Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple dropped plan for encrypting backups after FBI complained

reuters.com

Post reply on HN
Print view View original

261–270 of 734 posts

Re: Apple dropped plan for encrypting backups after FBI complained

#261

Post by samatman »

panarky wrote: post #167
pdimitar wrote: post #110

Earlier quoted context omitted.

You vote if you actually have a choice. What choice is there beyond Apple or Google in terms of smartphones? And I mean actual, ergonomic, everyday convenient choice -- my mother will firmly refuse me if I said "I'll buy you a phone but will have to tinker a full weekend to make it half-privacy-aware". And even if she was on board, she'll just yell at me if she can't do a basic task (this is a controversial topic aro…

> Google is an ad company Apple is also an ad company. Apple's advertising business is currently $2 billion, growing rapidly, on track to $11 billion by 2025. https://9to5mac.com/2019/11/15/apple-ad-revenue/

Google is an ad company that sells hardware.

Apple is a hardware company that sells ads.

Re: Apple dropped plan for encrypting backups after FBI complained

#262

Post by minton »

tomaskafka wrote: post #208
mrtksn wrote: post #57

Apple has a list for that: https://support.apple.com/en-us/HT202303 These are end to end: Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information QuickType Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords The messages also end to end but the backup contains the private key. The moral of…

Two things: 1) There is no way Apple would be allowed to sell iPhones in China, without China government having access to anything. So, I assume that Apple users in China have e2e encrypted exactly nothing. 2) I have a strong suspicion that those 'enter your Apple ID password because your account needs it' message really means 'a government has requested your data and even though it's encrypted, we will nag you about…

> 2) I have a strong suspicion that those 'enter your Apple ID password because your account needs it' message really means 'a government has requested your data and even though it's encrypted, we will nag you about entering a password, and if you give it, you're a free game'.

Haha I hadn’t thought of that. If true, I must have every government requesting my data frequently as I constantly get bombarded to enter my iCloud password.

Re: Apple dropped plan for encrypting backups after FBI complained

#263

Post by ksec »

justapassenger wrote: post #227
GeekyBear wrote: post #207

>there's no good and easy option to backup your phone other than iCloud. Turn off iCloud and do local encrypted backups to your PC or Mac. This works over your wifi network (if you prefer wireless charging at home) or via a cable connection.

It’s not only way more friction than iCloud, but you’d be surprised how many people nowadays don’t even own a PC or Mac. In my wife’s family 60% of people only have phones, tablets and smart TVs. They use laptops/desktops only at work.

We Need iOS TimeCapsule.

Re: Apple dropped plan for encrypting backups after FBI complained

#264

Post by EGreg »

shadowgovt wrote: post #76
EGreg wrote: post #59

Earlier quoted context omitted.

Tell you what. The minute the entire government and FBI start recording their activities openly on an immutable blockchain, or at least every police officer wears a bodycam on-duty, we can talk about handing over keys for all citizen data being open to said government. But still hard to search and index en masse. And same goes for every other government. Why should the government can do whatever they want secretly?

I can't speak for all governments, but in the US the National Archives has responsibility for recording the things the federal government undertakes on behalf of the people. This includes even the tapes Nixon made of his own conversations as President. The guiding principle the US government operates on in this context is "When a man assumes a public trust he should consider himself a public property" (Thomas Jeffers…

It’s only a matter of time before easy-to-use open source technology becomes available to everyone to host and they won’t need Apple to manage their data.

Unless you mean Apple should be actively trying to siphon off private data via their OS and hardware and index it for the feds?

I would then say Apple’s “trusted computing base” isn’t so trusted.

Re: Apple dropped plan for encrypting backups after FBI complained

#266

Post by zzzcpan »

zaroth wrote: post #218
zzzcpan wrote: post #190

Earlier quoted context omitted.

> There exists no magical way to provide a means of lost password/device recovery which doesn’t grant Apple access to decrypt your data. In modern times your face and your fingerprints could be that magic.

I’m not sure about that. Face and fingers are typically authentication mechanisms. They can grant access to a key, but they cannot themselves be the key. The thing doing the authentication can be your local device, or a cloud-device. That thing must necessarily store a validator for your face/fingerprints which it can use to decide your submitted capture is “close enough” to consider a match, after which it grants ac…

> They can grant access to a key, but they cannot themselves be the key.

My assumption is that device recovery is such a special case, that it can use very different algorithms than those used in phones today, they could be very computationally expensive and turn fingerprints into usable keys. And of course there is no need for anyone to store them or being able to match them individually or even just tie to an identity of a person.

Re: Apple dropped plan for encrypting backups after FBI complained

#267

Post by rootsudo »

_bxg1 wrote: post #206

> aboyt how much Apple cares about users No company cares about anything. A company is not a person. Apple, because of its privacy-marketing, is incentivized to be the privacy player in the market. But only so far as consumers keep them honest about it. They got away with this loophole because it stayed under the radar; if it gets enough attention and enough customers show that it matters to them, it could change. On…

But a corporation is a person.

Re: Apple dropped plan for encrypting backups after FBI complained

#268

Post by fma »

ghaff wrote: post #252
ogre_codes wrote: post #243

Earlier quoted context omitted.

Pretty much this. It's a bit of a PITA, but an easy work around. Of course then you have a local backup on a hard drive which is itself subject to seizure and I believe even encrypted backups can be cracked.

The other thing that’s a bit of a problem as I discovered is it doesn’t seem as if there’s any documented way (and I’m wary of undocumented workarounds) to have this backup anywhere but your boot drive. Especially with several OS X devices this can be a bit of a problem if you have an older undersized SSD. I was getting critically low on space and it turned out a huge amount was these backups.

There's a workaround to point the local folder to anywhere via a symbolic link (in my case, a NAS).

https://reincubate.com/support/how-to/change-itunes-backup-l...

Re: Apple dropped plan for encrypting backups after FBI complained

#269

Post by Ajedi32 »

zaarn wrote: post #196
Ajedi32 wrote: post #186

Earlier quoted context omitted.

Long-term, there may eventually come a solution to this problem in the form of [binary transparency]( https://wiki.mozilla.org/Security/Binary_Transparency ). However, we're obviously a long way away from that being the norm, and there's still the problem of supply-chain attacks on hardware to consider.

I doubt the hardware supply chain can ever be secured. Even if you were to open-source every single part of manufacturing, there is no reliable way to ensure that the chip you, as a customer, have obtained, hasn't been backdoored. You'd have to delid it and put it under an X-Ray if that even resolves the tiny featuresin modern CPUs.

With an open hardware design, periodically de-liding and examining a random sample of available consumer hardware would probably sufficient to protect the general consumer population, and targeted attacks become very difficult if you purchase your hardware from a store rather than order it by mail.

Even so I agree that examining all hardware in that manner is impractical. A better approach might be having a small, simpler core of secure open-source hardware managing your root of trust, and trying our best to mitigate the impact of compromises in the more complicated components (like the motherboard, CPU, etc) with approaches such as requiring open source firmware, sandboxing individual components by filtering their external communications through open hardware, and limiting their access to sensitive data like encryption keys. Obviously there's only so far you can go with that, but I don't think it's an entirely hopeless battle either.

It's a very interesting problem for sure.

Re: Apple dropped plan for encrypting backups after FBI complained

#270

Post by GeekyBear »

ghaff wrote: post #252
ogre_codes wrote: post #243

Earlier quoted context omitted.

Pretty much this. It's a bit of a PITA, but an easy work around. Of course then you have a local backup on a hard drive which is itself subject to seizure and I believe even encrypted backups can be cracked.

The other thing that’s a bit of a problem as I discovered is it doesn’t seem as if there’s any documented way (and I’m wary of undocumented workarounds) to have this backup anywhere but your boot drive. Especially with several OS X devices this can be a bit of a problem if you have an older undersized SSD. I was getting critically low on space and it turned out a huge amount was these backups.

I haven't run into any trouble backing up to spinning rust.

>How to move your iPhone or iPad backups to an external hard drive

https://www.imore.com/how-move-your-iphone-or-ipad-backups-e...

Post reply on HN