4 ms·

The paragraph he quoted notes that Apple does not have the keys.

by cwp 12y ago

foobarqux 12y ago
From Apple's site: > Even if you choose to use a third-party application to access your iCloud data, your username and password are sent over an encrypted SSL connection. So user/pass is sufficient to access cleartext of your data, and Apple definitely has that. This should be obvious: If there is any way to recover your data when you lose your phone (without using a secret key that is never shared with Apple) then the security is broken.
- xenadu02 12y ago
  How do you propose to solve the problem of a user's house burning down with their phone, laptop, and iPad? Tell them sorry, your iCloud backups are encrypted and now all the keys are gone? So encrypt the iCloud backup with a password you say... Except you need a password to get in to iCloud already so how is that any different? And for the record, Apple stores password hashes, so they don't have your password. Unless you think they are just lying repeatedly for no good reason. When was the last time you verified the chip layouts for your CPUS to ensure there were no back doors? Didn't think so.
  - foobarqux 12y ago
    I didn't propose to solve any problem, I pointed out the obvious flaws in claims about Apple's security and resistance to gov requests. Private keys are different than passwords. Password hashes are computed server side where the password can be trivially intercepted. CPU backdoors are a security problem, that doesn't negate the existence of other security flaws. Moreover CPU backdoors are far more costly to implement and effort should be directed first at cheaper/easier weaknesses, like ineffective encryption of data.
  - stdgy 12y ago
    I think you're being a bit overly defensive here. (S)he was just pointing out some facts about the system that I didn't grasp in my initial post. It's important that we remain critical of any system. And it's equally important that we remain conscious of their potential flaws and design trade-offs.

The paragraph he quoted notes that Apple does not have the keys.

by cwp 12y ago

The paragraph he quoted notes that Apple does not have the keys.

From Apple's site: > Even if you choose to use a third-party application to access your iCloud data, your username and password are sent over an encrypted SSL connection. So user/pass is sufficient to access cleartext of your data, and Apple definitely has that. This should be obvious: If there is any way to recover your data when you lose your phone (without using a secret key that is never shared with Apple) then the security is broken.

xenadu02 12y ago
How do you propose to solve the problem of a user's house burning down with their phone, laptop, and iPad? Tell them sorry, your iCloud backups are encrypted and now all the keys are gone? So encrypt the iCloud backup with a password you say... Except you need a password to get in to iCloud already so how is that any different? And for the record, Apple stores password hashes, so they don't have your password. Unless you think they are just lying repeatedly for no good reason. When was the last time you verified the chip layouts for your CPUS to ensure there were no back doors? Didn't think so.
- foobarqux 12y ago
  I didn't propose to solve any problem, I pointed out the obvious flaws in claims about Apple's security and resistance to gov requests. Private keys are different than passwords. Password hashes are computed server side where the password can be trivially intercepted. CPU backdoors are a security problem, that doesn't negate the existence of other security flaws. Moreover CPU backdoors are far more costly to implement and effort should be directed first at cheaper/easier weaknesses, like ineffective encryption of data.
- stdgy 12y ago
  I think you're being a bit overly defensive here. (S)he was just pointing out some facts about the system that I didn't grasp in my initial post. It's important that we remain critical of any system. And it's equally important that we remain conscious of their potential flaws and design trade-offs.