6 ms·
From the article: > Otherwise, please make sure you de-Apple, de-Google, and de-American Stack yourself when you have time, clarity, and focus to do it. Start
by thw_9a83c 11mo ago
From the article:
> Otherwise, please make sure you de-Apple, de-Google, and de-American Stack yourself when you have time, clarity, and focus to do it. Start today.
I don't understand the core of this advice. So if you're in the UK and do all the above, can you suddenly get similar E2EE cloud storage from a different provider without a UK government-mandated backdoor?
- benoau 11mo agoHopefully pretty soon Apple will have to provide the same functionality iCloud monopolizes so you can have an equivalent service. But right now you can do an encrypted transmission to a privately-owned NAS like Synology and then E2E cloud storage provider of your choice, with the caveat that things like background syncing are strategically monopolized and no app may backup your full phone. https://www.catribunal.org.uk/cases/16897724-consumers-association-which https://www.catribunal.org.uk/cases/16897724-consumers-assoc... (hearing in 9 days)
- nine_k 11mo agoIt's a bit like the famous HN post where somebody said that Dropbox is not needed if you have rsync and friends. Technically this can even be correct. You can build and operate a good, secure solution for yourself if you have time and skill to build. Could make sense for a company handling sensitive data. Would hardly make sense for most individuals who are not professional SREs / SWEs. (To check how it feels, an engineer can try to sew themself a pair of pants to wear daily, or do something similarly mundane in what they are not skilled.) A solution that can reliably work for non-experts is very important.
- benoau 11mo agoSure but in this case most of the difficulties are artificially imposed by Apple, depending on how the tribunal responds to their alleged iCloud monopoly it could become as simple as choosing a compatible provider and putting your username/password in.
- smsm42 11mo agoAnd as soon as you have "a provider" as a business entity, UK government can ban them from providing E2EE solutions to Apple users the same way they did ban Apple. Or the provider would just silently bend over hand hand all the keys to the UK govt.
- benoau 11mo agoThey can't police every online server you can possibly rent, and they can't police them "all at once" like they can with the Google/Apple duopoly, all they can do is go after them one-by-one as they need access and as we see with 4chan, rejecting their assertions on jurisdiction is certainly an option.
- smsm42 11mo agoThey can't. But they can police any service that has substantial number of users. And that's what most of the people would use. So, the hardened criminals would use their own underground darknet services which the government couldn't breach, but the regular people would have no privacy at all. > 4chan, rejecting their assertions on jurisdiction is certainly an option. 4chan can tell UK regulators to take hike because 4chan has no business presence in the UK. Any service that does want to serve UK users and is successful in doing so, will eventually find itself in UK regulators' crosshairs. For services that are based outside UK, they'd just stop serving UK users because that's the easiest way to handle it. Which is completely fine with UK regulators, in fact, that's exactly what they want - so that nobody would be able to provide privacy to UK subjects.
- thenthenthen 11mo agoI have done all this. All inhad to do was provide my passport scans, fingerprints, photos of my face, phone number so now I can use tencent cloud in china! /s
- caconym_ 11mo agoE2EE cloud storage is not some kind of magic that only tech bigcorps can provide. I de-Dropboxed a few years ago, replacing it with Syncthing running on a local NAS with e2ee backups in Backblaze and Wireguard VPN out to my mobile devices. Sure, this is not the sort of thing most people can set up for themselves, but I don't think that's particularly relevant in context.
- aucisson_masque 11mo agoSyncthing and e2e is great but the issue is that the law force you to give away your phone and your password if asked. Meaning, they have the encrypted data on your phone and the password to unlock it.. same for computer ofc. If you're in England and have to keep things secured (including from government eyes), i have no idea how you can do. They soon will be allowed to put a camera in your small room and watch you take a dump.
- sayamqazi 11mo agoMemorize a long passphrase for encryption, dont keep it anywhere and when forced to give it up, say "I forgot it". This is partly a joke but only partly.
- mavhc 11mo agoMemorize two passwords and have a hidden volume with the real data in
- hellojesus 11mo agoAnd have a wipe-password that deletes phone data, etc. when entered.
- erpellan 11mo agoUnfortunately for the vast majority of people, it absolutely is some kind of magic.
- disambiguation 11mo ago# Encrypt a file openssl enc -aes-256-cbc -salt -in secret.txt -out secret.enc # Decrypt openssl enc -d -aes-256-cbc -in secret.enc -out secret.txt Wow that was hard.
- prophesi 11mo agoI'm reminded of the infamous HN Dropbox comment.
- runjake 11mo agoReference: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224
- deleted 11mo ago[deleted]
- deleted 11mo ago[deleted]
- radlad 11mo agoYeesh, this seems like a good example of the fact that a feature (encrypting a file) is not a product (an E2E encrypted storage solution.)
- exe34 11mo agoRe: rubber hose attack on cryptography.
- Zak 11mo agoThreat modeling is important of course. The UK government does have tools with which to punish people who don't turn over the cleartext of targeted documents once it's directly investigating them, but that's not scalable. The method the grandparent comment proposes greatly reduces one's exposure to mass surveillance, criminals, and abusive service providers.
- smsm42 11mo ago
- cmsj 11mo agoYes, but you'll have to trust that they haven't been issued a secret government order to implement a backdoor. Not all of those companies will loudly object in the way Apple does.
- b00ty4breakfast 11mo ago>Not all of those companies will loudly object in the way Apple does. This assumes that Apple has loudly objected to every government request for backdoor access and also that they have never acquiesced to any of those requests.
- curt15 11mo agoHas Apple loudly objected to the CCP's requests?
- lawlessone 11mo ago>when you have time, clarity, and focus to do it. i thought this a joke, lol
- kakacik 11mo agoOn personal level, you have to choose whether your priority is privacy or convenience. If its privacy, no whining about 'I want this and that and I am too lazy to rollback' is relevant. Never trust US services, 3-letter agencies are endlessly greedy to fill your profile with another tens of thousands of data points. As do all advertisers all around the globe. As do (with various success) all other governments and private companies who have something to gain, HDD storage has never been cheaper and all personal data are worth gold and beyond. Or if you have to use them, use your own encryption with strength to not be broken for next few hundreds of years, to stand a chance. That is, if you actually have something to hide, but I have never met a person who really doesn't :)
- isodev 11mo agoBecause no US corp can promise you true E2EE. Even an app like Signal - are you sure the version you're getting from the App Store is always the one with "unbreakable E2EE"?
- bink 11mo agoWith Signal they provide a toolkit you can use to verify that the checksum for your App Store download matches that of the public build or one that you compile yourself. edit: This is apparently currently not working for Apple and MS builds. https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md https://github.com/signalapp/Signal-Desktop/blob/main/reprod...
- alfiedotwtf 11mo agoWhy compromise Signal when Apple is an American company
- InTheArena 11mo agoThe first two are reasonable positions. The third, on the merits of the argument in the article, is absolutely bonkers. It's the UK government that is unleashing this stupidity on the world. There is no European alternative that is any safer, and it's the UK's own hands that are at fault in the first place. Not that there aren't other reasons to be skeptical of American companies' right, but it's just so easy to fall into nationalistic prattle instead of fixing the real problem.
- thewebguyd 11mo ago> but it's just so easy to fall into nationalistic prattle instead of fixing the real problem. Right. This, right now, is 100% a UK problem. De-Americanising your tech stack isn't going to fix the political issues domestically. Hence Apple pulling ADP out, they made the choice of not complying with the UK and not offering the service instead of compromising the service for everyone else in the world. UK citizens need to direct their attention inwards against their own government.
- denkmoon 11mo agoOh yes, the UK is very keen on Reform. Reform in this case however is the death rattle of a long dead empire.
- rounce 11mo ago“Death rattle”? More like “zombie groan”.
- ungreased0675 11mo agoLast time I was in the UK, the news (BBC) was bizarrely 90% American politics. Trump this, Trump did that, etc. People there knew American politicians better than the people who actually represent them.
- 978689757846 11mo ago[flagged]
- dpoloncsak 11mo agoI'm sort of out of the loop as a US citizen....Does the UK really have the ability to enforce every E2EE storage solution on GitHub to comply? Even if you monitor downloads, every VPN, every ISP..... can't I copy paste the source code? Isn't SFTP already E2EE? They're not going to come down on SFTP....right? I really hope not...
- mmh0000 11mo agoThe simple answer is: Money. If you're making money in the UK, they have a lot of legal authority over you. If you're based in the UK, they have a lot of legal authority over you. If you're neither of those things, they might complain, but the actual consequences are close to nil. And they're not banning the tools (this is arguable, but they "can't" logically, as you point out). They're banning businesses from providing the tools.
- dpoloncsak 11mo agoThats reassuring...but still frightening, just less so I guess. Most of my homelab is self-hosted (Cloudflare and Tailscale stop me short of saying it's 100%, plus an Oracle VPS for a Minecraft server if you count the WHOLE stack I guess)...and you tell yourself its 'better to own your own data' or whatever your personal mantra is, but it's bizarre to see this play out
- jackjeff 11mo agoThe UK (same as the US) has lots of extra territorial laws. Enforcing them is another matter. It’s easy to make Apple budge because they have money ties to the Uk. This works less well for unsavory websites not complying with UK law. See https://prestonbyrne.com/2025/10/16/the-ofcom-files/ https://prestonbyrne.com/2025/10/16/the-ofcom-files/
- bob1029 11mo agoMy new high-privacy, high-control data management solution revolves around pen & paper. As far as I am aware, these implements have not yet been banned in the UK. I don't know why everything must be digital. If you don't put it on a computer, it's almost as if it doesn't exist. If you do this often enough, it is almost as if you don't exist.
- alfiedotwtf 11mo agoParty members were supposed not to go into ordinary shops ('dealing on the free market', it was called), but the rule was not strictly kept, because there were various things, such as shoelaces and razor blades, which it was impossible to get hold of in any other way. He had given a quick glance up and down the street and then had slipped inside and bought the book for two dollars fifty. At the time he was not conscious of wanting it for any particular purpose. He had carried it guiltily home in his briefcase. Even with nothing written in it, it was a compromising possession. The thing that he was about to do was to open a diary. This was not illegal (nothing was illegal, since there were no longer any laws), but if detected it was reasonably certain that it would be punished by death, or at least by twenty-five years in a forced-labour camp. Winston fitted a nib into the penholder and sucked it to get the grease off. The pen was an archaic instrument, seldom used even for signatures, and he had procured one, furtively and with some difficulty, simply because of a feeling that the beautiful creamy paper deserved to be written on with a real nib instead of being scratched with an ink-pencil. Actually he was not used to writing by hand. Apart from very short notes, it was usual to dictate everything into the speak-write which was of course impossible for his present purpose. He dipped the pen into the ink and then faltered for just a second. A tremor had gone through his bowels. To mark the paper was the decisive act. In small clumsy letters he wrote: April 4th, 1984.
- mbirth 11mo agoIn the latest Janus Cycle video he explained how he started carrying an IBM WorkPad c3 around to manage his contacts and appointments. I found that a great idea for people like me that struggle with deciphering their handwriting an hour later.
- 11mo ago
- smsm42 11mo agoIt's not a backdoor per se. UK just banned using E2EE (at least for Apple users' data). I don't think though they can ban E2EE in general - like, if I upload a binary blob to a data store, how would they know whether it's encrypted or not? Short of banning all strong encryption completely (which even UK yet is not stupid enough to do) it's not possible to prevent. But they did not build a "backdoor" into encryption - they demanded that, and Apple refused, so there's now no encryption at all for UK users. There's no door. They are just going for service providers that make E2EE easy for users - clearly betting on the fact that people they want to surveil would be too lazy/incompetent to use a custom solution providing strong E2EE encryption. And they may be right - most iphone users would keep using the same services even with the knowledge that the data is now widely open - and eventually of course will be breached and available to every kind of criminal, as it happened many times already with other massive data warehouses. But I believe even is the UK you still can encrypt your own backup and upload it, e.g., to rsync.net and nobody would be able to stop you. Just most people won't.
- egorfine 11mo ago> banning all strong encryption completely (which even UK yet is not stupid enough to do) What we have in effect today (ban of E2EE, chat control) was laughably impossible to conceive just five years ago. ttyl
- smsm42 11mo agoThat's why I used "yet". It looks like things that were the domain of wild tinfoil hat theories a decade ago now are routine policies.
- deleted 11mo ago[deleted]
- EA-3167 11mo agoIt seems like the real solution is de-UK'ing, a wise move for a number of reasons. Move to the continent, to Ireland, or the US (or Australia for that classic British expat experience), but leave the sinking ship. Ideally the time to leave was when the passport was still in the EU, but now is better than never.
- deleted 11mo ago[deleted]
- celsoazevedo 11mo agoProbably easy to do with a Mac, but iOS is a different question. Way too restrictive if you don't use iCloud.
- alistairSH 11mo agoOf the major consumer tech companies, isn't Apple still the leader in terms of privacy? (yes, that's a low bar) And, it's just ADP being affected by the UK mandates? What % of users bother enabling ADP? I probably should, but haven't bothered (am I being foolish?).
- tedd4u 11mo agoI guess it depends on the individual’s threat model. If government is the primary concern and they are a UK person, then maybe not. If it’s their employer or random hacker then maybe so.