11 ms·
The UK is still trying to backdoor encryption for Apple users
- bigyabai 1y agoIf your OEM can be coerced into pushing a backdoor in an OTA update, maybe our software habits are to blame. We'll always be powerless to stop top-down attacks like this until we demand real audits and accountability in the devices we own. Shaming the UK only kicks the can down the road and further highlights the danger of trusting a black box to remain secure.
- beeflet 1y agoWhen a company has the ability to push OTA updates to a device locked down with trusted computing, it's not even a backdoor at that point, it's a frontdoor. I agree political action here is totally fruitless. The UK government and Apple could already be cooperating and you would have no way of telling the difference.
- JoshTriplett 1y ago> When a company has the ability to push OTA updates to a device locked down with trusted computing, it's not even a backdoor at that point, it's a frontdoor. Ideally, everything that runs outside of an app sandbox would be 100% Open Source. Anything short of that is not sufficient to give people full confidence against a backdoor. (Even that also relies on people paying attention, but it at least gives the possibility that people outside of a company whistleblower could catch and flag a backdoor.)
- zzo38computer 1y agoI think so too. It should include full free open source specifications of hardware, as well as fully FOSS for all software that is not inside of the sandbox system, and probably also FOSS for most of the stuff that is using the sandbox, too. Other things should also be done rather than this way alone, but this will be a very important part of it.
- mulmen 1y agoOpen source alone isn’t enough. You also need a way to build and deploy the code yourself.
- JoshTriplett 1y agoAgreed. And demonstrated reproducibility showing that the result is identical.
- Xelbair 1y agoI'll go even further and bring up Trusting Trust - whole chain needs to be open source and verifiable. and you need to be able to compile each and every part of it.
- hunter2_ 1y ago> you would have no way of telling the difference If only specific individuals are targeted, I agree. But if it's pushed to all users, wouldn't we expect a researcher to notice? Maybe not immediately, so damage will be done in the meantime, but sooner than later.
- SV_BubbleTime 1y agoHow long was HeartBleed exploitable? How many people looked at that code? Now, take the source away and make the exploit intentional.
- michaelt 1y ago> But if it's pushed to all users, wouldn't we expect a researcher to notice? Think of the security a games console has - every download arrives encrypted, all storage encrypted, RAM encrypted, and security hardware in the CPU that makes sure everything is signed by the corporation before decrypting anything. To prevent cheating and piracy. Modern smartphones are the same way. We can't expect independent researchers to notice a backdoor when they can't access the code or the network traffic.
- thewebguyd 1y agoThat’s the trick. We don’t own the devices. We merely license their use. No root, no ownership. People have been warning of this outcome for years and years. Stallman was right and all that. We got laughed out of the room and called paranoid weirdos. Ever since smartphones were a thing it’s been obvious that this is where we were heading.
- jama211 1y agoI mean, arguably you don’t have ownership over anything without a legal right which is enforced by a government etc, and every item has exceptions. You think you own a house, but see how long that lasts if you stop paying land taxes. You only own a car as long as you don’t damage someone else’s car without insurance and it gets repossessed. These are stupid examples so don’t read too deeply into them, but it sorta outlines my point that licensing the use of things is very often as close as we get to owning just about anything. Not saying that’s good or bad, just that that’s kinda how it works.
- ktallett 1y agoAs someone who lives in the UK, I hope Apple tell the government where to shove their requests, and that they don't bow down like they did in China. I would prefer a company withdraws from the UK than listens to these over reaching requests of a power hungry government.
- bigyabai 1y ago> I would prefer a company withdraws from the UK than listens to these over reaching requests of a power hungry government. That doesn't sound super profitable. Apple made money by the truckload bending over to accommodate surveillance in China.
- Normal_gaussian 1y agoWhilst this is true; its also worth considering: If Apple did not stay in the Chinese market they will very quickly have a competitor appear in that market that will then threaten other markets. Arguably, there are already Apple competitors in it and Apple's position keeps them from occupying a space that quickly leads to competing with Apple globally. China is generally viewed as a unique market and capitulating to the Chinese government may lead to capitulation to the US, but not to any other nation as they are incomparable. The UK market will neither create an Apple competitor nor will it provide enough scope to allow existing competitors to meaningfully grow. Capitulating to the UK government will lead to many other countries requiring similar capitulations.
- deleted 1y ago[deleted]
- anonymousiam 1y agoSo from the selfish Apple perspective, it made perfect sense and Apple did the right thing (for them). From a rights/freedom perspective (for their users), they did the wrong thing, but that's not a battle that they they alone can win. Out of the 197 countries in the world, how many have governments that respect the privacy rights of their citizens enough to prevent mass surveillance of them? Answer: Zero. Bring on the arguments about the various laws that prevent this, and I'll point you to the "national security and law enforcement exceptions" they they all have, sometimes in the form of "classified" contracts or court orders, and sometimes in the form of "executive orders" or other similar instruments. There are also agreements between the intelligence services of allied countries that facilitate information sharing, so each counterpart can do the collection and analysis of the partner nation and share the results, without technically violating any of their laws.
- sneak 1y agoThey don’t need to. All of the photos and iMessages are stored in iCloud without e2ee (nobody has ADP turned on, and it’s blocked in the UK anyway) and Apple provides the data to the Five Eyes without a warrant. This is already the status quo in the US. The fact that ADP is offered as an option is irrelevant.
- zer00eyz 1y agohttps://support.apple.com/en-us/102651#:~:text=Advanced%20Data%20Protection:%20Messages%20in,Messages%20in%20iCloud%20encryption%20key https://support.apple.com/en-us/102651#:~:text=Advanced%20Da... Lots of things to fault apple about. This likely is not one of them.
- throawy 1y agoThis must be a response to the headline, without reading the article. It's specifically users' ADP content that the UK gov wants to be able to access.
- leakycap 1y agoIt's encrypted iCloud backups, not ADP. ADP hasn't been available in the UK for some time now.
- throawy 1y agoIt's ADP. That's why Apple didn't reinstate ADP in the UK. The UK wants a backdoor for UK users of ADP. And there are plenty of UK users of ADP - those who got in before it was banned still have it. From the article: > After the U.K. government first issued the TCN in January, Apple was forced to either create a backdoor or block its Advanced Data Protection feature > the US claimed the U.K. withdrew the demand, but Apple did not re-enable Advanced Data Protection > The new order provides insight into why: the U.K. was just rewriting it to only apply to British users
- ChrisArchitect 1y agoDiscussion: https://news.ycombinator.com/item?id=45440226 https://news.ycombinator.com/item?id=45440226
- bradley13 1y ago[flagged]
- mulmen 1y ago> Guillotines were made for this purpose. So were voting booths. Calls to violence are unacceptable.
- dseGH3FETWJJy 1y agoNo, they are sometimes necessary.
- pixxel 1y ago[dead]
- hagbard_c 1y agoOr, in box terms four boxes to be used in the defence of liberty in the given order, these being the soap box, the ballot box, the jury box and finally the ammunition box.
- tremon 1y agoPlease don't shoot the canary in the coalmine. Quoth JFK, in 1962: > Those who make peaceful transition impossible, make violent revolution inevitable.
- AnonymousPlanet 1y agoKarl Popper made the point of democracy being the only form of government that provides getting rid of those in power without bloodshed and violence. If voting will not remove them, what will?
- mulmen 1y agoVoting will remove them, that’s the point.
- 1y ago
- pipes 1y agoThe article states that apple removed the feature in the UK. So what are the UK government demanding access to?
- leakycap 1y agoAdvanced Data Protection, where Apple does not keep a copy of your encryption keys (essentially), was removed in the UK. The UK seems to now want Apple to decrypt/provide access to encrypted iPhone backups. This is where your device backs itself up in a restorable format to the cloud, including passwords and private data. Since Apple has a way to decrypt non-ADP iCloud data, UK wants it.
- blitzar 1y agoFrankly if Apple (or any provider for that matter) hold the encryption key then it isn't encrypted.
- varispeed 1y agoIt's encrapped.
- NoImmatureAdHom 1y agoencrappted
- leakycap 1y agoFrankly most of the services you use work exactly like this, so you must think very few things are encrypted
- blitzar 1y agoA locked door with a key in the lock is not really locked. As far as a court order is concerned, if they hold the keys they are available with the "encrypted" data". Apple already (can and do) provide any and all data they hold, including decrypting data they hold the decryption keys for in response to a court order worldwide.
- holoduke 1y agoWhat is happening in the UK really?. I see numerous clips of the desperate state of many parts of various cities. It seems the country is in a steep decline. The once mighty UK sailing the world now became an island of elitists and many more poor low class folks. Sad reality
- deleted 1y ago[deleted]
- pixxel 1y ago[dead]
- monero-xmr 1y agoI have been following this thread for a long time. The UK is poor, simply put, but it has taken a long time to realize it. But the chickens are coming home to roost now. The blame is primarily the rich and immigrants. The real problem is socialism and heavy taxes, plus a denigration of entrepreneurs and business owners. They will learn, once everything has gone to utter shit
- leakycap 1y ago> The UK is poor, simply put That's far too simply put The UK has incredible wealth, it is just more concentrated than ever in a few select pockets
- monero-xmr 1y agoYes like I said you have the socialism take and your enemy is the rich. You will learn eventually
- argomo 1y agoCapitalism and socialism are both pretty effective at killing competition and rewiring the government & economy to seek extractive rents. Granted, it takes longer with capitalism.
- lucasRW 1y agoWhat, so JD Vance was right ?!
- aucisson_masque 1y agoAren't the English already forced to give cops their phone passwords and face jail time if they refuse to? Giving away Apple's encrypted cloud is just another small step into making 1984 a reality. In France, they tried to make a law to force signals, WhatsApp, and other encrypted messaging to implement backdoors so that they could catch drug dealers. Thankfully, it wasn't voted for, but truthfully, the average people didn't give a shit. I wish there was a way to make people learn how important privacy is to freedom and, therefore, to democracy. I blame the education system that teaches almost nothing relevant. We even had 'citizen lessons', but it was about learning how the political institution works. We never spoke about what is freedom, what it involves, how easy it is to lose it, how hard it is to gain it.
- pbalau 1y ago[flagged]
- ThePowerOfFuet 1y agoHa! Source: https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Powers_Act_2000 https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po...
- varispeed 1y agoSection 49 of the Regulation of Investigatory Powers Act 2000 (RIPA). This section grants police and other public authorities the power to issue a formal written notice (a "Section 49 notice") demanding that a person disclose the password, PIN, or encryption key to a protected device or data. A notice cannot be issued lightly. It requires approval from a judge and can only be used when it is deemed necessary and proportionate for purposes such as: In the interests of national security. For the purpose of preventing or detecting crime. In the interests of the economic well-being of the UK. Refusing to comply with a lawfully issued Section 49 notice is a criminal offence under Section 53 of RIPA Standard cases: Up to two years' imprisonment. Cases involving national security or child indecency: The maximum penalty is increased to five years' imprisonment.
- pessimizer 1y agoThe most important thing about this, and other similar overreach, is that there is no democratic constituency for this. It's a waste of time, almost a distraction, picking at the rationality of these constant attacks. The important thing is to find out exactly who they are doing it for. Who asked for it? Let them speak up, and explain why they are so special that governments should and do obey them. Starmer doesn't personally care about any of this (or anything.) No Labour MP cares about any of this. Who is convincing them to override democracy to create tools that make it easier to override democracy? Force them to drop the pretense that they have come up with this themselves, and that they personally believe that it is important. Start by finding out who the hands were who wrote the actual text. The MPs themselves, and the network of important nephews and nieces that work on their respective staffs are too stupid to write this stuff. Who are the minds that are crafting law for supposed democracies from whole cloth?
- afh1 1y agoGovernment is overreaching, it must be someone else's fault!
- pessimizer 1y agoGovernment is not a guy, it's run by guys. They've got you blaming an abstraction.
- miroljub 1y ago[flagged]
- deleted 1y ago[deleted]
- skippyboxedhero 1y agoSecurity services. You have to be absolutely blind at this point not to realise this. The "media campaigns" are identical to the ones used for the past few decades, in print media these were run by tabloids and they have moved on, with less success, online (in the 90s, the coverage of the tabloid campaigns was wall-to-wall). OSA was textbook: unrelated tragic event, young child, grieving parents, mentioning this campaign in relation to the OSA repeatedly despite them being unrelated, same thing every time. The really odd thing is that you have people who will claim that the media is run by right-wing billionaires. On certain topics, you will see every story come from civil servants, the government is just too big (the easiest way to tell is the sources, articles run by civil servants will almost never have actual sources and will usually not be constructed in a logical way, for example a new one is to repeatedly refer to Russia). But because so many people are making so much money from the government, this kind of thing is ignored (and I will also say, the observation that this isn't the actual government just civil servants is important...some newspapers are now notorious for having civil servants contacts who brief journalists against their own ministers, Home Office is the most well-known but it has happened in almost every area...there is nothing that elected officials can do).
- amelius 1y agoIf they succeed, we'll probably never know.
- nedt 1y agoAs long as they keep pushing we have a 80% chance that they haven't succeeded yet.
- chatmasta 1y agoWhat is a “UK user?” Someone with their App Store region set to the UK? (Meaning they have a UK payment method.) What about US citizens living in the UK? Would they have standing to sue Apple in a US court for breach of contract? I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent – by definition, won’t the user need to provide their secret key to decrypt their existing data? Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption?
- Infernal 1y ago> Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption? More likely that the phone just sends the keys to Apple in that case
- chatmasta 1y agoThe phone doesn’t have (all of) the keys. That’s the point. I had to save a passphrase somewhere out of band.
- Infernal 1y agoBut that passphrase you saved is an additional key, in case you lose all your Apple devices for example. You can tell it isn’t required for your phone to decrypt data because you don’t have to type it in to access your data, or even migrate to a new phone.
- rootnod3 1y agoAnd if they allow rescue contacts in case you lose the password and you can decrypt the data through their account, there is a chance they also keep a key for themselves, just in case. If you got sensitive data, learn to encrypt it yourself. That is the ONLY way to make sure. If you trust another company to do the encryption at rest for you, that is your own fault. edit: s/passport/password, damn my phone.
- pfexec 1y agoEveryone is so preoccupied with losing their minds every time Trump trolls the media with some new nonsense on the socials that they're ignoring the completely insane things going on in the UK right now. Like arresting people for using naughty language online. 20 years ago this would have been daily outrage on Slashdot's YRO section but I get the feeling no one cares enough anymore.
- basisword 1y agoThe reason this is a story again is because the reporting the last time was piss poor. The UK only agreed to drop the request for access to data for all users regardless of their nationality after pressure for the USG. They never said they were going to back down from the request for UK user data.
- wonderwonder 1y agoThe UK has gone full thought control. They have also gone full immigration. Going to be a very different place in 10 years.
- tim333 1y agoProbably Farage in 3 years and back the other way.
- paffdragon 1y agoSorry, I'm not an Apple user, so I'm not 100% sure if this is about forcing Apple to avoid/break E2E encryption (E2E in the true sense like Proton Mail) in the UK or to give them the keys they already can obtain themselves?
- deleted 1y ago[deleted]
- drnick1 1y agoFor all that matters, Apple may be already sharing "encrypted" data with governments and law enforcement. It's a locked down device running closed source software, and it's impossible to know what it really does behind the user's back.
- realusername 1y agoMay? We already know that they do it since Snowden.
- cdsghh 1y ago> It's a locked down device running closed source software, and it's impossible to know what it really does behind the user's back. That’s hardly true, analyzing binaries is not significantly more difficult without access to the source code. Even if you did have the source code, any serious analysis would focus on the binaries as seemingly innocuous code can be transformed into something else by a compiler. If we’re talking about some deep hardware level backdoors, you presumably don’t have your own fab and therefore are stuck with trusting whoever you get hardware from.
- neop1x 1y agoThe right to privacy is one of the basic human rights. How can they even think about restricting it? Why aren't there more protests already? Once it is fully implemented, there will be no way back and no more protests will be possible.