10 ms·

They've got it all wrong. Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, con

by abalone 13y ago

They've got it all wrong. Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, controlled approach to third party software distribution. This is backed by hard data on malicious attacks from the Dept. of Homeland Security and the FBI. 79% occurred on Android, and just 0.7% on iPhone. I'm also 100% positive this will have no effect on the reasoning of the FSF. Source: http://www.bbc.co.uk/news/technology-23863495 http://www.bbc.co.uk/news/technology-23863495

tedks 13y ago
This says nothing of NSA sleeper agents sneaking backdoors into Apple products, which seems pretty likely given the recent disclosures. The more centralized you build a system, the easier it is to completely own. Also, there's a massive confound in that Android phones come a lot cheaper than iPhones, making them far more accessible for the typical targets of active government surveillance.
- ubernostrum 13y ago
  You could be an NSA sleeper agent, using HN to launch false-flag propaganda operations. Go ahead and prove otherwise, if you can. Until then I'm going to treat everything you say and do as an attempt to spy on me.
  - vincie 13y ago
    You could be an NSA sleeper-sleeper agent, using HN to launch false-false-flag propaganda operations. Go ahead and prove otherwise, if you can. Until then I'm going to treat everything you say and do as an attempt to spy on me.
    - mck- 13y ago
      Stack Overflow
    - sliverstorm 13y ago
      We're probably all NSA sleeper agents, every one of us, we just don't know it because we haven't been activated yet.
  - tedks 13y ago
    I suppose so, but the NSA budget would have to be awfully big to fund me. It's high-cost, and low-gain. In contrast, owning Apple would be a massive win. But you're free to treat everything I say and do as an attempt to spy on me. How will that change your behavior? Or are you being deliberately obtuse for the sake of disrupting discussion?
    - sbuk 13y ago
      But your comment was obtuse too. Throwing the NSA thing at Apple is ridiculous frankly. It seems that the vast majority of tech companies were involved, including the likes of Google and all seemed to be far more embroiled is the sordid affair than Apple. So why are they more likely to be sharing stuff that anyone else? It's all very disingenuous from where I'm standing.
      - tedks 13y ago
        A single walled garden is easily subverted by HUMINT. That is a valid counterstatement to the statement "Walled gardens make users more safe." I can't see how that was obtuse. What part did you not understand?
        sbuk 13y ago
        Oh, I understand what you are saying perfectly. You are going about it in an obtuse manner.
    - ubernostrum 13y ago
      I think there is a point at which mindlessly yelling "WHAT ABOUT THE NSA" at, well, basically everything stops being useful, because it offers no insight whatsoever, and provokes no thoughts that hadn't already been provoked. In fact, past a certain point it becomes counterproductive, as it enters "Old Man Yells At Cloud" territory and opens up the commenter, and by connection the content of the comment, as a subject of ridicule. Also, you've still not proven to me that you don't work for the NSA.
      - 13y ago
- scoot 13y ago
  Given that the USCIS (and so, presumably, the NSA) already has the fingerprints of every visitor to the USA, and (as I understand it) any US citizen with a drivers license, I'm not sure I understand what harvesting fingerprint signatures from the iPhone would achieve.
  - nthj 13y ago
    Hmm, I don't remember giving my fingerprints to anyone for a driver's license.
    - scoot 13y ago
      You're right, apparently not all states require this.
      - Amadou 13y ago
        Most do not. But some of the most populous do. California and Texas are among the list that require thumbprints.
        selectodude 13y ago
        California, Colorado, Georgia, and Texas.
  - drcube 13y ago
    It goes the other way around. Because the government has almost everyone's fingerprint on file already, it is important to them that fingerprint scanners become a widespread method of authentication. Making sure the new locks fit all these old keys we have lying around, basically. Standard government cost saving measure.
  - jarek 13y ago
    As I've pointed out in another thread, Canadian citizens visiting the U.S. are not automatically fingerprinted: http://en.wikipedia.org/wiki/US-VISIT http://en.wikipedia.org/wiki/US-VISIT http://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_us_canada_land_border_info_card_english.pdf http://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_us_ca...
nostromo 13y ago
Reminds me of this: http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/ http://news.cnet.com/8301-13578_3-57577887-38/apples-imessag... > Encryption used in Apple's iMessage chat service has stymied attempts by federal drug enforcement agents to eavesdrop on suspects' conversations, an internal government document reveals.
- staticfish 13y ago
  Or does it..
  - skeletonjelly 13y ago
    "Oh damn! We are totally foiled by this encryption. Can't read any messages, public! Carry on sending confidential data". Seems like a good play.
milsorgen 13y ago
I actually think you have it all wrong. For while malicious applications can do all sorts of nefarious things they are still individual actors. I think at this point while we all detest the extremes of marketing the more pressing concern has to do with state sanctioned surveillance which would be much more feasible with such a centralized service as provided by Apple. I truly find your comment disingenuous and suspect as you only mention apparent malware and virii while the tone I infered from the article seemed a little more nuanced.
why-el 13y ago
I disagree. FSF's usual complaints are not about who protects whom, but rather about knowing what your device is doing, which is impossible in the case of Apple.
- rimantas 13y ago
  It is impossible with any phone today. Unless you made it from the scratch yourself.
  - simik 13y ago
    Knowledge is not binary. Knowing more about what your phone is doing is better than knowing less.
jkscm 13y ago
and the "average" user, not some hyper-educated tech savy never needing support person, has not much of a choice. Standard Android solutions will become just as bad in terms of unfree software. Sadly, but understandingly, user will value the niceties of iOS and alike more than the potential damage to their privacy. NSA aside, I think their fingerprint system is a security improvement. Although there are methods to easily fool fingerprint sensors : [http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=en](http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=en) http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?langu... No password < 4-digit code < fingerprint < complex password
brymaster 13y ago
> Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, controlled approach to third party software distribution. You have got to be kidding. For an ecosystem where its been the 'norm' to slurp users entire address books[1], NOTHING about Apple's 'curated, controlled' approach protects users. Please get real. 1. https://news.ycombinator.com/item?id=3563016 https://news.ycombinator.com/item?id=3563016 2. https://news.ycombinator.com/item?id=5632934 https://news.ycombinator.com/item?id=5632934 3. https://news.ycombinator.com/item?id=3564830 https://news.ycombinator.com/item?id=3564830 4. http://www.idownloadblog.com/2012/09/27/facebook-ios-6-phone-number/ http://www.idownloadblog.com/2012/09/27/facebook-ios-6-phone...
- aaronbrethorst 13y ago
  Not any longer. Users must explicitly approve app access to contacts the first time it's requested.
  - devx 13y ago
    Yes, and what else we don't know about, thanks to their closed software? Yes, Apple just told us your fingerprint will be stored locally. So? Does that mean Apple si telling the truth, or couldn't leave a backdoor for NSA to get the data? No it doesn't, and we wouldn't know if they did do that. That's the problem with closed software.
    - jarcoal 13y ago
      I'm not going to say that your fingerprints won't fall into the wrong hands, but it's incredibly simple to monitor network traffic from the device, and it's a guarantee someone will do this just to see. It's also a guarantee that Apple knows this, so why bother lying?
    - coldtea 13y ago
      >That's the problem with closed software. That's also the problem with open software people get off of the internet/provider in binary form instead of compiling it themselves. That is, all software.
andmarios 13y ago
In prison you are less likely to get involved in a car accident.
byoogle 13y ago
> This is backed by hard data on malicious attacks from the Dept. of Homeland Security and the FBI. These seem like nice, trustworthy sources.
backprojection 13y ago
>Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, controlled approach to third party software distribution. I'm a strong proponent of free software, but I do see your point, that there's safety for non-technical people in a walled garden, as long as you trust the gardener. I'm wondering if the concept of free-software and a walled garden are really that incompatible. Let's say the garden has a gate, that a user has to go through a clear process in order to allow to install non-recommended software. This would give a similar level of protection for non-technical people, but will still be free-software, and allow technical users to install whatever they want. One effect would be that, if the gardeners decide not to recommend some popular software, then many users would be inclined to disable the safety features, thus reducing overall safety, so there will be a penalty if the gardeners are too strict.
- gizmo686 13y ago
  >I'm wondering if the concept of free-software and a walled garden are really that incompatible. They are defiantly compatible. Consider the way Debian (and many others) approach the problem. Almost all software is installed through the package manager, which gets the software from a set of repositories. These repositories can be as much of a walled garden as the repository owners want them to be. The main difference is that, it is possible to add third party repositories, and/or remove first party repositories (or sidestep the package manager entirely).
lectrick 13y ago
Thank you for pointing this out. While a "walled garden" approach is less than ideal, it is clearly somewhat more effective from a security standpoint. Perhaps not your "NSA backdoor" variety of security though...
keithwinstein 13y ago
This is silly. The free-software folks doesn't want phones to be like Android; they want them to be like Debian (or gNewSense or whatever). That is, where users have a choice of a curated package repository maintained by middlemen who have the users' interests at heart. And where packages and the changes to those packages have an audit trail. The Google Play store is a disaster from the GNU perspective -- zillions of nearly-identical closed-source programs, most of them pretty lousy, no curation by a trusted third party, no access to source anyway (so not so easy to curate even if you wanted to), no ability to fetch an old version or see what has changed, no way to "take over" an abandoned package and bring it up to date or improve it, no way for a distributor to make programs play nicely together, and no way for a distributor to modify programs to make them less privacy-invasive or battery-intensive or whatever users might want.
- zanny 13y ago
  They don't even want Debian, since it has optional binary blobs and hosted repositories of commercial software. FSF isn't complciated - don't give your users anything without including the source. And don't restrict the users ability to modify and run said software however they want.
  - Karunamon 13y ago
    The FSF refuses to "approve" something just because they point out nonfree software that you can use. Fedora fails for this reason - it's 100% free software with some firmware blobs kept aside that are, yknow, necessary to make some hardware work. It's dogmatic to the point of absurdity. A piece of software is free software because of what it is, not because of what its makers suggest/allow you install on it.
    - mattl 13y ago
      > A piece of software is free software because of what it is, not because of what its makers suggest/allow you install on it. And so, if its a binary with a license that prohibits redistribution, modification, ships without source, or is just a series of hex values in a struct, I don't see how its free software?
mikeash 13y ago
> This is backed by hard data on malicious attacks from the Dept. of Homeland Security and the FBI. Poe's Law strikes again.
doctorwho 13y ago
You are so far from the point, the light from the point will take billions of years to reach you. It's the platform and the platform vendor that can't be trusted to keep you safe, that's before you even start talking about attack vectors from third parties a.k.a. Apple Partner Companies. And seriously, you're ready to get in bed with the DHS and FBI? They're the ones after your data!

by abalone 13y ago

tedks 13y ago

This says nothing of NSA sleeper agents sneaking backdoors into Apple products, which seems pretty likely given the recent disclosures. The more centralized you build a system, the easier it is to completely own. Also, there's a massive confound in that Android phones come a lot cheaper than iPhones, making them far more accessible for the typical targets of active government surveillance.

ubernostrum 13y ago
You could be an NSA sleeper agent, using HN to launch false-flag propaganda operations. Go ahead and prove otherwise, if you can. Until then I'm going to treat everything you say and do as an attempt to spy on me.
- vincie 13y ago
  You could be an NSA sleeper-sleeper agent, using HN to launch false-false-flag propaganda operations. Go ahead and prove otherwise, if you can. Until then I'm going to treat everything you say and do as an attempt to spy on me.
  - mck- 13y ago
    Stack Overflow
  - sliverstorm 13y ago
    We're probably all NSA sleeper agents, every one of us, we just don't know it because we haven't been activated yet.
- tedks 13y ago
  I suppose so, but the NSA budget would have to be awfully big to fund me. It's high-cost, and low-gain. In contrast, owning Apple would be a massive win. But you're free to treat everything I say and do as an attempt to spy on me. How will that change your behavior? Or are you being deliberately obtuse for the sake of disrupting discussion?
  - sbuk 13y ago
    But your comment was obtuse too. Throwing the NSA thing at Apple is ridiculous frankly. It seems that the vast majority of tech companies were involved, including the likes of Google and all seemed to be far more embroiled is the sordid affair than Apple. So why are they more likely to be sharing stuff that anyone else? It's all very disingenuous from where I'm standing.
    - tedks 13y ago
      A single walled garden is easily subverted by HUMINT. That is a valid counterstatement to the statement "Walled gardens make users more safe." I can't see how that was obtuse. What part did you not understand?
      - sbuk 13y ago
        Oh, I understand what you are saying perfectly. You are going about it in an obtuse manner.
  - ubernostrum 13y ago
    I think there is a point at which mindlessly yelling "WHAT ABOUT THE NSA" at, well, basically everything stops being useful, because it offers no insight whatsoever, and provokes no thoughts that hadn't already been provoked. In fact, past a certain point it becomes counterproductive, as it enters "Old Man Yells At Cloud" territory and opens up the commenter, and by connection the content of the comment, as a subject of ridicule. Also, you've still not proven to me that you don't work for the NSA.
    - 13y ago
scoot 13y ago
Given that the USCIS (and so, presumably, the NSA) already has the fingerprints of every visitor to the USA, and (as I understand it) any US citizen with a drivers license, I'm not sure I understand what harvesting fingerprint signatures from the iPhone would achieve.
- nthj 13y ago
  Hmm, I don't remember giving my fingerprints to anyone for a driver's license.
  - scoot 13y ago
    You're right, apparently not all states require this.
    - Amadou 13y ago
      Most do not. But some of the most populous do. California and Texas are among the list that require thumbprints.
      - selectodude 13y ago
        California, Colorado, Georgia, and Texas.
- drcube 13y ago
  It goes the other way around. Because the government has almost everyone's fingerprint on file already, it is important to them that fingerprint scanners become a widespread method of authentication. Making sure the new locks fit all these old keys we have lying around, basically. Standard government cost saving measure.
- jarek 13y ago
  As I've pointed out in another thread, Canadian citizens visiting the U.S. are not automatically fingerprinted: http://en.wikipedia.org/wiki/US-VISIT http://en.wikipedia.org/wiki/US-VISIT http://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_us_canada_land_border_info_card_english.pdf http://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_us_ca...

nostromo 13y ago

Reminds me of this: http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/ http://news.cnet.com/8301-13578_3-57577887-38/apples-imessag... > Encryption used in Apple's iMessage chat service has stymied attempts by federal drug enforcement agents to eavesdrop on suspects' conversations, an internal government document reveals.

staticfish 13y ago
Or does it..
- skeletonjelly 13y ago
  "Oh damn! We are totally foiled by this encryption. Can't read any messages, public! Carry on sending confidential data". Seems like a good play.

milsorgen 13y ago

I actually think you have it all wrong. For while malicious applications can do all sorts of nefarious things they are still individual actors. I think at this point while we all detest the extremes of marketing the more pressing concern has to do with state sanctioned surveillance which would be much more feasible with such a centralized service as provided by Apple. I truly find your comment disingenuous and suspect as you only mention apparent malware and virii while the tone I infered from the article seemed a little more nuanced.

why-el 13y ago

I disagree. FSF's usual complaints are not about who protects whom, but rather about knowing what your device is doing, which is impossible in the case of Apple.

rimantas 13y ago
It is impossible with any phone today. Unless you made it from the scratch yourself.
- simik 13y ago
  Knowledge is not binary. Knowing more about what your phone is doing is better than knowing less.

jkscm 13y ago

and the "average" user, not some hyper-educated tech savy never needing support person, has not much of a choice. Standard Android solutions will become just as bad in terms of unfree software. Sadly, but understandingly, user will value the niceties of iOS and alike more than the potential damage to their privacy. NSA aside, I think their fingerprint system is a security improvement. Although there are methods to easily fool fingerprint sensors : [http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=en](http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=en) http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?langu... No password < 4-digit code < fingerprint < complex password

brymaster 13y ago

> Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, controlled approach to third party software distribution. You have got to be kidding. For an ecosystem where its been the 'norm' to slurp users entire address books[1], NOTHING about Apple's 'curated, controlled' approach protects users. Please get real. 1. https://news.ycombinator.com/item?id=3563016 https://news.ycombinator.com/item?id=3563016 2. https://news.ycombinator.com/item?id=5632934 https://news.ycombinator.com/item?id=5632934 3. https://news.ycombinator.com/item?id=3564830 https://news.ycombinator.com/item?id=3564830 4. http://www.idownloadblog.com/2012/09/27/facebook-ios-6-phone-number/ http://www.idownloadblog.com/2012/09/27/facebook-ios-6-phone...

aaronbrethorst 13y ago
Not any longer. Users must explicitly approve app access to contacts the first time it's requested.
- devx 13y ago
  Yes, and what else we don't know about, thanks to their closed software? Yes, Apple just told us your fingerprint will be stored locally. So? Does that mean Apple si telling the truth, or couldn't leave a backdoor for NSA to get the data? No it doesn't, and we wouldn't know if they did do that. That's the problem with closed software.
  - jarcoal 13y ago
    I'm not going to say that your fingerprints won't fall into the wrong hands, but it's incredibly simple to monitor network traffic from the device, and it's a guarantee someone will do this just to see. It's also a guarantee that Apple knows this, so why bother lying?
  - coldtea 13y ago
    >That's the problem with closed software. That's also the problem with open software people get off of the internet/provider in binary form instead of compiling it themselves. That is, all software.

andmarios 13y ago

In prison you are less likely to get involved in a car accident.

byoogle 13y ago

> This is backed by hard data on malicious attacks from the Dept. of Homeland Security and the FBI. These seem like nice, trustworthy sources.

backprojection 13y ago

>Users are vastly better protected from the kind of network surveillance they mention with Apple products, thanks to their curated, controlled approach to third party software distribution. I'm a strong proponent of free software, but I do see your point, that there's safety for non-technical people in a walled garden, as long as you trust the gardener. I'm wondering if the concept of free-software and a walled garden are really that incompatible. Let's say the garden has a gate, that a user has to go through a clear process in order to allow to install non-recommended software. This would give a similar level of protection for non-technical people, but will still be free-software, and allow technical users to install whatever they want. One effect would be that, if the gardeners decide not to recommend some popular software, then many users would be inclined to disable the safety features, thus reducing overall safety, so there will be a penalty if the gardeners are too strict.

gizmo686 13y ago
>I'm wondering if the concept of free-software and a walled garden are really that incompatible. They are defiantly compatible. Consider the way Debian (and many others) approach the problem. Almost all software is installed through the package manager, which gets the software from a set of repositories. These repositories can be as much of a walled garden as the repository owners want them to be. The main difference is that, it is possible to add third party repositories, and/or remove first party repositories (or sidestep the package manager entirely).

lectrick 13y ago

Thank you for pointing this out. While a "walled garden" approach is less than ideal, it is clearly somewhat more effective from a security standpoint. Perhaps not your "NSA backdoor" variety of security though...

keithwinstein 13y ago

This is silly. The free-software folks doesn't want phones to be like Android; they want them to be like Debian (or gNewSense or whatever). That is, where users have a choice of a curated package repository maintained by middlemen who have the users' interests at heart. And where packages and the changes to those packages have an audit trail. The Google Play store is a disaster from the GNU perspective -- zillions of nearly-identical closed-source programs, most of them pretty lousy, no curation by a trusted third party, no access to source anyway (so not so easy to curate even if you wanted to), no ability to fetch an old version or see what has changed, no way to "take over" an abandoned package and bring it up to date or improve it, no way for a distributor to make programs play nicely together, and no way for a distributor to modify programs to make them less privacy-invasive or battery-intensive or whatever users might want.

zanny 13y ago
They don't even want Debian, since it has optional binary blobs and hosted repositories of commercial software. FSF isn't complciated - don't give your users anything without including the source. And don't restrict the users ability to modify and run said software however they want.
- Karunamon 13y ago
  The FSF refuses to "approve" something just because they point out nonfree software that you can use. Fedora fails for this reason - it's 100% free software with some firmware blobs kept aside that are, yknow, necessary to make some hardware work. It's dogmatic to the point of absurdity. A piece of software is free software because of what it is, not because of what its makers suggest/allow you install on it.
  - mattl 13y ago
    > A piece of software is free software because of what it is, not because of what its makers suggest/allow you install on it. And so, if its a binary with a license that prohibits redistribution, modification, ships without source, or is just a series of hex values in a struct, I don't see how its free software?

mikeash 13y ago

> This is backed by hard data on malicious attacks from the Dept. of Homeland Security and the FBI. Poe's Law strikes again.

doctorwho 13y ago

You are so far from the point, the light from the point will take billions of years to reach you. It's the platform and the platform vendor that can't be trusted to keep you safe, that's before you even start talking about attack vectors from third parties a.k.a. Apple Partner Companies. And seriously, you're ready to get in bed with the DHS and FBI? They're the ones after your data!