4 ms·

The U.S. also attempted to force Apple to add a back door just a decade ago. > Tim Cook, the C.E.O. of Apple, which has been ordered to help the F.B.I. get int

The U.S. also attempted to force Apple to add a back door just a decade ago. > Tim Cook, the C.E.O. of Apple, which has been ordered to help the F.B.I. get into the cell phone of the San Bernardino shooters, wrote in an angry open letter this week that "the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create." The second part of that formulation has rightly received a great deal of attention: Should a back door be built into devices that are used for encrypted communications? https://www.newyorker.com/news/amy-davidson/a-dangerous-all-writ-precedent-in-the-apple-case https://www.newyorker.com/news/amy-davidson/a-dangerous-all-...

reactordev 1y ago
[flagged]
- hobs 1y ago
  I mean Cellebrite has been a public name for a long time now, and LEO pays for that and similar devices which basically launder zero days and physical exploits to get your stuff.
  - reactordev 1y ago
    Correct, they are one known actor...
- jrockway 1y ago
  I don't think anyone's surprised by that. Our emails have literally been used to target ads at us since like 2006. Cell phone carriers are happy to mine voicemail, call logs, SMS, etc. in the hopes of finding a revenue stream that doesn't involve them having to do irritating work like running fiber to cell phone towers. This leaves contact mining as the odd one out, but given how many apps want to see your contacts, you know that those are being sold by at least one of those apps. None of this stuff has ever been end-to-end encrypted, so there can't be any way people expect it to be private.
  - xorcist 1y ago
    That's not a revenue stream at any cell phone carrier I've seen. They do what they are legally obliged to do, and while they do get paid for it, it's a fraction of the actual cost of providing the data. The state tends to drive the hell of a bargain. The service providers, such as Facebook, Google and Apple though, that's entirely different.
    - jrockway 1y ago
      Verizon silently opted everyone into sharing their browser history (based on DNS I guess) with advertisers: https://arstechnica.com/information-technology/2021/12/verizon-ignored-users-previous-opt-outs-in-latest-push-to-scan-web-browsing/ https://arstechnica.com/information-technology/2021/12/veriz... I have to imagine that the other companies are doing this as well.
      - reactordev 1y ago
        Warmer, think of the other vector, from the data broker point of view…
    - shakna 1y ago
      Almost all telcos in the US sell data to brokers. Like for example, when they got caught selling location data they were required to protect. [0] [0] https://www.theregister.com/2024/04/29/fcc_telecom_fines/ https://www.theregister.com/2024/04/29/fcc_telecom_fines/
- kingnothing 1y ago
  It's called Pegasus. https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)
  - reactordev 1y ago
    That's old patched spyware. I'm talking about something entirely different. No device install needed.
- GeekyBear 1y ago
  No-one is surprised by the existence of the security arms race. It's the reason that Apple and Google recently started rebooting devices that haven't been unlocked in a while.
- echelon_musk 1y ago
  With physical access to the device or not?
  - reactordev 1y ago
    Not
- idiotsecant 1y ago
  You're 'not at liberty' to post wikipedia links? Or you have knowledge of programs wikipedia doesn't?
  - reactordev 1y ago
    The latter. Wikipedia doesn’t know everything. NDA’s are enforceable.
    - idiotsecant 1y ago
      Pretty sure no NDA ever says it's forbidden to discuss the subject of the agreement, but cute little internet innuendos whispered from behind a coy little fan are ok.
    - Silhouette 1y ago
      Extraordinary claims require extraordinary evidence. If you really have access to secret information of that significance and you really are under an NDA that prohibits you from talking about it then why are you casually posting innuendo about it on HN?
      - reactordev 1y ago
        To point out that your data isn't safe from law enforcement. Quite the contrary. I think everyone should be aware of the state we are in. And while I can't go into detail about how I know, I want others to be aware that anything on their devices is fair game. Now a day's with or without a warrant. Three letter agencies are operating with impunity. Using this very tech.
        Silhouette 1y ago
        Again - extraordinary claims require extraordinary evidence. It's no secret that there are groups actively looking for new exploits and that sometimes vulnerabilities are discovered that become zero days. It's a good bet that police and security services take an active interest in those vulnerabilities when they are found. But that's very different to claiming the police can easily unlock any device any time they want to and there is a range of private companies around who provide that service to them.
- andrepd 1y ago
  Emails and GSM calls yes, obviously. But e.g. Signal communications? You need a Pegasus-tier exploit for that, which means that unless you're high profile enough you should be safe.
Spooky23 1y ago
You need to think about what they don’t say with these matters. He said Apple does not have and won’t create a backdoor. That was well crafted and means exactly what he said, any implicit meaning is an artifact of your brain.
- BuildTheRobots 1y ago
  I might postulate that while Rhubarb LTD absolutely doesn't hold and will never create a backdoor, Celery Inc does. Ignore the fact that Celery is staffed by some of Rhubarb's senior engineers working part time. Ignore the fact Celery are contracted to do security assessments so have access to all the source code, radio firmware and schematics... I absolutely don't actually know anything about Apple, but I've seen some of the ways even small companies legally split themselves up to avoid tax or various forms of liability. Multiple phone numbers to the same phone, multiple domains and email providers to the same laptop. Multiple denials that you've ever heard of the other company let alone happen to share the same office space... There's a massive difference between a truthful statement and an honest one; anyone that works with code should understand that.
bigyabai 1y ago
The US succeeded, according to American lawmakers: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-secretly-giving-governments-push-notification-data/ https://arstechnica.com/tech-policy/2023/12/apple-admits-to-... Apple has since confirmed in a statement provided to Ars that the US federal government "prohibited" the company "from sharing any information," but now that Wyden has outed the feds, Apple has updated its transparency reporting and will "detail these kinds of requests" in a separate section on push notifications in its next report. Apple's hidden at least one warrantless backdoor in their systems for the purpose of federal surveillance. I have no reason to believe the exploitation stops there.
- GeekyBear 1y ago
  Apple and Google had no choice but to comply with the National Security Letters demanding access to user's push notification data. They also can't refuse to comply with warrants demanding any such unencrypted data that is stored on their servers. That's not the same thing as adding a back door to allow access to encrypted user data that is stored on the user's device. It's also different than storing encrypted user data on your server, when you have purposefully designed a system where you don't have access to the user's encryption key. Encrypted user data backup is the feature that Apple disabled access to in the UK rather than comply with the order to insert a back door in the OS.
  - bigyabai 1y ago
    You'd better hope you're right. Nobody is auditing Apple who can hold them accountable. The lack of transparency is how we ended up on this slippery slope in the first place. Good security models typically don't hinge on being lucky.
    - GeekyBear 1y ago
      Nobody is auditing Google to prove that they aren't selling user data to third party data brokers. Should we disbelieve them when they say they don't do so?
  - 1y ago

reactordev 1y ago

[flagged]

hobs 1y ago
I mean Cellebrite has been a public name for a long time now, and LEO pays for that and similar devices which basically launder zero days and physical exploits to get your stuff.
- reactordev 1y ago
  Correct, they are one known actor...
jrockway 1y ago
I don't think anyone's surprised by that. Our emails have literally been used to target ads at us since like 2006. Cell phone carriers are happy to mine voicemail, call logs, SMS, etc. in the hopes of finding a revenue stream that doesn't involve them having to do irritating work like running fiber to cell phone towers. This leaves contact mining as the odd one out, but given how many apps want to see your contacts, you know that those are being sold by at least one of those apps. None of this stuff has ever been end-to-end encrypted, so there can't be any way people expect it to be private.
- xorcist 1y ago
  That's not a revenue stream at any cell phone carrier I've seen. They do what they are legally obliged to do, and while they do get paid for it, it's a fraction of the actual cost of providing the data. The state tends to drive the hell of a bargain. The service providers, such as Facebook, Google and Apple though, that's entirely different.
  - jrockway 1y ago
    Verizon silently opted everyone into sharing their browser history (based on DNS I guess) with advertisers: https://arstechnica.com/information-technology/2021/12/verizon-ignored-users-previous-opt-outs-in-latest-push-to-scan-web-browsing/ https://arstechnica.com/information-technology/2021/12/veriz... I have to imagine that the other companies are doing this as well.
    - reactordev 1y ago
      Warmer, think of the other vector, from the data broker point of view…
  - shakna 1y ago
    Almost all telcos in the US sell data to brokers. Like for example, when they got caught selling location data they were required to protect. [0] [0] https://www.theregister.com/2024/04/29/fcc_telecom_fines/ https://www.theregister.com/2024/04/29/fcc_telecom_fines/
kingnothing 1y ago
It's called Pegasus. https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)
- reactordev 1y ago
  That's old patched spyware. I'm talking about something entirely different. No device install needed.
GeekyBear 1y ago
No-one is surprised by the existence of the security arms race. It's the reason that Apple and Google recently started rebooting devices that haven't been unlocked in a while.
echelon_musk 1y ago
With physical access to the device or not?
- reactordev 1y ago
  Not
idiotsecant 1y ago
You're 'not at liberty' to post wikipedia links? Or you have knowledge of programs wikipedia doesn't?
- reactordev 1y ago
  The latter. Wikipedia doesn’t know everything. NDA’s are enforceable.
  - idiotsecant 1y ago
    Pretty sure no NDA ever says it's forbidden to discuss the subject of the agreement, but cute little internet innuendos whispered from behind a coy little fan are ok.
  - Silhouette 1y ago
    Extraordinary claims require extraordinary evidence. If you really have access to secret information of that significance and you really are under an NDA that prohibits you from talking about it then why are you casually posting innuendo about it on HN?
    - reactordev 1y ago
      To point out that your data isn't safe from law enforcement. Quite the contrary. I think everyone should be aware of the state we are in. And while I can't go into detail about how I know, I want others to be aware that anything on their devices is fair game. Now a day's with or without a warrant. Three letter agencies are operating with impunity. Using this very tech.
      - Silhouette 1y ago
        Again - extraordinary claims require extraordinary evidence. It's no secret that there are groups actively looking for new exploits and that sometimes vulnerabilities are discovered that become zero days. It's a good bet that police and security services take an active interest in those vulnerabilities when they are found. But that's very different to claiming the police can easily unlock any device any time they want to and there is a range of private companies around who provide that service to them.
andrepd 1y ago
Emails and GSM calls yes, obviously. But e.g. Signal communications? You need a Pegasus-tier exploit for that, which means that unless you're high profile enough you should be safe.

Spooky23 1y ago

You need to think about what they don’t say with these matters. He said Apple does not have and won’t create a backdoor. That was well crafted and means exactly what he said, any implicit meaning is an artifact of your brain.

BuildTheRobots 1y ago
I might postulate that while Rhubarb LTD absolutely doesn't hold and will never create a backdoor, Celery Inc does. Ignore the fact that Celery is staffed by some of Rhubarb's senior engineers working part time. Ignore the fact Celery are contracted to do security assessments so have access to all the source code, radio firmware and schematics... I absolutely don't actually know anything about Apple, but I've seen some of the ways even small companies legally split themselves up to avoid tax or various forms of liability. Multiple phone numbers to the same phone, multiple domains and email providers to the same laptop. Multiple denials that you've ever heard of the other company let alone happen to share the same office space... There's a massive difference between a truthful statement and an honest one; anyone that works with code should understand that.

bigyabai 1y ago

The US succeeded, according to American lawmakers: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-secretly-giving-governments-push-notification-data/ https://arstechnica.com/tech-policy/2023/12/apple-admits-to-... Apple has since confirmed in a statement provided to Ars that the US federal government "prohibited" the company "from sharing any information," but now that Wyden has outed the feds, Apple has updated its transparency reporting and will "detail these kinds of requests" in a separate section on push notifications in its next report. Apple's hidden at least one warrantless backdoor in their systems for the purpose of federal surveillance. I have no reason to believe the exploitation stops there.

GeekyBear 1y ago
Apple and Google had no choice but to comply with the National Security Letters demanding access to user's push notification data. They also can't refuse to comply with warrants demanding any such unencrypted data that is stored on their servers. That's not the same thing as adding a back door to allow access to encrypted user data that is stored on the user's device. It's also different than storing encrypted user data on your server, when you have purposefully designed a system where you don't have access to the user's encryption key. Encrypted user data backup is the feature that Apple disabled access to in the UK rather than comply with the order to insert a back door in the OS.
- bigyabai 1y ago
  You'd better hope you're right. Nobody is auditing Apple who can hold them accountable. The lack of transparency is how we ended up on this slippery slope in the first place. Good security models typically don't hinge on being lucky.
  - GeekyBear 1y ago
    Nobody is auditing Google to prove that they aren't selling user data to third party data brokers. Should we disbelieve them when they say they don't do so?
- 1y ago