3 ms·

What is your proof they don't have a duplicate key that also unlocks it? A firm handshake from Tim?

otterley 9mo ago
If they say they don't, and they do, then that's fraud, and they could be held liable for any damages that result. And, if word got out that they were defrauding customers, that would result in serious reputational damage to Apple (who uses their security practices as an industry differentiator) and possibly a significant customer shift away from them. They don't want that.
- tokyobreakfast 9mo ago
  Absent the source code, it's incredibly difficult to disprove when the only proof you have is good vibes.
  - otterley 9mo ago
    There are many things you can't prove or disprove in this world. That's where trust and reputation comes in - to fill the uncertainty gap.
    - fsflover 9mo ago
      You mean, trust and reputation of Apple? They're not exactly high: https://news.ycombinator.com/item?id=46252114 https://news.ycombinator.com/item?id=46252114 https://news.ycombinator.com/item?id=45520407 https://news.ycombinator.com/item?id=45520407 https://news.ycombinator.com/item?id=42014588 https://news.ycombinator.com/item?id=42014588 https://news.ycombinator.com/item?id=26644216 https://news.ycombinator.com/item?id=26644216
      - otterley 9mo ago
        At the end of the day, it's all about how you weigh the evidence. If those examples are sufficient to tip the scales for you, that's your choice. However, Apple's overall trustworthiness--particular when it comes to protecting people's sensitive data--remains high for in the market. Even the examples you posted aren't especially pertinent to that (except for iCloud Keychain, where the complaint isn't whether Apple is securely storing it, but the fact that it got transmitted to them in the first place, and there exists some unresolved ambiguity about whether it is appropriately deleted on demand).
      - ezfe 9mo ago
        None of these really match the scenario we're discussing here. Some are typical big company stuff, some are technical edge cases, but none are "Apple lies about a fundamental security practice consistently and with malice"
        PlatoIsADisease 9mo ago
        Cognitive Dissonance. You already made up your mind, no evidence will change it. Any evidence you get is cast aside for one reason or another.
        fsflover 9mo ago
        > "Apple lies about a fundamental security practice consistently and with malice" Uploading passwords to the cloud should count. Also this: https://sneak.berlin/20231005/apple-operating-system-surveillance/ https://sneak.berlin/20231005/apple-operating-system-surveil...
        otterley 9mo ago
        That link you provided is a "conspiracy theory," even by the author's own admission. That article is also outdated; OCSP is as dead as a doornail (no doubt in part because it could be used for surveillance) and they fixed the cleartext transmission of hardware identifiers. Are you expecting perfection here? Or are you just being argumentative?
        fsflover 9mo ago
        > That link you provided is a "conspiracy theory," even by the author's own admission. "Conspiracy theory" is not the same as a crazy, crackhead theory. See: Endward Snowden. Full quote from the article: > Mind you, this is definitionally a conspiracy theory; please don’t let the connotations of that phrase bias you, but please feel free to read this (and everything else on the internet) as critically as you wish. > and they fixed the cleartext transmission of hardware identifiers Have you got any links for that? > Are you expecting perfection here? Or are you just being argumentative? I expect basic things people should expect from a company promoting themselves as respecting privacy. And I don't expect them to be much worse than GNU/Linux in that respect (but they definitely are).
- direwolf20 9mo ago
  The government would never prosecute a company for fraud where that fraud consists of cooperating with the government after promising to a suspected criminal that they wouldn't.
  - otterley 9mo ago
    That's not the scenario I was thinking of. There are other possibilities here, like providing a decryption key (even if by accident) to a criminal who's stolen a business's laptop, or if a business had made contractual promises to their customers, based on Apple's promises to them. The actions would be private (civil) ones, not criminal fraud prosecution. Besides, Apple's lawyers aren't stupid enough to forget to carve out a law-enforcement demand exception.
- PlatoIsADisease 9mo ago
  Apple has the number 1 marketing team in the world. They got away with PRISM and terrible security. They are immune to reputation damage. Teens and moms don't care.
  - otterley 9mo ago
    Terrible security... compared to what? Some ideal state that exists in your head, or a real-world benchmark? Do you expect them to ignore lawful orders from governments as well?
- codedokode 9mo ago
  Cooperating with law enforcement cannot be a fraud. Fraud is lying to get illegal gains. I think, it's legally ok to lie if the goal is to catch a criminal and help the government. For example, in 20th century, an European manufacturer of encryption machines (Crypto AG [1]) made a backdoor at request of governments and never got punished - instead it got generous payments. [1] https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
eddyg 9mo ago
You should watch the whole BlackHat talk (from 2016!) from Apple's Head of Security Engineering and Architecture, but especially this part: https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s
- PlatoIsADisease 9mo ago
  Lot of trust in the words that cannot be verified.

If they say they don't, and they do, then that's fraud, and they could be held liable for any damages that result. And, if word got out that they were defrauding customers, that would result in serious reputational damage to Apple (who uses their security practices as an industry differentiator) and possibly a significant customer shift away from them. They don't want that.

tokyobreakfast 9mo ago
Absent the source code, it's incredibly difficult to disprove when the only proof you have is good vibes.
- otterley 9mo ago
  There are many things you can't prove or disprove in this world. That's where trust and reputation comes in - to fill the uncertainty gap.
  - fsflover 9mo ago
    You mean, trust and reputation of Apple? They're not exactly high: https://news.ycombinator.com/item?id=46252114 https://news.ycombinator.com/item?id=46252114 https://news.ycombinator.com/item?id=45520407 https://news.ycombinator.com/item?id=45520407 https://news.ycombinator.com/item?id=42014588 https://news.ycombinator.com/item?id=42014588 https://news.ycombinator.com/item?id=26644216 https://news.ycombinator.com/item?id=26644216
    - otterley 9mo ago
      At the end of the day, it's all about how you weigh the evidence. If those examples are sufficient to tip the scales for you, that's your choice. However, Apple's overall trustworthiness--particular when it comes to protecting people's sensitive data--remains high for in the market. Even the examples you posted aren't especially pertinent to that (except for iCloud Keychain, where the complaint isn't whether Apple is securely storing it, but the fact that it got transmitted to them in the first place, and there exists some unresolved ambiguity about whether it is appropriately deleted on demand).
    - ezfe 9mo ago
      None of these really match the scenario we're discussing here. Some are typical big company stuff, some are technical edge cases, but none are "Apple lies about a fundamental security practice consistently and with malice"
      - PlatoIsADisease 9mo ago
        Cognitive Dissonance. You already made up your mind, no evidence will change it. Any evidence you get is cast aside for one reason or another.
      - fsflover 9mo ago
        > "Apple lies about a fundamental security practice consistently and with malice" Uploading passwords to the cloud should count. Also this: https://sneak.berlin/20231005/apple-operating-system-surveillance/ https://sneak.berlin/20231005/apple-operating-system-surveil...
        otterley 9mo ago
        That link you provided is a "conspiracy theory," even by the author's own admission. That article is also outdated; OCSP is as dead as a doornail (no doubt in part because it could be used for surveillance) and they fixed the cleartext transmission of hardware identifiers. Are you expecting perfection here? Or are you just being argumentative?
        fsflover 9mo ago
        > That link you provided is a "conspiracy theory," even by the author's own admission. "Conspiracy theory" is not the same as a crazy, crackhead theory. See: Endward Snowden. Full quote from the article: > Mind you, this is definitionally a conspiracy theory; please don’t let the connotations of that phrase bias you, but please feel free to read this (and everything else on the internet) as critically as you wish. > and they fixed the cleartext transmission of hardware identifiers Have you got any links for that? > Are you expecting perfection here? Or are you just being argumentative? I expect basic things people should expect from a company promoting themselves as respecting privacy. And I don't expect them to be much worse than GNU/Linux in that respect (but they definitely are).
direwolf20 9mo ago
The government would never prosecute a company for fraud where that fraud consists of cooperating with the government after promising to a suspected criminal that they wouldn't.
- otterley 9mo ago
  That's not the scenario I was thinking of. There are other possibilities here, like providing a decryption key (even if by accident) to a criminal who's stolen a business's laptop, or if a business had made contractual promises to their customers, based on Apple's promises to them. The actions would be private (civil) ones, not criminal fraud prosecution. Besides, Apple's lawyers aren't stupid enough to forget to carve out a law-enforcement demand exception.
PlatoIsADisease 9mo ago
Apple has the number 1 marketing team in the world. They got away with PRISM and terrible security. They are immune to reputation damage. Teens and moms don't care.
- otterley 9mo ago
  Terrible security... compared to what? Some ideal state that exists in your head, or a real-world benchmark? Do you expect them to ignore lawful orders from governments as well?
codedokode 9mo ago
Cooperating with law enforcement cannot be a fraud. Fraud is lying to get illegal gains. I think, it's legally ok to lie if the goal is to catch a criminal and help the government. For example, in 20th century, an European manufacturer of encryption machines (Crypto AG [1]) made a backdoor at request of governments and never got punished - instead it got generous payments. [1] https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG

eddyg 9mo ago

You should watch the whole BlackHat talk (from 2016!) from Apple's Head of Security Engineering and Architecture, but especially this part: https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s

PlatoIsADisease 9mo ago
Lot of trust in the words that cannot be verified.