6 ms·

>UK users would not be beholden to Apple for E2EE if their clients had legitimate alternatives to the first-party iCloud service. Any sufficiently popular alte

>UK users would not be beholden to Apple for E2EE if their clients had legitimate alternatives to the first-party iCloud service. Any sufficiently popular alternative would be subject to the same issue: you can't backdoor encryption without making it insecure. >There would be no world where Apple could even threaten to disable it. Your framing of this seems to blame Apple, and I don't understand why.

alwayslikethis 2y ago
You can have a service beyond the reach of UK law enforcement. Somehow piracy on the clearnet never really stopped with it being illegal in most countries.
- tree_enjoyer 2y ago
  If you're a company with offices, personnel, and assets in the UK, well your "service" may be beyond the reach, but the rest isn't.
- ziddoap 2y ago
  You're suggesting that Apple, a giant publicly traded company with known people that can be summoned to court and assets located in places that can be seized, should ignore lawful orders from a country they are operating in? Can I ask you how you think that would play out? >Somehow piracy on the clearnet never really stopped with it being illegal in most countries. I'm sure you can spot the difference between a small group of people running a piracy site and a multinational company selling physical devices in physical stores.
  - alwayslikethis 2y ago
    I'm not talking about Apple here. This is what you said: > Any sufficiently popular alternative would be subject to the same issue: you can't backdoor encryption without making it insecure. I'm just saying this is not true because you can have a company without any legal presence, thus susceptibility to law enforcement, in the UK. The legal issue will be shifted onto the user, but it's hard to go after millions of users compared to one big company. The parallel with piracy is that they also tend to be operated from beyond the jurisdiction of countries enforcing the copyright.
    - ben_w 2y ago
      That didn't work out for X in Brazil. The government of a sovereign nation can just require you to have a presence to do business there.
      - alwayslikethis 2y ago
        That's mostly because of them using Musk's other business as leverage. A good company created explicitly to operate like this has no such vulnerability. The UK can try to stop them by trying to block the IPs or whatever, and the company is in turn free to try to circumvent it. The only issue is they may be banned from App store, which is a self-inflicted problem caused by Apple.
        immibis 2y ago
        They simply blocked the whole of X in the whole of Brazil. They made it a crime to circumvent the block, so of course you could still access it with a VPN, as long as you didn't log into any account tied to your presence in Brazil, making it useless for politicians and the like. They didn't need to "use another business as leverage."
    - robertlagrant 2y ago
      > you can have a company without any legal presence, thus susceptibility to law enforcement, in the UK This is true, although you'd need to sideload to avoid things like "UK government bans this app from the UK app store".
      - Filligree 2y ago
        Or worse, “UK government requires the App Store version to be backdoored”.
  - wqaatwt 2y ago
    > should ignore lawful orders from a country they are operating in? By allowing users to install arbitrary software on their computers which is not directly controlled by them? That certainly would be shocking and unheard of.
  - genewitch 2y ago
    "Lawful" "order" is cute.
lll-o-lll 2y ago
> you can't backdoor encryption without making it insecure. That’s not really true is it? If I have a building where every room has its own key, but there is also a “master key” that can open all doors; then it’s not “insecure”. You want to be pretty bl—dy careful with that master key, sure, but the idea isn’t crazy.
- akimbostrawman 2y ago
  Even the most secure masterkey can just be stolen. https://en.m.wikipedia.org/wiki/EternalBlue https://en.m.wikipedia.org/wiki/EternalBlue
- ziddoap 2y ago
  It is absolutely a crazy idea. Physical analogies don't really work in this situation because of the scale, and the payout. A physical master key for a building has a few hundred thousand/a few million people that could potentially access it. The payout is low (i.e. the motivation is low on average) An encryption backdoor to phones has a few billion people that could potentially access it. From anywhere in the world. The payout is huge (access to all iPhones). Multiple entire governments would dedicate tens of millions of dollars and thousands of people to gain access to a ubiquitous backdoor on something like a phone. The same just isn't true with your building analogy -- they are completely different.
  - lll-o-lll 2y ago
    It doesn’t have to be one key for all, one key for a bucket, per user if needs be. Can’t these master keys be in offline HSM’s? I get your argument, but it doesn’t seem an impossible problem to solve.
    - immibis 2y ago
      So the UK government would buy one HSM for every UK citizen and store their backdoor access key on there? And put the HSMs where? In a big room? Protected by a door, with one key? Or maybe each of the 650 elected politicians gets to hold 10 HSMs, each holding 10,000 keys? That way, by distributing trust, we can be completely sure that politicians are always snooping on about 10% of everyone's mails, instead of worrying about whether it's 100% or 0% at any particular moment.

alwayslikethis 2y ago

You can have a service beyond the reach of UK law enforcement. Somehow piracy on the clearnet never really stopped with it being illegal in most countries.

tree_enjoyer 2y ago
If you're a company with offices, personnel, and assets in the UK, well your "service" may be beyond the reach, but the rest isn't.
ziddoap 2y ago
You're suggesting that Apple, a giant publicly traded company with known people that can be summoned to court and assets located in places that can be seized, should ignore lawful orders from a country they are operating in? Can I ask you how you think that would play out? >Somehow piracy on the clearnet never really stopped with it being illegal in most countries. I'm sure you can spot the difference between a small group of people running a piracy site and a multinational company selling physical devices in physical stores.
- alwayslikethis 2y ago
  I'm not talking about Apple here. This is what you said: > Any sufficiently popular alternative would be subject to the same issue: you can't backdoor encryption without making it insecure. I'm just saying this is not true because you can have a company without any legal presence, thus susceptibility to law enforcement, in the UK. The legal issue will be shifted onto the user, but it's hard to go after millions of users compared to one big company. The parallel with piracy is that they also tend to be operated from beyond the jurisdiction of countries enforcing the copyright.
  - ben_w 2y ago
    That didn't work out for X in Brazil. The government of a sovereign nation can just require you to have a presence to do business there.
    - alwayslikethis 2y ago
      That's mostly because of them using Musk's other business as leverage. A good company created explicitly to operate like this has no such vulnerability. The UK can try to stop them by trying to block the IPs or whatever, and the company is in turn free to try to circumvent it. The only issue is they may be banned from App store, which is a self-inflicted problem caused by Apple.
      - immibis 2y ago
        They simply blocked the whole of X in the whole of Brazil. They made it a crime to circumvent the block, so of course you could still access it with a VPN, as long as you didn't log into any account tied to your presence in Brazil, making it useless for politicians and the like. They didn't need to "use another business as leverage."
  - robertlagrant 2y ago
    > you can have a company without any legal presence, thus susceptibility to law enforcement, in the UK This is true, although you'd need to sideload to avoid things like "UK government bans this app from the UK app store".
    - Filligree 2y ago
      Or worse, “UK government requires the App Store version to be backdoored”.
- wqaatwt 2y ago
  > should ignore lawful orders from a country they are operating in? By allowing users to install arbitrary software on their computers which is not directly controlled by them? That certainly would be shocking and unheard of.
- genewitch 2y ago
  "Lawful" "order" is cute.

lll-o-lll 2y ago

> you can't backdoor encryption without making it insecure. That’s not really true is it? If I have a building where every room has its own key, but there is also a “master key” that can open all doors; then it’s not “insecure”. You want to be pretty bl—dy careful with that master key, sure, but the idea isn’t crazy.

akimbostrawman 2y ago
Even the most secure masterkey can just be stolen. https://en.m.wikipedia.org/wiki/EternalBlue https://en.m.wikipedia.org/wiki/EternalBlue
ziddoap 2y ago
It is absolutely a crazy idea. Physical analogies don't really work in this situation because of the scale, and the payout. A physical master key for a building has a few hundred thousand/a few million people that could potentially access it. The payout is low (i.e. the motivation is low on average) An encryption backdoor to phones has a few billion people that could potentially access it. From anywhere in the world. The payout is huge (access to all iPhones). Multiple entire governments would dedicate tens of millions of dollars and thousands of people to gain access to a ubiquitous backdoor on something like a phone. The same just isn't true with your building analogy -- they are completely different.
- lll-o-lll 2y ago
  It doesn’t have to be one key for all, one key for a bucket, per user if needs be. Can’t these master keys be in offline HSM’s? I get your argument, but it doesn’t seem an impossible problem to solve.
  - immibis 2y ago
    So the UK government would buy one HSM for every UK citizen and store their backdoor access key on there? And put the HSMs where? In a big room? Protected by a door, with one key? Or maybe each of the 650 elected politicians gets to hold 10 HSMs, each holding 10,000 keys? That way, by distributing trust, we can be completely sure that politicians are always snooping on about 10% of everyone's mails, instead of worrying about whether it's 100% or 0% at any particular moment.