Apple dropped plan for encrypting backups after FBI complained • Hacker News Board

Re: Apple dropped plan for encrypting backups after FBI complained

#571

Post by artificial » Wed, Jan 22, 2020, 2:08 AM UTC

Proziam wrote: post #473

matwood wrote: post #414

Earlier quoted context omitted.

It has been known and talked about on HN for a long time that only certain things are E2E encrypted on iCloud. And, if full privacy was the goal, then either the user can only do local backups or no backups at all.

HN is among the most technologically-literate demographics in the world. Using HN as a control group to say that it's been 'known and talked about' is a bit disingenuous when we're the proverbial 1% who are in the know. Meanwhile, the other 99% are left trusting Apple's advertising.

Just to understand this better is it that Apple is misleading or the public is uninformed? Trusting 3rd parties should default to “others have access including law enforcement” behavior.

Re: Apple dropped plan for encrypting backups after FBI complained

#572

Post by alfiedotwtf » Wed, Jan 22, 2020, 2:12 AM UTC

thathndude wrote: post #541

mistersquid wrote: post #323

Earlier quoted context omitted.

> Wonder if this will help to kill a meme, aboyt how much Apple cares about users and what great values they have, how they're going to stand for the user, fight with governments, etc. In this instance, Apple decided to continue to not encrypt iCloud backups because, according to one source, > […] the company did not want to risk being attacked by public officials for protecting criminals, sued for moving previously…

If unencrypted iCloud back ups is the price for us getting to keep fully encrypted devices, so be it

If backups aren't encrypted, then neither is your device

Re: Apple dropped plan for encrypting backups after FBI complained

#573

Post by Teever » Wed, Jan 22, 2020, 2:22 AM UTC

DonaldPShimoda wrote: post #352

wnevets wrote: post #217

Earlier quoted context omitted.

>Wonder if this will help to kill a meme, aboyt how much Apple cares about users and what great values they have, Probably not. The keyboards on their laptops are barely functional but it doesn't stop people from saying how great they are.

> The keyboards on their laptops are barely functional This must be some definition of "barely functional" I'm unfamiliar with. I've had a mid-2017 MBP since they were released. Yeah, I had to get the keyboard replaced when some keys failed after a year, but at least they did it for free. Actually, overall I prefer this keyboard to the 2013 I had previously. I think their failure rate is unacceptable, but they are ce…

> Yeah, I had to get the keyboard replaced when some keys failed after a year

As a person who had to replace a microsoft ergonomic keyboard after 14 years and has never had to replace a laptop keyboard I would consider a laptop keyboard that was replaced after a year due to failed keys to qualify as 'barely functional.'

It's the 21st century. keyboards are a solved problem that should never fail. It's abject failure on the part of Apple for releasing a flagship laptop with such a comparatively shitty keyboard.

No keyboard should be failing at this point. Keyboards are a mature technology.

Re: Apple dropped plan for encrypting backups after FBI complained

#574

Post by scarface74 » Wed, Jan 22, 2020, 2:25 AM UTC

Does anyone who knows anything about Apple think they would approach the FBI before creating a new feature?

Re: Apple dropped plan for encrypting backups after FBI complained

#575

Post by _23sd » Wed, Jan 22, 2020, 2:31 AM UTC

scarface74 wrote: post #522

president wrote: post #517

Earlier quoted context omitted.

Tell me how you think public/private keys helps Apple from skirting Chinese law that stipulates that they must provide access to user data.

It doesn’t by itself - but you have neither shown that Apple has surreptitiously uploaded user’s private keys in China or that it was required to do so.

I think the overlooked answer in this conversation is that Apple doesn't need to modify their service for China at all. In in all countries, they hold the encryption keys for most user data. Only these things are E2E encrypted[1]:

    Home data
    Health data (requires iOS 12 or later) 
    iCloud Keychain (includes all of your saved accounts and passwords)
    Payment information
    QuickType Keyboard learned vocabulary (requires iOS 11 or later)
    Screen Time
    Siri information
    Wi-Fi passwords

You might say "what about iMessage". The link has that answer, too:

>Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices.

This means Apple can produce the data a government is looking for in virtually all cases, and that's probably good enough for China.

[1] https://support.apple.com/en-us/HT202303

Re: Apple dropped plan for encrypting backups after FBI complained

#576

Post by scarface74 » Wed, Jan 22, 2020, 2:32 AM UTC

lern_too_spel wrote: post #568

scarface74 wrote: post #550

Earlier quoted context omitted.

Apple clearly lists which data is e2e encrypted and which isn’t. The keys that encrypt e2e data is not stored on Apple’s servers.

And we were talking about iCloud data here. So why were you claiming the keys were on the device?

And that doesn’t make the statement untrue. Apple clearly lists which data stored on its servers are e2e encrypted. Those are all considered “iCloud data”.

Re: Apple dropped plan for encrypting backups after FBI complained

#577

Post by mirimir » Wed, Jan 22, 2020, 2:38 AM UTC

couchridr wrote: post #555

tomc1985 wrote: post #300

Earlier quoted context omitted.

Yeah, but what are the reasonable alternatives? Android, with its freewheeling stance on privacy and app permissions? Do they even let you disable location tracking any more?

My favorite apple deceptive practice: allowing you to think you have disabled Bluetooth, when all you have disabled is Your Own ability to use it. Merchant partners of apple can use it to finely track you.

Does that also apply to UWB?

Re: Apple dropped plan for encrypting backups after FBI complained

#578

Post by tbodt » Wed, Jan 22, 2020, 2:38 AM UTC

mirimir wrote: post #557

amluto wrote: post #544

Earlier quoted context omitted.

The iPhone is plenty open for this. You just need a computer. The rest is fully open source. https://www.libimobiledevice.org/

Does this work with current iOS? And it's not remote, and you must connect via USB-C, right?

Yes and yes. It's a reverse engineered version of what iTunes does.

Re: Apple dropped plan for encrypting backups after FBI complained

#579

Post by Silhouette » Wed, Jan 22, 2020, 2:46 AM UTC

scarface74 wrote: post #554

Silhouette wrote: post #549

Earlier quoted context omitted.

Is there a specialised protocol for all types of data stored on iOS devices? Probably not. But plenty of other models of phone, tablet, camera and other data-processing devices manage to communicate just fine with Windows (or Linux or macOS) using generic protocols as USB mass storage devices, there is little excuse for iOS devices not to. In fact, you actually can download your photos and videos from an iPhone to a…

So while it is “communicating” with iPhones. What exactly is it suppose to communicate over standard protocols that would alleviate the need for an application and still perform all of the functions of iTunes? What other devices perform all of the backup, restore, and os upgrade, functionality of iTunes. The iPhone doesn’t use the standard “usb mass storage” protocol to allow you to download pictures. It uses the pic…

What other devices perform all of the backup, restore, and os upgrade, functionality of iTunes.

I've never claimed anything about any other functions of iTunes. I just said it was a problem that Apple devices make it difficult to get your data off using only local transfer.

The iPhone doesn’t use the standard “usb mass storage” protocol to allow you to download pictures. It uses the picture transfer protocol.

Yes, exactly like your camera, as I said.

Re: Apple dropped plan for encrypting backups after FBI complained

#580

Post by MereInterest » Wed, Jan 22, 2020, 2:49 AM UTC

welder wrote: post #409

MereInterest wrote: post #79

Earlier quoted context omitted.

Maybe this is me being out of touch with modern deployment, but that is absolutely not what my impression of "on the server" means. My mental model is that of a client, whatever software is under my control, and a server, which is whatever my client connects to. "Encrypted on the server" then means that at no point is the plaintext data visible to any part of the server. If Apple splits up the server into a web serve…

There's a difference in encrypted data at rest vs. end-to-end client side encryption. Encrypted data at rest protects against stolen physical storage devices. Without access to decryption key stored on a separate machine, you're unable to read data on the storage device. Encryption at rest doesn't protect users from the company, since the company has the decryption key. It protects your data if the company misplaces…

True, but I read a big distinction between "encrypted at rest" and "encrypted on the server". Encrypted at rest has the implications that you state, being there to prevent somebody from walking off with a hard drive. Encrypted on the server implies that it is never unencrypted while on the server, and that any server-side computation is done solely through homomorphic encryption.