4 ms·

I understand Apple's position on this one. This is essentially a backdoor into all of your data. It is also a very useful feature. The EU regulators are disallo

I understand Apple's position on this one. This is essentially a backdoor into all of your data. It is also a very useful feature. The EU regulators are disallowing guardrails without which this backdoor will be used to strip-mine people's personal data. The privacy implications are not legible to most people. If I was more cynical I would suggest that this is being used as an end-run around encryption, since the encryption doesn't have backdoors for the government but this gives you access to all the same data. When this backdoor is inevitably exploited in some very public fashion, it won't be the EU regulators that required the backdoor to exist who will be blamed.

flumpcakes 4mo ago
iPhones have pretty good privacy controls. I don’t see how they can’t extend those to cover AI apps. I imagine the settings menu will get bonkers though. User education about apps slurping up all your data is needed regardless. People just trust apple with their talk of private cloud computing.
- wmf 4mo ago
  It would either lead to Vista-style constant UAC prompts or having to give blanket access upfront (which would be abused).
simjnd 4mo ago
It would only be a backdoor if it's implemented as a backdoor. The way Apple Health exchanges data with 3rd-party trackers (Fitbit, Garmin, etc.) is very well built and a good model of how other components in iOS could allow data exchange with very granular permissions. Apple touts the "Private Cloud Compute". If they found a way to share your personal context to process on their cloud in a private and anonymized way, there is no reason the same process couldn't be used to handoff data to a 3rd party AI provider.
- jandrewrogers 4mo ago
  The technical problem is nothing like exchanging data with fitness trackers. One of the issues here is that there are many people with strong opinions that don't understand the thing they have strong opinions about. Which is the normal state of human affairs.
  - simjnd 4mo ago
    Indeed but you ignore my second paragraph: they have developed (and 3rd-party audited) a way to handoff all the data (parts of your Personal Context, etc.) to their cloud servers in a privacy preserving way on-device. Why couldn't the same process could be used to handoff the data to a 3rd-party AI provider? (genuine why, if you have an understanding of the thing you have a strong opinion about I'd genuinely appreciate the answer) It looks like Apple is framing this as a privacy issue as a marketing tactic so that consumers will blame the EU when Apple COULD implement it without endangering privacy.
    - JumpCrisscross 4mo ago
      > Why couldn't the same process could be used to handoff the data to a 3rd-party AI provider? You have more safeguards if it’s running on your own metal. It’s reasonable to want to understand that better, perhaps with your own red team, before opening up customer data to actual potential hostiles.
      - simjnd 4mo ago
        Yeah I overestimated the amount of stripping / anonymization that was being done on device and didn't realize how much plumbing was required server-side too to have good enough privacy guarantees
    - theshrike79 4mo ago
      Apple PCC is using completely mad and paranoid amounts of security down to hardware and firmware level making sure nobody at any point of the supply chain can access the data. EU can’t and won’t enforce the same rigour for 3rd party cloud AI. Which is the problem for Apple. If said 3rd party service leaks private data, guess which company is going to be in the BIG HEADLINE and which one will hardly be mentioned in the news?
- Petersipoi 4mo ago
  What? You want Apple to anonymize a users data, then hand that users data to a third party who knows who the user is? I don't think PCC is doing what you think it's doing.
- mike_d 4mo ago
  > It would only be a backdoor if it's implemented as a backdoor. You don't seem to know how backdoors work. Oppressive regimes mandate that tech companies pre-install apps to protect people from spam calls, or install specific root certificates so they can intercept your traffic and insert a helpful banner into your browsing session to remind you when to pray. The EU isn't going to ask Apple to add DataCollectionBackdoor(). They are going to demand that in the spirit of freedom and happiness EU companies must have access to Apple users private data.
andix 4mo ago
> This is essentially a backdoor into all of your data. No. Only if you would consider the Linux/macos/windows filesystem API a backdoor too. On your desktop any app with sufficient permissions can read all your data. Would you call that a backdoor?
- deleted 4mo ago
  [deleted]
iAMkenough 4mo ago
Why do you use the phrase backdoor? Is Apple incapable of designing a permissions system that allows a user to grant access to email and messages to an app of their choice? We already download apps and grant them permissions to subsections of personal data on our devices. I don’t believe Apple is incapable of designing a system that respects a user’s choices and granted permissions.
flaunf221 4mo ago
> This is essentially a backdoor into all of your data. This is the rhetoric used against right to repair. "What if enemies get access to our citizens' data if we allow anyone but us to repair your car?"
- superxpro12 4mo ago
  The hypocrisy is easily explained by the overall attack on ownership... you dont own your own data. you dont own your car, your phone, your pc. Everyone wants to own all your stuff...
- HappyPanacea 4mo ago
  I have never seen this argument against (admittedly I'm not big into such debates) right to repair, did it came up somewhere?
  - shimman 4mo ago
    Yes, it's what the opposition literally does. Go read some press pieces from these neoliberal moderates: https://www.progressivepolicy.org/weighing-the-risks-of-right-to-repair-for-consumer-tech-products/ https://www.progressivepolicy.org/weighing-the-risks-of-righ...
t-sauer 4mo ago
> I understand Apple's position on this one Well then explain me this: There are absolutely no restriction on MacOS where I can give Claude free access to everything. If you are a Mac and iPhone user that essentially gives it access to the exact same data. Why is the data only protect worthy when accessed on the phone directly?
- xlii 4mo ago
  There's SIP. Claude can't install kernel extension and you can. (... and it just hit me why Apple requires specific reboot procedure to disable it)
  - iAMkenough 4mo ago
    SIP doesn’t protect user data, and I’m not sure why a Siri AI alternative would need kernel access.
- hyperpape 4mo ago
  The Mac is a pre-existing platform that is both more capable than iOS, and had an existing user base that used apps that had much greater access. Apple’s attempts to lock down the Mac have met with poor adoption. In exchange, it also less secure, less user friendly, and less popular.
- Gigachad 4mo ago
  Laptops are a low security environment and already massively compromised. Thats why banks make you authorise transactions by approving them on your phone when you started them on the web. Apple has been working for a while to secure MacOS but it’s hard without breaking compatibility with old processes.
- throwaway329847 4mo ago
  There is no one-click way to install an AI model on macOS like potentially iOS could have. I can easily imagine some grandma install on their iPhone some random AI model they saw in an AI-generated Facebook post with just one tap.
InsideOutSanta 4mo ago
How is it a backdoor if I, as my data's actual owner, intentionally provide access to my data?
yxhuvud 4mo ago
It is not prohibiting guard rails. It is prohibiting Siri getting preferred treatment to bypass said guard rails
aucisson_masque 4mo ago
We have been able to choose our default app for 'assistant' on Android for a decade. It's fine. You can even revoke permissions if you want to. And guess what ? Because you're allowed to choose something else than Siri, it doesn't mean you have to. You can still use Siri if you think it's better for your privacy.
- Gigachad 4mo ago
  What level of system access do they have? You can use 3rd party AI apps on iOS, they just can’t read app data or make actions on the system outside of the APIs that currently exist. The new Siri has much deeper access to personal data and absolutely can not be trusted being siphoned off to a 3rd party server.
  - aucisson_masque 4mo ago
    It's never been what the eu asks for. They want people to be able to set a different assistant than Siri, and that this assistant can have deep access (as much as Siri) if the users wants it.
jwitthuhn 4mo ago
It is not a backdoor if I authorize some other app to use that data, it is a front door. Apple thinks users should not be able to make the decision about who can access their data. It is not more complicated that that.
- Gigachad 4mo ago
  It’s a back door around normal app sandboxing and permissions systems. The security design of iOS was not meant to allow 3rd party apps to reach in and read any data from any app. There is a 100% chance this would be used maliciously immediately. Meta would pressure users to install their meta AI agent, which would then go and read the users DMs, and create profiles on all the users who don’t even use Facebook by reading their data from everyone they talk to who did. Personally I'd much prefer no siri access to app data than allowing evil companies like Meta/TikTok/Etc this level of access.

flumpcakes 4mo ago

iPhones have pretty good privacy controls. I don’t see how they can’t extend those to cover AI apps. I imagine the settings menu will get bonkers though. User education about apps slurping up all your data is needed regardless. People just trust apple with their talk of private cloud computing.

wmf 4mo ago
It would either lead to Vista-style constant UAC prompts or having to give blanket access upfront (which would be abused).

simjnd 4mo ago

It would only be a backdoor if it's implemented as a backdoor. The way Apple Health exchanges data with 3rd-party trackers (Fitbit, Garmin, etc.) is very well built and a good model of how other components in iOS could allow data exchange with very granular permissions. Apple touts the "Private Cloud Compute". If they found a way to share your personal context to process on their cloud in a private and anonymized way, there is no reason the same process couldn't be used to handoff data to a 3rd party AI provider.

jandrewrogers 4mo ago
The technical problem is nothing like exchanging data with fitness trackers. One of the issues here is that there are many people with strong opinions that don't understand the thing they have strong opinions about. Which is the normal state of human affairs.
- simjnd 4mo ago
  Indeed but you ignore my second paragraph: they have developed (and 3rd-party audited) a way to handoff all the data (parts of your Personal Context, etc.) to their cloud servers in a privacy preserving way on-device. Why couldn't the same process could be used to handoff the data to a 3rd-party AI provider? (genuine why, if you have an understanding of the thing you have a strong opinion about I'd genuinely appreciate the answer) It looks like Apple is framing this as a privacy issue as a marketing tactic so that consumers will blame the EU when Apple COULD implement it without endangering privacy.
  - JumpCrisscross 4mo ago
    > Why couldn't the same process could be used to handoff the data to a 3rd-party AI provider? You have more safeguards if it’s running on your own metal. It’s reasonable to want to understand that better, perhaps with your own red team, before opening up customer data to actual potential hostiles.
    - simjnd 4mo ago
      Yeah I overestimated the amount of stripping / anonymization that was being done on device and didn't realize how much plumbing was required server-side too to have good enough privacy guarantees
  - theshrike79 4mo ago
    Apple PCC is using completely mad and paranoid amounts of security down to hardware and firmware level making sure nobody at any point of the supply chain can access the data. EU can’t and won’t enforce the same rigour for 3rd party cloud AI. Which is the problem for Apple. If said 3rd party service leaks private data, guess which company is going to be in the BIG HEADLINE and which one will hardly be mentioned in the news?
Petersipoi 4mo ago
What? You want Apple to anonymize a users data, then hand that users data to a third party who knows who the user is? I don't think PCC is doing what you think it's doing.
mike_d 4mo ago
> It would only be a backdoor if it's implemented as a backdoor. You don't seem to know how backdoors work. Oppressive regimes mandate that tech companies pre-install apps to protect people from spam calls, or install specific root certificates so they can intercept your traffic and insert a helpful banner into your browsing session to remind you when to pray. The EU isn't going to ask Apple to add DataCollectionBackdoor(). They are going to demand that in the spirit of freedom and happiness EU companies must have access to Apple users private data.

andix 4mo ago

> This is essentially a backdoor into all of your data. No. Only if you would consider the Linux/macos/windows filesystem API a backdoor too. On your desktop any app with sufficient permissions can read all your data. Would you call that a backdoor?

deleted 4mo ago
[deleted]

iAMkenough 4mo ago

Why do you use the phrase backdoor? Is Apple incapable of designing a permissions system that allows a user to grant access to email and messages to an app of their choice? We already download apps and grant them permissions to subsections of personal data on our devices. I don’t believe Apple is incapable of designing a system that respects a user’s choices and granted permissions.

flaunf221 4mo ago

> This is essentially a backdoor into all of your data. This is the rhetoric used against right to repair. "What if enemies get access to our citizens' data if we allow anyone but us to repair your car?"

superxpro12 4mo ago
The hypocrisy is easily explained by the overall attack on ownership... you dont own your own data. you dont own your car, your phone, your pc. Everyone wants to own all your stuff...
HappyPanacea 4mo ago
I have never seen this argument against (admittedly I'm not big into such debates) right to repair, did it came up somewhere?
- shimman 4mo ago
  Yes, it's what the opposition literally does. Go read some press pieces from these neoliberal moderates: https://www.progressivepolicy.org/weighing-the-risks-of-right-to-repair-for-consumer-tech-products/ https://www.progressivepolicy.org/weighing-the-risks-of-righ...

t-sauer 4mo ago

> I understand Apple's position on this one Well then explain me this: There are absolutely no restriction on MacOS where I can give Claude free access to everything. If you are a Mac and iPhone user that essentially gives it access to the exact same data. Why is the data only protect worthy when accessed on the phone directly?

xlii 4mo ago
There's SIP. Claude can't install kernel extension and you can. (... and it just hit me why Apple requires specific reboot procedure to disable it)
- iAMkenough 4mo ago
  SIP doesn’t protect user data, and I’m not sure why a Siri AI alternative would need kernel access.
hyperpape 4mo ago
The Mac is a pre-existing platform that is both more capable than iOS, and had an existing user base that used apps that had much greater access. Apple’s attempts to lock down the Mac have met with poor adoption. In exchange, it also less secure, less user friendly, and less popular.
Gigachad 4mo ago
Laptops are a low security environment and already massively compromised. Thats why banks make you authorise transactions by approving them on your phone when you started them on the web. Apple has been working for a while to secure MacOS but it’s hard without breaking compatibility with old processes.
throwaway329847 4mo ago
There is no one-click way to install an AI model on macOS like potentially iOS could have. I can easily imagine some grandma install on their iPhone some random AI model they saw in an AI-generated Facebook post with just one tap.

InsideOutSanta 4mo ago

How is it a backdoor if I, as my data's actual owner, intentionally provide access to my data?

yxhuvud 4mo ago

It is not prohibiting guard rails. It is prohibiting Siri getting preferred treatment to bypass said guard rails

aucisson_masque 4mo ago

We have been able to choose our default app for 'assistant' on Android for a decade. It's fine. You can even revoke permissions if you want to. And guess what ? Because you're allowed to choose something else than Siri, it doesn't mean you have to. You can still use Siri if you think it's better for your privacy.

Gigachad 4mo ago
What level of system access do they have? You can use 3rd party AI apps on iOS, they just can’t read app data or make actions on the system outside of the APIs that currently exist. The new Siri has much deeper access to personal data and absolutely can not be trusted being siphoned off to a 3rd party server.
- aucisson_masque 4mo ago
  It's never been what the eu asks for. They want people to be able to set a different assistant than Siri, and that this assistant can have deep access (as much as Siri) if the users wants it.

jwitthuhn 4mo ago

It is not a backdoor if I authorize some other app to use that data, it is a front door. Apple thinks users should not be able to make the decision about who can access their data. It is not more complicated that that.

Gigachad 4mo ago
It’s a back door around normal app sandboxing and permissions systems. The security design of iOS was not meant to allow 3rd party apps to reach in and read any data from any app. There is a 100% chance this would be used maliciously immediately. Meta would pressure users to install their meta AI agent, which would then go and read the users DMs, and create profiles on all the users who don’t even use Facebook by reading their data from everyone they talk to who did. Personally I'd much prefer no siri access to app data than allowing evil companies like Meta/TikTok/Etc this level of access.