Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple dropped plan for encrypting backups after FBI complained

reuters.com

Post reply on HN
Print view View original

311–320 of 734 posts

Re: Apple dropped plan for encrypting backups after FBI complained

#311

Post by 0xff00ffee »

TruthSHIFT wrote: post #301
mrtksn wrote: post #57

Apple has a list for that: https://support.apple.com/en-us/HT202303 These are end to end: Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information QuickType Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords The messages also end to end but the backup contains the private key. The moral of…

Have they updated that page? Backups are the very first thing on the list.

Right? I'm so confused now. That link appears to be opposite of the article.

Re: Apple dropped plan for encrypting backups after FBI complained

#312

Post by Cyberdog »

ogre_codes wrote: post #243
GeekyBear wrote: post #207

>there's no good and easy option to backup your phone other than iCloud. Turn off iCloud and do local encrypted backups to your PC or Mac. This works over your wifi network (if you prefer wireless charging at home) or via a cable connection.

Pretty much this. It's a bit of a PITA, but an easy work around. Of course then you have a local backup on a hard drive which is itself subject to seizure and I believe even encrypted backups can be cracked.

> I believe even encrypted backups can be cracked.

If anything, they're more prone to being cracked, since an attacker can load the backup onto a very fast system and run custom software which can run many permutations of keys against the backup to try to unlock it. With actual hardware, they're limited by having to manually enter the key in most cases plus any hardware or OS features which would notice that the user has entered too many incorrect passwords and lock down the device further.

On the other hand, if the computer that your backup has been backed up to is itself reasonably locked down, that might be an acceptable trade-off; they can't try to crack a backup they can't access in the first place.

Re: Apple dropped plan for encrypting backups after FBI complained

#313

Post by jxdxbx »

A completely e2e encrypted backup system would have to include photos (current iPhone backups do not). But true encryption means that when customers forget their passwords, they lose their data.

Already, people who don't use iCloud Photo Library and lose their phones, or forget their passwords, lose the photos that were on the phones.

Anyway, I think the customer experience issues weigh pretty heavily here.

Re: Apple dropped plan for encrypting backups after FBI complained

#314

Post by novok »

mrtksn wrote: post #57

Apple has a list for that: https://support.apple.com/en-us/HT202303 These are end to end: Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information QuickType Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords The messages also end to end but the backup contains the private key. The moral of…

So do you need to decrypt the backup of your iMessages to get to the private key inside of it, or can apple see your private iMessage keys in the backup without needing to decrypt anything?

Re: Apple dropped plan for encrypting backups after FBI complained

#315

Post by berkes »

giancarlostoro wrote: post #225
_bxg1 wrote: post #206

> aboyt how much Apple cares about users No company cares about anything. A company is not a person. Apple, because of its privacy-marketing, is incentivized to be the privacy player in the market. But only so far as consumers keep them honest about it. They got away with this loophole because it stayed under the radar; if it gets enough attention and enough customers show that it matters to them, it could change. On…

> On the other hand, it's possible that because we have a smartphones duopoly, Apple only needs to maintain a position where people will say "well at least it's not as bad as Google". I'm upset about this personally, but I'm not ditching my iPhone. Of course, this does cement my decision to never pay for iCloud, for what that's worth (much less, but not nothing). Agreed, and I am likely going away from Android and in…

I'd argue that Android, without the Google stuff, is still the best option if you care about privacy and security.

This is not accessible for average Joe, but I'm pretty certain the majority of readers here can use the tools to load an alternative ROM. That you can enable and use F-droid just fine. And are knowledgeable enough to know what apps to avoid.

Re: Apple dropped plan for encrypting backups after FBI complained

#316

Post by vkou »

_bxg1 wrote: post #206

> aboyt how much Apple cares about users No company cares about anything. A company is not a person. Apple, because of its privacy-marketing, is incentivized to be the privacy player in the market. But only so far as consumers keep them honest about it. They got away with this loophole because it stayed under the radar; if it gets enough attention and enough customers show that it matters to them, it could change. On…

> No company cares about anything. A company is not a person.

You're splitting hairs over the definition of 'cares'. I think we all understand what that word means in this context.

Re: Apple dropped plan for encrypting backups after FBI complained

#317

Post by seagullz »

rootsudo wrote: post #267
_bxg1 wrote: post #206

> aboyt how much Apple cares about users No company cares about anything. A company is not a person. Apple, because of its privacy-marketing, is incentivized to be the privacy player in the market. But only so far as consumers keep them honest about it. They got away with this loophole because it stayed under the radar; if it gets enough attention and enough customers show that it matters to them, it could change. On…

But a corporation is a person.

The inconsistency in that is telling. Corporations demand the rights of persons, yet do not tend to shoulder the responsibilities that come with it [0]. Given how gigantic they are, the consequences are way too costly for the society.

[0] https://www.theatlantic.com/politics/archive/2015/02/if-corp...

Re: Apple dropped plan for encrypting backups after FBI complained

#318

Post by 8ytecoder »

GeekyBear wrote: post #207

>there's no good and easy option to backup your phone other than iCloud. Turn off iCloud and do local encrypted backups to your PC or Mac. This works over your wifi network (if you prefer wireless charging at home) or via a cable connection.

While it doesn't justify that it's not encrypted in the cloud, you are right that Apple does provide a way to encrypt the backups locally:

https://support.apple.com/en-afri/HT203977#computer

https://support.apple.com/en-us/HT205220

Re: Apple dropped plan for encrypting backups after FBI complained

#319

Post by parthdesai »

tomc1985 wrote: post #300
natch wrote: post #230

Earlier quoted context omitted.

As someone who has bought into that meme I will admit this feels like a pretty huge betrayal by Apple. So, yes, I think if Apple sticks with this, their whole privacy stance is going in the toilet now. And a very dirty toilet it is. Beyond just the facts of not protecting data, there is also the deception. This is some really very, very, nasty stuff for Apple's brand and the reputation of every person who works at Ap…

Yeah, but what are the reasonable alternatives? Android, with its freewheeling stance on privacy and app permissions? Do they even let you disable location tracking any more?

No, but Android/Google doesn't go out and advertise themselves as a privacy first company.

Re: Apple dropped plan for encrypting backups after FBI complained

#320

Post by Cyberdog »

anoncake wrote: post #254
dfee wrote: post #241

Earlier quoted context omitted.

Why the distinction on for-profit? There are plenty of non-profits you shouldn’t trust. Surely their tax status is orthogonal to their trustability.

You can trust an organization to do some mix of pursuing its goals and filling someone's pockets. So while you can trust some non-profits, you can never trust a for-profit about anything you care about as a customer.

Taking this argument to its logical conclusion, you can't trust eating food someone grew for profit, riding in a car someone built for profit, wearing clothes someone made for profit…

Under capitalism, encouraging repeat business from a customer is a successful long-term strategy, and maintaining customer satisfaction by not selling them food that will make them sick, cars that have faulty brakes, clothes that deteriorate in the rain, or so on is part of that. So if I purchase a product from a company that's been around for a while, I can have a reasonable expectation - a trust - that that product will be of some quality.

Post reply on HN