3 ms·

What computer resources are being used without authorization?

by grok25 3y ago

hedora 3y ago
They gave Apple authorization to access their phone (the phone is not Apple property) in order to copy certain things into the cloud. They uploaded new software and downloaded data they were not authorized to download without getting permission first. I'm sure there is some cover your ass clause in the EULA that tries to protect them when they (accidentally or on purpose) violate the CFAA, but, in this case, they pretty clearly did things that exceeded their authorization. The relevant part of the CFAA is a.1 (I removed the bits that are irrelevant): > (a) Whoever— > (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained ... restricted data, as defined in ... causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it ... https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- gruez 3y ago
  That definition quickly becomes absurd. If I run "cat a.txt b.txt" but only give it authorization to read a.txt, does that mean Richard Stallman (or whoever wrote the program) is breaking the law? You might say consent is implied in that case but: 1. I thought implied consent was out of fashion these days 2. What if it's something like an IDE that reads the surrounding directories? VS code does that and I certainly didn't know that feature even existed before I first opened it, so how could have given authorization? Is Microsoft in breach of the CFAA?
  - funcDropShadow 3y ago
    > 2. What if it's something like an IDE that reads the surrounding directories? Reading the directory in a software running on your computer is not the problem. The question is, is data from the surrounding directories transmitted to somebody else's computer, a.k.a. The Cloud?
- grok25 3y ago
  The data wasn’t transmitted, communicated or delivered to Apple. It’s E2E encrypted, so Apple can’t receive it. The service isn’t capable of delivering the keychain to anything other than the user’s own devices.
  - ratg13 3y ago
    Who do you think the other end is? It’s Apple. They are the other end where the traffic is decrypted. And yes they can see your stuff. We know this because law enforcement gets access to it all the time. The keychain is just another keystore.
    - kalleboo 3y ago
      Please don't spread lies. > They are the other end where the traffic is decrypted Only for certain types of data, with certain settings. That does not include the keychain. https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 > And yes they can see your stuff. We know this because law enforcement gets access to it all the time. What law enforcement typically gets access to is iCloud Backups, which is not end-to-end encrypted by default (but can be) and is not a mandatory feature. iCloud backups do not contain your keychain. > The keychain is just another keystore Nobody has said anything else? But Apple does not hold the key to decrypt it.
      - hedora 3y ago
        Your link (Dec 14, 2023) says they E2E encrypt it and do not store escrow keys, but this link (May 13, 2022) says they store escrow keys for keychain: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych... Did they announce this change? It's a pretty major UI departure. In particular, if you have one Apple device and loose it, the 2022 article implies you can recover your keychain, but the 2023 article says you're completely screwed. A lot of people rely on iCloud backup. It seems like there should be a device-wide toggle that lets you choose between the two behaviors for things like passwords, health data, and all the other E2E apps.

What computer resources are being used without authorization?

by grok25 3y ago

What computer resources are being used without authorization?

They gave Apple authorization to access their phone (the phone is not Apple property) in order to copy certain things into the cloud. They uploaded new software and downloaded data they were not authorized to download without getting permission first. I'm sure there is some cover your ass clause in the EULA that tries to protect them when they (accidentally or on purpose) violate the CFAA, but, in this case, they pretty clearly did things that exceeded their authorization. The relevant part of the CFAA is a.1 (I removed the bits that are irrelevant): > (a) Whoever— > (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained ... restricted data, as defined in ... causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it ... https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

gruez 3y ago
That definition quickly becomes absurd. If I run "cat a.txt b.txt" but only give it authorization to read a.txt, does that mean Richard Stallman (or whoever wrote the program) is breaking the law? You might say consent is implied in that case but: 1. I thought implied consent was out of fashion these days 2. What if it's something like an IDE that reads the surrounding directories? VS code does that and I certainly didn't know that feature even existed before I first opened it, so how could have given authorization? Is Microsoft in breach of the CFAA?
- funcDropShadow 3y ago
  > 2. What if it's something like an IDE that reads the surrounding directories? Reading the directory in a software running on your computer is not the problem. The question is, is data from the surrounding directories transmitted to somebody else's computer, a.k.a. The Cloud?
grok25 3y ago
The data wasn’t transmitted, communicated or delivered to Apple. It’s E2E encrypted, so Apple can’t receive it. The service isn’t capable of delivering the keychain to anything other than the user’s own devices.
- ratg13 3y ago
  Who do you think the other end is? It’s Apple. They are the other end where the traffic is decrypted. And yes they can see your stuff. We know this because law enforcement gets access to it all the time. The keychain is just another keystore.
  - kalleboo 3y ago
    Please don't spread lies. > They are the other end where the traffic is decrypted Only for certain types of data, with certain settings. That does not include the keychain. https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 > And yes they can see your stuff. We know this because law enforcement gets access to it all the time. What law enforcement typically gets access to is iCloud Backups, which is not end-to-end encrypted by default (but can be) and is not a mandatory feature. iCloud backups do not contain your keychain. > The keychain is just another keystore Nobody has said anything else? But Apple does not hold the key to decrypt it.
    - hedora 3y ago
      Your link (Dec 14, 2023) says they E2E encrypt it and do not store escrow keys, but this link (May 13, 2022) says they store escrow keys for keychain: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych... Did they announce this change? It's a pretty major UI departure. In particular, if you have one Apple device and loose it, the 2022 article implies you can recover your keychain, but the 2023 article says you're completely screwed. A lot of people rely on iCloud backup. It seems like there should be a device-wide toggle that lets you choose between the two behaviors for things like passwords, health data, and all the other E2E apps.