Google suspends some business with Huawei • Hacker News Board

Re: Google suspends some business with Huawei

#481

Post by xvector » Tue, May 21, 2019, 1:10 AM UTC

opportune wrote: post #213

Despegar wrote: post #163

Earlier quoted context omitted.

The last thing China wants during a trade war is to have the 3 million people in Apple's supply chain unemployed and angry. This particular leverage is also why iMessage isn't blocked in China.

iMessage isn't blocked in China because it doesn't need to be. China passed a law forcing Apple to put all Chinese users' iCloud data in a Chinese datacenter. Since Apple allows for account recovery, they store account keys in that datacenter. Anyone with privileged access to certain production resources in iCloud China should be able to access basically all Chinese users' data. The one exception is apparently Apple'…

IIUC if you disable iCloud backup of iMessages, you're safe here. This is because iMessage is E2EE enforced by the Secure Enclave when iCloud backup of iMessages is disabled.

Re: Google suspends some business with Huawei

#482

Post by xvector » Tue, May 21, 2019, 1:12 AM UTC

opportune wrote: post #252

graeme wrote: post #250

Earlier quoted context omitted.

The article refers to icloud encryption keys, not imessage keys. If imessages are backed up to icloud, then the govt will have keys to see them. But if a user doesn't back up, I was under the impression not even apple could decrypt iMessages.

Correct, for data that isn't backed up, you would need to have root access to the user's device.

Not even root access would suffice. You'd need the user passcode.

Re: Google suspends some business with Huawei

#483

Post by windexh8er » Tue, May 21, 2019, 1:44 AM UTC

tptacek wrote: post #462

windexh8er wrote: post #446

Earlier quoted context omitted.

Lawful intercept isn't itself a backdoor, but it did provide one that was exposed via Snowden. In this case I'll call a spade a spade: many lawful intercept tools were used as backdoors, or overreach of legal authority. Again, keep in mind the context of my original comment: the years 2010-2011 which was pre-Snowden. The FBI may have stepped in with a heavy hand for many reasons but those reasons may have included in…

PRISM was literally a system for handling the paperwork for lawful intercepts. There are instances of the USG exceeding its authority, but you've somehow managed to cite one of the few leaked programs that had an almost purely lawful purpose.

While I respect your opinion I don't agree.

First of all PRISM was not purely "a system for handling paperwork for lawful intercepts", see [0].

Second your assertion assumes that somehow all requests within these programs abided by "lawful purpose", which we also know is not true. Whether FISA rubber stamps were lawful is subjective and your opinion but not fact. Your answer purports a black and white perspective on the past which I simply don't find appropriately represents all the shades of grey presented by all of the legal angles during this time.

[0] https://dzone.com/articles/nsa-prism-%E2%80%93-mother-all-bi...

Re: Google suspends some business with Huawei

#484

Post by hollerith » Tue, May 21, 2019, 1:52 AM UTC

dx034 wrote: post #410

PixyMisa wrote: post #349

Earlier quoted context omitted.

It's a China vs. the world issue. China has been spying on everyone, for years. Political, military, commercial, makes no difference.

For the EU it's really just the question if you want to be spied on by the US or by China. In recent years, trade with China has probably helped the economy much more than trade with the US. At the same time, China (while certainly acting out of self interest), is somewhat predictable in their actions. Europeans are really critical of China and their policies (esp. their human rights record). But they don't like the…

>China, is somewhat predictable in their actions

Yeah, wow, it must be completely impossible for someone without decades of US residency or decades of intense interest in the US to understand the US government!

I like to flatter myself that after 58 years of living in the US, I have recently started to be able to predict most of the major decisions of the US government. (Youtube videos of speeches and interviews by Peter Zeihan and George Friedman helped me in my understanding. Most of the senior editors and reporters at, e.g., the New York Times and the Washington Post, although passionately interested in the US government, have only a shallow understanding of it IMO.)

Re: Google suspends some business with Huawei

#485

Post by tooltalk » Tue, May 21, 2019, 2:13 AM UTC

ChuckNorris89 wrote: post #165

costcopizza wrote: post #154

Earlier quoted context omitted.

How much more expensive would an iPhone be that’s assembled in the US?

Cost is not the reason all consumer electronics are made in China. Actually, manufacturing there is now more expensive than Estern Europe. They build them there because all the supply chain is already there. In Shenzhen, the capacitors, resistors, PCBs and most chips are sourced in bulk from around the block . That's something no other country in the West or even East has and it's such a complex interconnected ecosys…

This is ridiculous. You are making it sound like those suppliers are immovable and somehow only available in China. But let's face it, Apple is in China because of almost unlimited cheap, unskilled rural labor force that can't be found elsewhere. Samsung was also in same spot years ago, but found a much better deal in Vietnam years back and in fact moved much of their smartphone operation there (along with some 200+ subcontractors and suppliers). Unlike Samsung's AMOLED displays, Corning's Gorilla glasses, or SONY's cameras, there is nothing in China that can't be produced elsewhere.

Vietnam also has hundreds of thousands of CNC, toolings and craftmen to produce in Samsung's volume. This supply chain narrative is something Apple marketing folks invented to justify their outsourcing. Trump's trade war with China, as many contract manufacturer move out of China, will prove none of that supply chain myth is true within a year or two.

Re: Google suspends some business with Huawei

#486

Post by partiallypro » Tue, May 21, 2019, 2:28 AM UTC

dang wrote: post #470

partiallypro wrote: post #468

Earlier quoted context omitted.

I don't see how pointing out a country has concentration camps (reported by multiple outlets, like the NYTs) is "nationalistic," or against the spirit of the site. In fact the story has been reported here...A LOT. https://hn.algolia.com/?query=china%20muslims&sort=byPopular... https://hn.algolia.com/?query=china%20concentration&sort=byP... I don't see anyone being "warned" about their -submissions- on this very topic…

I'm aware of how often the story has been submitted and also how often people bring it up in comments, including where it breaks this site guideline to do so: "Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html The issue is that your comment was taking the thread further…

Still fail to see how this is an unrelated controversy or generic tangent, when Huawei has been accused of aiding in human rights violations with the Chinese government. That is very much on topic. If it were just China in general, that would be a tangent...but this is about Huawei which was accused of this by "Reporters without Borders" just last month, of assisting in Chinese concentration camps imprisoning Muslims https://rsf.org/en/reports/rsf-report-chinas-pursuit-new-wor....

The reason I say this is unevenly enforced is that people constantly point out US companies aiding the NSA via PRISM from years back...but new reports of the Chinese government doing the same thing, if not worse, are marked as "nationalist" and "flamebait." Either both are, or neither are. It seems like one comes under much more scrutiny than the other. Maybe that's something you and the mod team need to figure out.

Re: Google suspends some business with Huawei

#487

Post by windexh8er » Tue, May 21, 2019, 2:34 AM UTC

dsl wrote: post #480

windexh8er wrote: post #445

Earlier quoted context omitted.

While your statement on CALEA is true it also isn't the correct history. What CALEA put in place was designed for lawful intercept but we also know there were programs in use going against said law [0]. Remember the context of my conversation was 2010-2011 which was pre-Snowden. It's likely state, local and national agencies have less of an interest, today, at route/switch infrastructure simply because of the post-Sn…

PRISM was a confusing program because neither the people reporting on it, or the tech companies impacted understood how it worked. The claim was the NSA had direct access in to providers networks, and the companies claimed they did not - the "logical" conclusion was an abuse of CALEA or similar access granted to FBI. It was later discovered the NSA capability was the direct result of tapping fiber optic cables betwee…

We never got the full picture on PRISM. We do know that at least a part of the program was a direct result of tapping fiber much of the program also went redacted. I've posted this before but during 2010 the main data center I had access to was closed one evening and the next morning we had a mobile server rack tied back to main routing gear via fiber which was in a mobile rack, blacked out and fully tamper taped. We knew a three letter agency was installing it and all floor access was revoked for that evening as well as being in the building. This was not off long haul fiber but was off of main routing infrastructure. I don't believe PRISM was purely fiber taps and that these programs had deeper hooks. Unfortunately I don't have any evidence beyond the assumption based on the facts I had been given and what I physically saw. I've used and installed a lot of long haul gear and have seen and installed many fiber taps in my day, this implementation was hardly passive in nature. But, that's just first hand knowledge of a random patron of the Internet.

Re: Google suspends some business with Huawei

#488

Post by pvg » Tue, May 21, 2019, 4:24 AM UTC

windexh8er wrote: post #483

tptacek wrote: post #462

Earlier quoted context omitted.

PRISM was literally a system for handling the paperwork for lawful intercepts. There are instances of the USG exceeding its authority, but you've somehow managed to cite one of the few leaked programs that had an almost purely lawful purpose.

While I respect your opinion I don't agree. First of all PRISM was not purely "a system for handling paperwork for lawful intercepts", see [0]. Second your assertion assumes that somehow all requests within these programs abided by "lawful purpose", which we also know is not true. Whether FISA rubber stamps were lawful is subjective and your opinion but not fact. Your answer purports a black and white perspective on…

It's not a 'just your opinion, man' sort of thing - more or less nobody seems to have thought PRISM was unlawful. Rand Paul, I think, made some noises about suing at the time and eventually did file some sort of suit that ended up not being about PRISM.

Re: Google suspends some business with Huawei

#489

Post by dafsdfasdfsa » Tue, May 21, 2019, 4:38 AM UTC

tgragnato wrote: post #456

dafsdfasdfsa wrote: post #401

Earlier quoted context omitted.

This is not true anymore. Some android phones (samsung, google), have DMA disabled and modern iphones (around 2016?) use USB or SDIO without DMA. I honestly believe that the theoretical DMA backdoor attack (and most other similar attacks) have been mitigated thoroughly. I am much more concerned about secretly held 0days (RCE) and most concerned about warrantless orders against cloud storage. https://www.apple.com/bus…

> without DMA [...] 0days (RCE) > https://www.apple.com/business/site/docs/iOS_Security_Guide.... p41 Are you citing "To protect the device from vulnerabilities in network processor firmware, network interfaces including Wi-Fi and baseband have limited access to application processor memory. When USB or SDIO is used to interface with the network processor, the network processor can’t initiate Direct Memory Access (DM…

Blocking DMA is separate from 0days. One is a design decision, the other is a still-unavoidable consequence of complicated software.

I think that these mechanisms completely frustrate "bulk" in-field collection efforts; for example, scanning all phones at DUI checkpoints.

No technical control is perfect. If you personally piss off a nation state adversary, they are more likely to yeet you off to a black site and hit you with a wrench until you cough up your passcode.

Surely, someone will break iBoot, and surely, someone will break SEPOS. And surely, someone will chain a kernel exploit with a userspace exploit [0]. And surely, someone will leak the signing keys for a widely deployed cheap android phone [1]. And surely, someone will push 777 permissions to a cloud provider [2]. And most surely, powerful government adversaries will hold brutal exploits close to their chest in the service of power and politics [3].

So I guess, if you want to breath freely: host your infrastructure yourself where feasible. Choose providers who respect your privacy. Make a modest but financially fair donation to the EFF. Become politically active. Use better practices - not best - to avoid fatiguing yourself in the windmill chasing effort of being Perfectly Secure. Most importantly, stay awake and aware and ready to fight.

0 https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...

1 https://www.theregister.co.uk/2017/11/16/dji_private_keys_le...

2 https://www.cnbc.com/2019/05/17/salesforce-says-a-major-issu...

3 https://www.wired.com/story/eternalblue-leaked-nsa-spy-tool-...

Re: Google suspends some business with Huawei

#490

Post by mantas » Tue, May 21, 2019, 7:16 AM UTC

kgabis wrote: post #475

mantas wrote: post #421

Earlier quoted context omitted.

Would you prefer daily life like in US or China?

I haven't been to US, but all my friends that visited it were quite disappointed with quality of life there (coming from Poland). But I've recently spent a few weeks in China and I'm really impressed with how advanced it is in terms of infrastructure and technology, I don't think US or even EU is anywhere near where China is right now. So it's not as simple a comparison as it first appears.

It's not only about QoL. Personal freedom, government accountability and democracy is as important. If not even more important. Coming from ex-Soviet state you should be aware of that (saying this as your neighbour from Lithuania).

Even if democracy in West (or at home) is far from perfect, it's lightyears ahead of China.