the company or the people. This is false. Good security is very expensive. The board knowingly bets that the damage will be far less than the cost. Meaning it's a non tangible effect to them. It's mostly noise in the form of drama. If we want security we have to fix government. No other industry can just expose SSN's, credit cards, personal details, and get a slap on the wrist. Software must be treated like an engineering profession and have the responsibility to uphold standards. If not, they get big fines that go into paying the victims and research into security. This will not happen in the U.S. because bribery is legal and tech corps are all in on using it to make the world worse for everyone except themselves. You need a different country to have a properly functioning industry. The EU is doing very well at this.