3 ms·

You mean aside from the NSA? https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM

by thefz 5mo ago

otterley 5mo ago
I don't see anything on the linked page that supports a conclusion that NSA has successfully broken the encryption at rest of an Apple device's storage since they introduced the secure element. Care to share a quote?
- ffsm8 5mo ago
  Prism targeted network communication to my knowledge, hence the data wouldn't be siphoned from at rest encrypted devices. Instead it would've been leaked before it was copied to that local encrypted device, whenever it was transmitted over the wire. Eg when your background task uploaded it to iCloud or similar.
  - dcrazy 5mo ago
    It’s worth remembering that since Snowden, much of iCloud is now end-to-end encrypted using keys that Apple cannot unwrap: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych...
    - ffsm8 5mo ago
      Fwiw, that's a clear statement - but only that. There is no way for us, the users, to know wherever they have the capability to add additional keys to decrypt the data because the platform isn't open source and doesn't have attestation wrt what's actually serving the requests. And it's worth remembering that apple had similar articles published before prism too which were ultimately proven to be groundless by prism.
      - otterley 5mo ago
        What, exactly, was proven to be groundless?
      - dcrazy 5mo ago
        The whole thing relies on hardware security modules, so even if you can prove that the whole software stack is working as described, there is literally no way to know that the SE isn’t secretly handing the OS keys that a third party can decrypt. There needs to be trust at some level, and trust in Apple the entity to not be outright lying about its thoroughly documented security posture is a reasonable level of trust for most people on the planet, including those who are at very real risk of targeted attack by state-level actors.

You mean aside from the NSA? https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM

by thefz 5mo ago

You mean aside from the NSA? https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM

I don't see anything on the linked page that supports a conclusion that NSA has successfully broken the encryption at rest of an Apple device's storage since they introduced the secure element. Care to share a quote?

ffsm8 5mo ago
Prism targeted network communication to my knowledge, hence the data wouldn't be siphoned from at rest encrypted devices. Instead it would've been leaked before it was copied to that local encrypted device, whenever it was transmitted over the wire. Eg when your background task uploaded it to iCloud or similar.
- dcrazy 5mo ago
  It’s worth remembering that since Snowden, much of iCloud is now end-to-end encrypted using keys that Apple cannot unwrap: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych...
  - ffsm8 5mo ago
    Fwiw, that's a clear statement - but only that. There is no way for us, the users, to know wherever they have the capability to add additional keys to decrypt the data because the platform isn't open source and doesn't have attestation wrt what's actually serving the requests. And it's worth remembering that apple had similar articles published before prism too which were ultimately proven to be groundless by prism.
    - otterley 5mo ago
      What, exactly, was proven to be groundless?
    - dcrazy 5mo ago
      The whole thing relies on hardware security modules, so even if you can prove that the whole software stack is working as described, there is literally no way to know that the SE isn’t secretly handing the OS keys that a third party can decrypt. There needs to be trust at some level, and trust in Apple the entity to not be outright lying about its thoroughly documented security posture is a reasonable level of trust for most people on the planet, including those who are at very real risk of targeted attack by state-level actors.