4 ms·

Not really. Apple has recently implemented comprehensive encryption measures. They themselves cannot access your data, so there is nothing for them to disclose.

Not really. Apple has recently implemented comprehensive encryption measures. They themselves cannot access your data, so there is nothing for them to disclose. It's hard to understand why anyone would choose anything other than Apple these days tbh.

Nextgrid 2y ago
Key management is a black box controlled by them. Encryption itself is pointless if they can be compelled to give up the key.
- BiteCode_dev 2y ago
  You probably don't need to compel them. PRISM have shown it's easy to setup a program where they are forced to just share everything through a back door to the gov and not tell anyone. It's it's closed source, assume the worse.
- Terretta 2y ago
  They are willing to give you the only key, provided you release them from obligation to help you get your own information back if you lose your key. For most people's threat model, this is not necessary, as even in the case of the San Bernardino terrorist iPhone, Apple doesn't tend to defeat their own security measures on demand. But following that situation and others, Apple added additional measures making it even more difficult for themselves. See this support article: "Advanced Data Protection for iCloud is an optional setting that offers our highest level of cloud data security. If you choose to enable Advanced Data Protection, your trusted devices will retain sole access to the encryption keys for the majority of your iCloud data, thereby protecting it using end-to-end encryption. Additional data protected includes iCloud Backup, Photos, Notes and more." https://support.apple.com/en-nz/102651 https://support.apple.com/en-nz/102651
mdhb 2y ago
If you had read absolutely nothing other than Apple’s marketing material I can see how you might come to that conclusion.
- detourdog 2y ago
  Here's a 224 PDF marketing material to poke holes in. https://support.apple.com/en-gb/guide/security/sece3bee0835/web https://support.apple.com/en-gb/guide/security/sece3bee0835/...
  - mdhb 2y ago
    I don’t know if maybe you missed what I said but the point I was making was that you can’t actually get the full picture of the situation from Apple’s information alone so I don’t know how sending me a link to a PDF that their marketing made is going to help no matter how many pages it is.
    - detourdog 2y ago
      I understood. I thought the pdf provides one the road map to start verifying the material. The internet is full of sources that go deeper than what Apple thinks the general public is interested in. Here is another PDF describe the security certifications. https://help.apple.com/pdf/sccc/en_GB/security-certifications-compliance-center-b.pdf https://help.apple.com/pdf/sccc/en_GB/security-certification... One could also start here with another third party review of the cryptographic process. https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4570.pdf https://csrc.nist.gov/CSRC/media/projects/cryptographic-modu... Here is a document with other third party certifications of the validity of the original document. The full picture is quite complicated but a curious person has access to more than enough data to either make an informed decision or decide to trust no one.
Am4TIfIsER0ppos 2y ago
Are you sure? Do you have the skills and equipment necessary to verify that apple's software and hardware work as they claim. A safer bet would be to assume that apple's government spy device is just as good at spying as google's government spy device.
- Spivak 2y ago
  I mean or you could just look at cases where the encryption has been tested in court by law enforcement. Unless they're sending your phone to Israel at great expense they're not getting in if you have anything but the simplest passwords. It's not like phone and iCloud data hasn't been subpoenaed before.
  - Am4TIfIsER0ppos 2y ago
    The government will read it only when it really wants to. The hospital shooter and the trump shooter were not worthwhile revealing that they can access all the data.
    - lupire 2y ago
      That's a square trade. I'll keep my nefarious behavior on this side of mass murder, and FBI doesn't read my documents.
      - Am4TIfIsER0ppos 2y ago
        You misunderstand me. They are reading it. They won't tell people they they're reading it without a good reason. They want people to keep sending data.
account42 2y ago
If the US government wants your data badly enough they can compel apple to push and update to work around all of these measures. As long as you don't own your device no amount of encryption matters. > It's hard to understand why anyone would choose anything other than Apple these days tbh. You could just not put your data into the hands of one of these companies.
- Spivak 2y ago
  You're basically arguing that there's no point to encrypting 100% of phones. You get that this isn't a useful position to take, right?
  - muwtyhg 2y ago
    I think they're arguing that encryption done by someone else on your behalf is not actually in your control. And if the people who do control it are beholden to the government requests, then they are not a safe option either. I'm not deeply familiar with Apple's encryption systems, but from the other commenters here, it appears that Apple holds the keys and also controls the source code and distribution to the device. It sounds like it might be trivial for them to invalidate their own security.
    - lupire 2y ago
      Apple uses hardware encryption on iPhone and famously told th FBI to pound sand when ordered to break it.
      - extraduder_ire 2y ago
        They're also apparently incapable of breaking it in that specific way on newer phones. (force update that allows unlimited PIN unlock attempts, only possible on the 5c and below)

Nextgrid 2y ago

Key management is a black box controlled by them. Encryption itself is pointless if they can be compelled to give up the key.

BiteCode_dev 2y ago
You probably don't need to compel them. PRISM have shown it's easy to setup a program where they are forced to just share everything through a back door to the gov and not tell anyone. It's it's closed source, assume the worse.
Terretta 2y ago
They are willing to give you the only key, provided you release them from obligation to help you get your own information back if you lose your key. For most people's threat model, this is not necessary, as even in the case of the San Bernardino terrorist iPhone, Apple doesn't tend to defeat their own security measures on demand. But following that situation and others, Apple added additional measures making it even more difficult for themselves. See this support article: "Advanced Data Protection for iCloud is an optional setting that offers our highest level of cloud data security. If you choose to enable Advanced Data Protection, your trusted devices will retain sole access to the encryption keys for the majority of your iCloud data, thereby protecting it using end-to-end encryption. Additional data protected includes iCloud Backup, Photos, Notes and more." https://support.apple.com/en-nz/102651 https://support.apple.com/en-nz/102651

mdhb 2y ago

If you had read absolutely nothing other than Apple’s marketing material I can see how you might come to that conclusion.

detourdog 2y ago
Here's a 224 PDF marketing material to poke holes in. https://support.apple.com/en-gb/guide/security/sece3bee0835/web https://support.apple.com/en-gb/guide/security/sece3bee0835/...
- mdhb 2y ago
  I don’t know if maybe you missed what I said but the point I was making was that you can’t actually get the full picture of the situation from Apple’s information alone so I don’t know how sending me a link to a PDF that their marketing made is going to help no matter how many pages it is.
  - detourdog 2y ago
    I understood. I thought the pdf provides one the road map to start verifying the material. The internet is full of sources that go deeper than what Apple thinks the general public is interested in. Here is another PDF describe the security certifications. https://help.apple.com/pdf/sccc/en_GB/security-certifications-compliance-center-b.pdf https://help.apple.com/pdf/sccc/en_GB/security-certification... One could also start here with another third party review of the cryptographic process. https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4570.pdf https://csrc.nist.gov/CSRC/media/projects/cryptographic-modu... Here is a document with other third party certifications of the validity of the original document. The full picture is quite complicated but a curious person has access to more than enough data to either make an informed decision or decide to trust no one.

Am4TIfIsER0ppos 2y ago

Are you sure? Do you have the skills and equipment necessary to verify that apple's software and hardware work as they claim. A safer bet would be to assume that apple's government spy device is just as good at spying as google's government spy device.

Spivak 2y ago
I mean or you could just look at cases where the encryption has been tested in court by law enforcement. Unless they're sending your phone to Israel at great expense they're not getting in if you have anything but the simplest passwords. It's not like phone and iCloud data hasn't been subpoenaed before.
- Am4TIfIsER0ppos 2y ago
  The government will read it only when it really wants to. The hospital shooter and the trump shooter were not worthwhile revealing that they can access all the data.
  - lupire 2y ago
    That's a square trade. I'll keep my nefarious behavior on this side of mass murder, and FBI doesn't read my documents.
    - Am4TIfIsER0ppos 2y ago
      You misunderstand me. They are reading it. They won't tell people they they're reading it without a good reason. They want people to keep sending data.

account42 2y ago

If the US government wants your data badly enough they can compel apple to push and update to work around all of these measures. As long as you don't own your device no amount of encryption matters. > It's hard to understand why anyone would choose anything other than Apple these days tbh. You could just not put your data into the hands of one of these companies.

Spivak 2y ago
You're basically arguing that there's no point to encrypting 100% of phones. You get that this isn't a useful position to take, right?
- muwtyhg 2y ago
  I think they're arguing that encryption done by someone else on your behalf is not actually in your control. And if the people who do control it are beholden to the government requests, then they are not a safe option either. I'm not deeply familiar with Apple's encryption systems, but from the other commenters here, it appears that Apple holds the keys and also controls the source code and distribution to the device. It sounds like it might be trivial for them to invalidate their own security.
  - lupire 2y ago
    Apple uses hardware encryption on iPhone and famously told th FBI to pound sand when ordered to break it.
    - extraduder_ire 2y ago
      They're also apparently incapable of breaking it in that specific way on newer phones. (force update that allows unlimited PIN unlock attempts, only possible on the 5c and below)