3 ms·

> have an Android device beside me that regularly asks me to back my device up to the cloud But is that backup encrypted? If it's not, all they need is <whate

> have an Android device beside me that regularly asks me to back my device up to the cloud But is that backup encrypted? If it's not, all they need is <whatever piece of paper a british security official needs, if any> to access your data. This is about having access to backups that are theoretically encrypted with a key Apple doesn't have? > We're talking about the largest back door I've ever heard of. Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight?

burnerthrow008 2y ago
> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight? Er, no...? I'm not sure where you get that idea. Access requires a warrant, and companies are not compelled to build systems which enable them to decrypt all data covered by the warrant. See, for example, the Las Vegas shooter case, where Apple refused to create an iOS build that would bypass iCloud security.
- nottorp 2y ago
  I asked if your Android backup is encrypted. Implies I'm talking about unencrypted data. > See, for example, the Las Vegas shooter case I am not in Las Vegas or anywhere else in the US. So as far as i know all the data about me that is stored in the US is easily accessible without a warrant unless it's encrypted with a key that's not available with the storage. > companies are not compelled to build systems which enable them to decrypt all data covered by the warrant Again, not what I was talking about. I'm merely pointing out that your data is not necessarily encrypted, and that the "rest of the world" was already unprotected vs at least one state. The UK joining in would just add another.
  - skydhash 2y ago
    People always overestimate how much companies will defy their government for you, legally or otherwise.
  - GeekyBear 2y ago
    This is why Apple, and more recently Google, create systems where they don't have access to your unencrypted data on their servers. > Google Maps is changing the way it handles your location data. Instead of backing up your data to the cloud, Google will soon store it locally on your device. https://www.theverge.com/2024/6/5/24172204/google-maps-delete-location-history-timeline https://www.theverge.com/2024/6/5/24172204/google-maps-delet... You can't be forced to hand over data on your servers that you don't have access to, warrant or no. The UK wants to make this workaround illegal on an international basis.
    - pmontra 2y ago
      > You can't be forced to hand over data on your servers that you don't have access to, warrant or no. But you can be forced to record and store that data even if you don't want to.
      - GeekyBear 2y ago
        Which is why Apple takes the stance that the users device shouldn't be sending data to the mothership at all, if it isn't absolutely necessary. Compare Apple Maps and Google Maps. Google initially hoovered up all your location data and kept it forever. They learned from Waze that one use case for location data was keeping your map data updated. Apple figured out how to accomplish the goal of keeping map data updated without storing private user data that could be subject to a subpoena. > “We specifically don’t collect data, even from point A to point B,” notes Cue. “We collect data — when we do it — in an anonymous fashion, in subsections of the whole, so we couldn’t even say that there is a person that went from point A to point B. The segments that he is referring to are sliced out of any given person’s navigation session. Neither the beginning or the end of any trip is ever transmitted to Apple. Rotating identifiers, not personal information, are assigned to any data sent to Apple... Apple is working very hard here to not know anything about its users. https://techcrunch.com/2018/06/29/apple-is-rebuilding-maps-from-the-ground-up/?guccounter=1 https://techcrunch.com/2018/06/29/apple-is-rebuilding-maps-f...
        acka 2y ago
  - spankalee 2y ago
    > all the data about me that is stored in the US is easily accessible without a warrant No, law enforcement needs a warrant to legally access any data. This is why Prism was illegal, and why companies like Google are pushing back against overly broad geofence search warrants.
    - alt227 2y ago
      > This is why Prism was illegal Yet it still existed, and was used for surveillance by 3 letter agencies. Why do you think this is any different?
      - somenameforme 2y ago
        No idea why the two of you are using past tense. PRISM is still very much alive and well.
    - fdb345 2y ago
      All Encrochat evidence was illegal in at least three different ways. UK Law enforcement didn't care. They just lied.
      - multjoy 2y ago
        No it wasn't. The Dutch cracked and wiretapped it. It has been held not to be intercept evidence per RIPA so capable of being used in evidence. Most went guilty because they caught red-handed in the most egregious criminality you've seen. Encro was designed to enable and protect criminal communications. It had no redeeming public value.
        fdb345 2y ago
        [flagged]
mtrovo 2y ago
> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight? Totally agree. Having this discussion so US centred just makes us miss the forest for the trees. Apart from data owned by US citizens, my impression is that data stored in the US is fair game for three letter agencies, and I really doubt most companies would spend more than five minutes agreeing with law enforcement if asked for full access to their database on non-US nationals. Also, remember that WhatsApp is the go-to app for communication in most of the world outside the US. And although it's end-to-end encrypted, it's always nudging you to back up your data to Google or Apple storage. I can't think of a better target for US intelligence to get a glimpse of conversations about their targets in real time, without needing to hack each individual phone. If WhatsApp were a Chinese app, this conversation about E2E and backup restrictions would have happened a long time ago. It's the same on how TikTok algorithm suddenly had a strong influence on steering public opinion and instead of fixing the game we banned the player.
- wkat4242 2y ago
  This is different IMO. When you buy Apple you buy an American product and you know the company is beholden to US law. Snowden has made perfectly clear how much they can be trusted. When you buy it anyway it's an informed choice. Here a country that has no ties with most of apple's customers is just butting in and claiming access to all of them. So what's next. Are we also giving access to everyone's data to Russia? Iran?
- causal 2y ago
  Agree in principle, though WhatsApp backups are encrypted with a user provided password, so ostensibly inaccessible to Google or whoever you use as backup
  - scripturial 2y ago
    What makes you think WhatsApp backups don’t have a secondary way to unlock the encryption key? Wouldn’t it be more logical to assume the encryption key for whatsapp backups can also be unlocked by an alternate “password” If the US is willing to build an entire data center in Outback Australia to allow warrantless access to US citizen data, why wouldn’t they be forcing WhatsApp backups to be unlockable?
squeaky-clean 2y ago
> But is that backup encrypted? If it's not, all they need is <whatever piece of paper a british security official needs, if any> to access your data. Based on them mentioning the difficulty of opting out, I presume OOP does not use Google's cloud backup.
crimsoneer 2y ago
Android data isn't encrypted at rest (or at least not in a way Google doesn't have the key). If the uk gov has a warrant, they can ask Google to provide your Google Drive content. The whole point of this issue is Apple specifically designed ADP so they couldn't do that.
- sunshowers 2y ago
  Android backups are encrypted at rest using the lockscreen PIN or passphrase: https://developer.android.com/privacy-and-security/risks/backup-best-practices#security-recommendations-for-backups-use-the-standard-android-backup-system https://developer.android.com/privacy-and-security/risks/bac... So not hugely secure for most people if they use 4-6 decimal digits, but possible to make secure if you set a longer passphrase. I don't know what Google's going to do about this UK business. edit: Ah it looks like they have a Titan HSM involved as well. Have to take Google's word for it, but an HSM would let you do rate limits and lockouts. If that's in place, it seems all right to me.
  - autoexec 2y ago
    I wonder how hard it would be for the US government to force Google to just get the lockscreen pin off of your device or for them to just infect your device with something to capture it themselves.
- Gatorguy 2y ago
  Wrong. Google Android user cloud backups are E2EE by default.There is no option to opt out. Use Google's backup service and your data is encrypted at rest, in transit, and on device. aka end-to-end. It's not just Google saying it. Google Cloud encryption is independently verified
noinsight 2y ago
> non US citizens whose data is stored in the US They don't even care where it's stored... See: CLOUD Act [1] [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- autoexec 2y ago
  I honestly doubt they even limit themselves to the data of non-US citizens. They have no respect at all for the fourth amendment.
93po 2y ago
i think people focus on whether backups are encrypted too much. it really doesn't matter when the government has remote access equivalent to your live phone when it's in an unencrypted state, which they almost certainly do.
deleted 2y ago
[deleted]

burnerthrow008 2y ago

> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight? Er, no...? I'm not sure where you get that idea. Access requires a warrant, and companies are not compelled to build systems which enable them to decrypt all data covered by the warrant. See, for example, the Las Vegas shooter case, where Apple refused to create an iOS build that would bypass iCloud security.

nottorp 2y ago
I asked if your Android backup is encrypted. Implies I'm talking about unencrypted data. > See, for example, the Las Vegas shooter case I am not in Las Vegas or anywhere else in the US. So as far as i know all the data about me that is stored in the US is easily accessible without a warrant unless it's encrypted with a key that's not available with the storage. > companies are not compelled to build systems which enable them to decrypt all data covered by the warrant Again, not what I was talking about. I'm merely pointing out that your data is not necessarily encrypted, and that the "rest of the world" was already unprotected vs at least one state. The UK joining in would just add another.
- skydhash 2y ago
  People always overestimate how much companies will defy their government for you, legally or otherwise.
- GeekyBear 2y ago
  This is why Apple, and more recently Google, create systems where they don't have access to your unencrypted data on their servers. > Google Maps is changing the way it handles your location data. Instead of backing up your data to the cloud, Google will soon store it locally on your device. https://www.theverge.com/2024/6/5/24172204/google-maps-delete-location-history-timeline https://www.theverge.com/2024/6/5/24172204/google-maps-delet... You can't be forced to hand over data on your servers that you don't have access to, warrant or no. The UK wants to make this workaround illegal on an international basis.
  - pmontra 2y ago
    > You can't be forced to hand over data on your servers that you don't have access to, warrant or no. But you can be forced to record and store that data even if you don't want to.
    - GeekyBear 2y ago
      Which is why Apple takes the stance that the users device shouldn't be sending data to the mothership at all, if it isn't absolutely necessary. Compare Apple Maps and Google Maps. Google initially hoovered up all your location data and kept it forever. They learned from Waze that one use case for location data was keeping your map data updated. Apple figured out how to accomplish the goal of keeping map data updated without storing private user data that could be subject to a subpoena. > “We specifically don’t collect data, even from point A to point B,” notes Cue. “We collect data — when we do it — in an anonymous fashion, in subsections of the whole, so we couldn’t even say that there is a person that went from point A to point B. The segments that he is referring to are sliced out of any given person’s navigation session. Neither the beginning or the end of any trip is ever transmitted to Apple. Rotating identifiers, not personal information, are assigned to any data sent to Apple... Apple is working very hard here to not know anything about its users. https://techcrunch.com/2018/06/29/apple-is-rebuilding-maps-from-the-ground-up/?guccounter=1 https://techcrunch.com/2018/06/29/apple-is-rebuilding-maps-f...
      - acka 2y ago
- spankalee 2y ago
  > all the data about me that is stored in the US is easily accessible without a warrant No, law enforcement needs a warrant to legally access any data. This is why Prism was illegal, and why companies like Google are pushing back against overly broad geofence search warrants.
  - alt227 2y ago
    > This is why Prism was illegal Yet it still existed, and was used for surveillance by 3 letter agencies. Why do you think this is any different?
    - somenameforme 2y ago
      No idea why the two of you are using past tense. PRISM is still very much alive and well.
  - fdb345 2y ago
    All Encrochat evidence was illegal in at least three different ways. UK Law enforcement didn't care. They just lied.
    - multjoy 2y ago
      No it wasn't. The Dutch cracked and wiretapped it. It has been held not to be intercept evidence per RIPA so capable of being used in evidence. Most went guilty because they caught red-handed in the most egregious criminality you've seen. Encro was designed to enable and protect criminal communications. It had no redeeming public value.
      - fdb345 2y ago
        [flagged]

mtrovo 2y ago

> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight? Totally agree. Having this discussion so US centred just makes us miss the forest for the trees. Apart from data owned by US citizens, my impression is that data stored in the US is fair game for three letter agencies, and I really doubt most companies would spend more than five minutes agreeing with law enforcement if asked for full access to their database on non-US nationals. Also, remember that WhatsApp is the go-to app for communication in most of the world outside the US. And although it's end-to-end encrypted, it's always nudging you to back up your data to Google or Apple storage. I can't think of a better target for US intelligence to get a glimpse of conversations about their targets in real time, without needing to hack each individual phone. If WhatsApp were a Chinese app, this conversation about E2E and backup restrictions would have happened a long time ago. It's the same on how TikTok algorithm suddenly had a strong influence on steering public opinion and instead of fixing the game we banned the player.

wkat4242 2y ago
This is different IMO. When you buy Apple you buy an American product and you know the company is beholden to US law. Snowden has made perfectly clear how much they can be trusted. When you buy it anyway it's an informed choice. Here a country that has no ties with most of apple's customers is just butting in and claiming access to all of them. So what's next. Are we also giving access to everyone's data to Russia? Iran?
causal 2y ago
Agree in principle, though WhatsApp backups are encrypted with a user provided password, so ostensibly inaccessible to Google or whoever you use as backup
- scripturial 2y ago
  What makes you think WhatsApp backups don’t have a secondary way to unlock the encryption key? Wouldn’t it be more logical to assume the encryption key for whatsapp backups can also be unlocked by an alternate “password” If the US is willing to build an entire data center in Outback Australia to allow warrantless access to US citizen data, why wouldn’t they be forcing WhatsApp backups to be unlockable?

squeaky-clean 2y ago

> But is that backup encrypted? If it's not, all they need is <whatever piece of paper a british security official needs, if any> to access your data. Based on them mentioning the difficulty of opting out, I presume OOP does not use Google's cloud backup.

crimsoneer 2y ago

Android data isn't encrypted at rest (or at least not in a way Google doesn't have the key). If the uk gov has a warrant, they can ask Google to provide your Google Drive content. The whole point of this issue is Apple specifically designed ADP so they couldn't do that.

sunshowers 2y ago
Android backups are encrypted at rest using the lockscreen PIN or passphrase: https://developer.android.com/privacy-and-security/risks/backup-best-practices#security-recommendations-for-backups-use-the-standard-android-backup-system https://developer.android.com/privacy-and-security/risks/bac... So not hugely secure for most people if they use 4-6 decimal digits, but possible to make secure if you set a longer passphrase. I don't know what Google's going to do about this UK business. edit: Ah it looks like they have a Titan HSM involved as well. Have to take Google's word for it, but an HSM would let you do rate limits and lockouts. If that's in place, it seems all right to me.
- autoexec 2y ago
  I wonder how hard it would be for the US government to force Google to just get the lockscreen pin off of your device or for them to just infect your device with something to capture it themselves.
Gatorguy 2y ago
Wrong. Google Android user cloud backups are E2EE by default.There is no option to opt out. Use Google's backup service and your data is encrypted at rest, in transit, and on device. aka end-to-end. It's not just Google saying it. Google Cloud encryption is independently verified

noinsight 2y ago

> non US citizens whose data is stored in the US They don't even care where it's stored... See: CLOUD Act [1] [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

autoexec 2y ago
I honestly doubt they even limit themselves to the data of non-US citizens. They have no respect at all for the fourth amendment.

93po 2y ago

i think people focus on whether backups are encrypted too much. it really doesn't matter when the government has remote access equivalent to your live phone when it's in an unencrypted state, which they almost certainly do.

deleted 2y ago

[deleted]