5 ms·

Is it safe to assume, then, that Google and Apple already have backdoors in their operating systems as likely requested by many governments around the world (no

by BLKNSLVR 11mo ago

Is it safe to assume, then, that Google and Apple already have backdoors in their operating systems as likely requested by many governments around the world (not least of which the one from their home country)? Or is GrapheneOS the only one built securely enough to need to be leaned upon? Either way, makes Google and Apple look bad and/or incompetent and GrapheneOS look like some kind of beacon of user protection / privacy rights / other things that are the opposite of the direction the world seems to be moving.

srmatto 11mo ago
Or that GrapheneOS is small enough to bully.
- fooqux 11mo ago
  The EU doesn't seem to shy about forcing Apple or Google to do things, so I don't think it's a size thing.
  - teaearlgraycold 11mo ago
    France isn’t the EU though.
    - fooqux 11mo ago
      True, but from what I understand France and Germany quite often get their way in the EU.
VWWHFSfQ 11mo ago
I seem to remember the FBI attempting to compel Apple to decrypt a criminal's iPhone, only for Apple to refuse and claim that it wasn't possible. I'm not sure exactly what happened after that. I think it was suspected that the NSA was able to do it by exploiting an unpatched zero-day. So they didn't need Apple's help anymore and the issue was dropped from the public's eye.
- mewse-hn 11mo ago
  https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
- wutwutwat 11mo ago
  That was show put on for the sole reason of the public seeing it.
  - mindslight 11mo ago
    I recall there being a little more substance to it at the time. But looking back from where we are now, that is a succinct way of describing its results.
  - Enginerrrd 11mo ago
    If you follow the things that have been disclosed / leaked/ confirmed when they’re 20+ years out of date, then yes the probability this is true is significant.
- zb3 11mo ago
  Cellebrite did the job using a vulnerability..
  - Bender 11mo ago
    That being JTAG debugging. Now there are greyhat groups discovering what they can do with it beyond bypassing the PIN at power-up. Honestly surprised phones are not being sold/marketed as having that disabled on both bluetooth and USB.
- pluralmonad 11mo ago
  I always assume these public performances are merely performances and that no one hears about the actual dirty work.
  - verisimi 11mo ago
estebank 11mo ago
Every time I travel internationally I immediately get notifications for Android OS updates. I'm pretty sure they are for satisfying local regulations about the phone's behavior, including the topic at hand.
- teaearlgraycold 11mo ago
  This has never happened on my iPhone
  - ortusdux 11mo ago
    They are just done in the background?
    - deleted 11mo ago
      [deleted]
  - hirako2000 11mo ago
    Apple charges a storage tax so why not ship all that data by default
    - gruez 11mo ago
      Every other OEM charges a "storage tax" too?
- sigmoid10 11mo ago
  Interesting. I have never seen anything like that in many years of frequent travelling while using Android. Which countries did you see this in? And are you using stock Android or some vendor's version?
  - estebank 11mo ago
    Stock android. Traveling between US, Europe, LATAM and China.
- 11mo ago
pengaru 11mo ago
Of course the likes of Apple and Google are complying with lawful orders from the governments of countries they do business in. Businesses that don't generally cease operating in said country. LavaBit was a highly visible instance of a business shuttering itself instead of complying with such lawful orders.
- sigmoid10 11mo ago
  That's also the ploy of basically every VPN provider out there. They say they don't store or give out data, but they still adhere to lawful requests. That necessarily includes requests from countries where they legally offer their service, even if their HQ is in some country with lax legal frameworks. It also means, if there is a legal way to coerce them into recording your data or handing it over, they will do so. https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit...
  - gruez 11mo ago
    They also mentioned they only respond to court orders (ie. not just because the cops asked nicely), will try to appeal as well. That's better than most ISPs, who would either give up data without a court order, or won't bother appealing.
    - sigmoid10 11mo ago
      The problem is that there may be perfectly legal gag orders (issued by a court) that force them to comply to normal police requests - and you would never even know. NordVPN in particular removed their warrant canary without informing their users and only gave some retroactive PR answer when people rightly started to freak out. The simple truth is that if a VPN provider hasn't been shut down by authorities after more than a year (like VPNLabs was), then they are basically guaranteed to be giving out your data to authorities at this point. The legal situation in most western countries does not allow complete online privacy for normal, law-abiding citizens.
SoftTalker 11mo ago
Yes, it's safe to assume that companies follow the law in countries where they operate.
- BLKNSLVR 11mo ago
  So we need GrapheneOS to stand their ground more than ever! My country has this: https://www.schneier.com/blog/archives/2024/09/australia-threatens-to-force-companies-to-break-encryption.html https://www.schneier.com/blog/archives/2024/09/australia-thr... Which kinda ruins it for everyone. Additionally, I would assume/guess that if it's some kind of coordinated campaign involving media then there is no law to compel GrapheneOS to do this. If they're was a law then that would be the pressure, as opposed to media articles. What that then implies is a campaign to convince the public a law is necessary, ie. they're already laying the ground work for support for the next version of a Chat Control bill.
GeekyBear 11mo ago
Apple has already taken the US government to court and forced them to back down after the FBI demanded that they insert a backdoor into iOS. > In 2015 and 2016, Apple Inc. received and objected to or challenged at least 11 orders issued by United States district courts under the All Writs Act of 1789. https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d... This year, Apple took the UK to court and announced that they would strip encryption features from UK users before they would give in to UK demands for an encryption back door before the UK backed down. If Graphene has the money to do so, they should fight it out in the courts.
- izacus 11mo ago
  There's a reason why they haven't had issues since then, not even with Trump. And it's not because they're hiding your data. See their disclosure report for data requests.
anonym29 11mo ago
Google and Apple were infamously official data providers[1] of the NSA's illegal and unconstitutional (as ruled by a federal judge[2]) warrant-less surveillance program (PRISM[3]) exposed by Edward Snowden. It's safe to assume that software provided by every large, publicly-traded, for-profit technology company incorporated in the USA cooperates extensively with US intelligence agencies, and therefore by extension, the "Five Eyes" alliance, at a minimum if not also the "Nine Eyes" and "Fourteen Eyes" alliances [4]. [1] Slide 6: https://www.eff.org/files/2013/11/21/20131022-monde-prism_april_2013.pdf https://www.eff.org/files/2013/11/21/20131022-monde-prism_ap... [2] https://www.reuters.com/business/media-telecom/us-court-mass-surveillance-program-exposed-by-snowden-was-illegal-2020-09-03/ https://www.reuters.com/business/media-telecom/us-court-mass... [3] https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM [4] https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
hamp95 11mo ago
It likely not due to any backdoors present, more so due to weak default setting plus alternate routes to the data. Things like backups being unencrypted either by default or when uploaded to the cloud. you don't need to ask for a backdoor if most users don't have encryption enabled.
rstuart4133 11mo ago
> Is it safe to assume, then, that Google and Apple already have backdoors in their operating systems as likely requested by many governments around the world I don't know whether it is safe to assume. But if they are complying with Australian law, specifically the Assistance and Access Bill (2018) [0], then they must write an undetectable backdoor for the Australia government if asked (that's the assistance the bill's name refers to), and push it any phone the government demands (that's the access bit). The only way to avoid this as far as I can tell is to run a free open source distribution. Unlike the paid systems such Windows and iPhone, the free distributions do not have the "billing relationship" their customers the proprietary companies are so fond of. It's that billing relationship that allows them to target only the devices owned by a specific individual. The Australian's must do that targeting because that law demands they don't introduce a systemic weakness into every phone. Any sort of backdoor is considered a systemic weakness. I dunno what laws other countries operate under, or how well they follow the laws they do have, but I'd be surprised if Australia wasn't following its own laws. That means if your device runs a true open source distro that doesn't track it's users, in Australia its truly your device. [0] https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/data-encryption https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...
- BLKNSLVR 11mo ago
  Viva FOSS!
- pabs3 11mo ago
  > if your device runs a true open source distro The situation with Android security updates means that such a distro is either not based on Android (and likely less useful), or there are months-long delays to security updates for the non-GPL components. Similarly, non-Google versions of Android can't run important apps that require attestation, including the Australian government app myGov. https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos https://grapheneos.org/articles/attestation-compatibility-gu...
0manrho 11mo ago
> Or is GrapheneOS the only one built securely enough to need to be leaned upon? Probably has something to do with it, but GrapheneOS doesn't have the money or resources that Google/Apple/etc has to lobby/bribe/delay/obfuscate/navigate/drawout/etc such attempts.

srmatto 11mo ago

Or that GrapheneOS is small enough to bully.

fooqux 11mo ago
The EU doesn't seem to shy about forcing Apple or Google to do things, so I don't think it's a size thing.
- teaearlgraycold 11mo ago
  France isn’t the EU though.
  - fooqux 11mo ago
    True, but from what I understand France and Germany quite often get their way in the EU.

VWWHFSfQ 11mo ago

I seem to remember the FBI attempting to compel Apple to decrypt a criminal's iPhone, only for Apple to refuse and claim that it wasn't possible. I'm not sure exactly what happened after that. I think it was suspected that the NSA was able to do it by exploiting an unpatched zero-day. So they didn't need Apple's help anymore and the issue was dropped from the public's eye.

mewse-hn 11mo ago
https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
wutwutwat 11mo ago
That was show put on for the sole reason of the public seeing it.
- mindslight 11mo ago
  I recall there being a little more substance to it at the time. But looking back from where we are now, that is a succinct way of describing its results.
- Enginerrrd 11mo ago
  If you follow the things that have been disclosed / leaked/ confirmed when they’re 20+ years out of date, then yes the probability this is true is significant.
zb3 11mo ago
Cellebrite did the job using a vulnerability..
- Bender 11mo ago
  That being JTAG debugging. Now there are greyhat groups discovering what they can do with it beyond bypassing the PIN at power-up. Honestly surprised phones are not being sold/marketed as having that disabled on both bluetooth and USB.
pluralmonad 11mo ago
I always assume these public performances are merely performances and that no one hears about the actual dirty work.
- verisimi 11mo ago

estebank 11mo ago

Every time I travel internationally I immediately get notifications for Android OS updates. I'm pretty sure they are for satisfying local regulations about the phone's behavior, including the topic at hand.

teaearlgraycold 11mo ago
This has never happened on my iPhone
- ortusdux 11mo ago
  They are just done in the background?
  - deleted 11mo ago
    [deleted]
- hirako2000 11mo ago
  Apple charges a storage tax so why not ship all that data by default
  - gruez 11mo ago
    Every other OEM charges a "storage tax" too?
sigmoid10 11mo ago
Interesting. I have never seen anything like that in many years of frequent travelling while using Android. Which countries did you see this in? And are you using stock Android or some vendor's version?
- estebank 11mo ago
  Stock android. Traveling between US, Europe, LATAM and China.
11mo ago

pengaru 11mo ago

Of course the likes of Apple and Google are complying with lawful orders from the governments of countries they do business in. Businesses that don't generally cease operating in said country. LavaBit was a highly visible instance of a business shuttering itself instead of complying with such lawful orders.

sigmoid10 11mo ago
That's also the ploy of basically every VPN provider out there. They say they don't store or give out data, but they still adhere to lawful requests. That necessarily includes requests from countries where they legally offer their service, even if their HQ is in some country with lax legal frameworks. It also means, if there is a legal way to coerce them into recording your data or handing it over, they will do so. https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit...
- gruez 11mo ago
  They also mentioned they only respond to court orders (ie. not just because the cops asked nicely), will try to appeal as well. That's better than most ISPs, who would either give up data without a court order, or won't bother appealing.
  - sigmoid10 11mo ago
    The problem is that there may be perfectly legal gag orders (issued by a court) that force them to comply to normal police requests - and you would never even know. NordVPN in particular removed their warrant canary without informing their users and only gave some retroactive PR answer when people rightly started to freak out. The simple truth is that if a VPN provider hasn't been shut down by authorities after more than a year (like VPNLabs was), then they are basically guaranteed to be giving out your data to authorities at this point. The legal situation in most western countries does not allow complete online privacy for normal, law-abiding citizens.

SoftTalker 11mo ago

Yes, it's safe to assume that companies follow the law in countries where they operate.

BLKNSLVR 11mo ago
So we need GrapheneOS to stand their ground more than ever! My country has this: https://www.schneier.com/blog/archives/2024/09/australia-threatens-to-force-companies-to-break-encryption.html https://www.schneier.com/blog/archives/2024/09/australia-thr... Which kinda ruins it for everyone. Additionally, I would assume/guess that if it's some kind of coordinated campaign involving media then there is no law to compel GrapheneOS to do this. If they're was a law then that would be the pressure, as opposed to media articles. What that then implies is a campaign to convince the public a law is necessary, ie. they're already laying the ground work for support for the next version of a Chat Control bill.

GeekyBear 11mo ago

Apple has already taken the US government to court and forced them to back down after the FBI demanded that they insert a backdoor into iOS. > In 2015 and 2016, Apple Inc. received and objected to or challenged at least 11 orders issued by United States district courts under the All Writs Act of 1789. https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d... This year, Apple took the UK to court and announced that they would strip encryption features from UK users before they would give in to UK demands for an encryption back door before the UK backed down. If Graphene has the money to do so, they should fight it out in the courts.

izacus 11mo ago
There's a reason why they haven't had issues since then, not even with Trump. And it's not because they're hiding your data. See their disclosure report for data requests.

anonym29 11mo ago

Google and Apple were infamously official data providers[1] of the NSA's illegal and unconstitutional (as ruled by a federal judge[2]) warrant-less surveillance program (PRISM[3]) exposed by Edward Snowden. It's safe to assume that software provided by every large, publicly-traded, for-profit technology company incorporated in the USA cooperates extensively with US intelligence agencies, and therefore by extension, the "Five Eyes" alliance, at a minimum if not also the "Nine Eyes" and "Fourteen Eyes" alliances [4]. [1] Slide 6: https://www.eff.org/files/2013/11/21/20131022-monde-prism_april_2013.pdf https://www.eff.org/files/2013/11/21/20131022-monde-prism_ap... [2] https://www.reuters.com/business/media-telecom/us-court-mass-surveillance-program-exposed-by-snowden-was-illegal-2020-09-03/ https://www.reuters.com/business/media-telecom/us-court-mass... [3] https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM [4] https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes

hamp95 11mo ago

It likely not due to any backdoors present, more so due to weak default setting plus alternate routes to the data. Things like backups being unencrypted either by default or when uploaded to the cloud. you don't need to ask for a backdoor if most users don't have encryption enabled.

rstuart4133 11mo ago

> Is it safe to assume, then, that Google and Apple already have backdoors in their operating systems as likely requested by many governments around the world I don't know whether it is safe to assume. But if they are complying with Australian law, specifically the Assistance and Access Bill (2018) [0], then they must write an undetectable backdoor for the Australia government if asked (that's the assistance the bill's name refers to), and push it any phone the government demands (that's the access bit). The only way to avoid this as far as I can tell is to run a free open source distribution. Unlike the paid systems such Windows and iPhone, the free distributions do not have the "billing relationship" their customers the proprietary companies are so fond of. It's that billing relationship that allows them to target only the devices owned by a specific individual. The Australian's must do that targeting because that law demands they don't introduce a systemic weakness into every phone. Any sort of backdoor is considered a systemic weakness. I dunno what laws other countries operate under, or how well they follow the laws they do have, but I'd be surprised if Australia wasn't following its own laws. That means if your device runs a true open source distro that doesn't track it's users, in Australia its truly your device. [0] https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/data-encryption https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...

BLKNSLVR 11mo ago
Viva FOSS!
pabs3 11mo ago
> if your device runs a true open source distro The situation with Android security updates means that such a distro is either not based on Android (and likely less useful), or there are months-long delays to security updates for the non-GPL components. Similarly, non-Google versions of Android can't run important apps that require attestation, including the Australian government app myGov. https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos https://grapheneos.org/articles/attestation-compatibility-gu...

0manrho 11mo ago

> Or is GrapheneOS the only one built securely enough to need to be leaned upon? Probably has something to do with it, but GrapheneOS doesn't have the money or resources that Google/Apple/etc has to lobby/bribe/delay/obfuscate/navigate/drawout/etc such attempts.