Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple: Android is a tracking device [pdf]

justice.gov

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Apple: Android is a tracking device [pdf]

#71

Post by svvvy »

Frost1x wrote: post #52
boxed wrote: post #39

Earlier quoted context omitted.

Talk about a false equivalency. One has spying built into the business model itself. The other does not.

The thing about business models is they are in never-ending flux, always shifting, optimizing, and re-optomizing seeking the most profitable model(s). If you have some business model either coincidentally or intentionally in alignment of consumer privacy, you're going to see marketing said alignment so long as it's a potential selling point (if it's not, it wont be advertised unless you can spin it). It doesn't mean…

Maybe I don't understand your point, but isn't this similarly false equivalency? The business models are for-profit and subject to change. But despite that, right now, there is a material difference in privacy.

Also I think it a bit humorous - "privacy tax" to me is when services like Google offer services at a cost to my privacy.

Re: Apple: Android is a tracking device [pdf]

#72

Post by hulitu »

bilekas wrote: post #41
alpaca128 wrote: post #28

Earlier quoted context omitted.

On the flipside e.g. in Germany this has been used to track down creators of illegal graffiti, using a law that is intended for terrorism and other heavy crimes. We can allow search and rescue missions without having to also accept abuse of power.

Can you reference anywhere where that happened because I've never heard of that and would expect huge pushback in Europe in general..

> would expect huge pushback in Europe in general..

In general those things are not made public so that you don't have pushbacks.

Re: Apple: Android is a tracking device [pdf]

#73

Post by rekoil »

realusername wrote: post #70
brookst wrote: post #17

Earlier quoted context omitted.

How do you square that claim with E2EE and the way Find My works?

E2EE arrived very very late and is even off by default. Anybody you are messaging to is going to have E2EE off and their backup data sent to the US government for analysis (see PRISM revelations which Apple participated to). Since you can't get iMessage without iCloud (at least to my knowledge) it's one of the most problematic messaging platform out there because of that. For Find My, since they can even locate switc…

I'll give you that E2EE arrived late and is off by default. But:

> For Find My, since they can even locate switched off phones

They can't. Find My is actually truly end-to-end encrypted, at least the version used for when a device is off (I'm not 100% sure how encrypted the self-reported version is for powered on iPhones with data).

Copy-pasting my summary about how Find My works from another comment in this post:

> The master private key used by the system is generated locally and never leaves your Apple devices in a state that anyone except your devices can read it.

> The master key is used to derive an AirTag specific private key which is provisioned to the AirTag and is in turn combined with an increasing counter which generates a third private key that's never stored anywhere. The ID broadcast is the public key of this third key. It changes every 30 minutes or 1 hour, I forget which.

> Other devices see this key, use it to encrypt their own location, and upload that encrypted blob along with the public key to Find My, and in order for Apple to even know which account the encrypted blob they can't decrypt belongs to I have to actually request the location of my AirTag by locally deriving the keypair it used for a certain point in time.

This has all been proven through [1] where they read the whitepaper (which I can't for the life of me find now but know exist because I've read it, or at least parts) and implemented OpenHaystack which proves Apple aren't lying about anything because if they did then OpenHaystack wouldn't work.

1: https://github.com/seemoo-lab/openhaystack

Re: Apple: Android is a tracking device [pdf]

#74

Post by RistrettoMike »

lutrinus wrote: post #10
RistrettoMike wrote: post #7

Title could probably use a “2013”

It hasn’t changed though, has it?

I guess my point is that I think even Apple likely has different policies or talking points around this now as opposed to a decade ago. Probably some more and some less troublesome than what's shown here.

Re: Apple: Android is a tracking device [pdf]

#75

Post by realusername »

rekoil wrote: post #73
realusername wrote: post #70

Earlier quoted context omitted.

E2EE arrived very very late and is even off by default. Anybody you are messaging to is going to have E2EE off and their backup data sent to the US government for analysis (see PRISM revelations which Apple participated to). Since you can't get iMessage without iCloud (at least to my knowledge) it's one of the most problematic messaging platform out there because of that. For Find My, since they can even locate switc…

I'll give you that E2EE arrived late and is off by default. But: > For Find My, since they can even locate switched off phones They can't. Find My is actually truly end-to-end encrypted, at least the version used for when a device is off (I'm not 100% sure how encrypted the self-reported version is for powered on iPhones with data). Copy-pasting my summary about how Find My works from another comment in this post: >…

I'm aware that for airtags, the implementation should not be too bad. I'm talking about iPhone which are much more important.

They can also be tracked close to real time with their gps coordinates so it cannot be passive, the phone has to report somewhere. And it's reporting in the background, there's no indication that its doing it.

Re: Apple: Android is a tracking device [pdf]

#76

Post by boxed »

Frost1x wrote: post #52
boxed wrote: post #39

Earlier quoted context omitted.

Talk about a false equivalency. One has spying built into the business model itself. The other does not.

The thing about business models is they are in never-ending flux, always shifting, optimizing, and re-optomizing seeking the most profitable model(s). If you have some business model either coincidentally or intentionally in alignment of consumer privacy, you're going to see marketing said alignment so long as it's a potential selling point (if it's not, it wont be advertised unless you can spin it). It doesn't mean…

> The thing about business models is they are in never-ending flux, always shifting, optimizing, and re-optomizing seeking the most profitable model(s).

Googles hasn't since the start. It's ads. Which leads to abuse and spying.

Re: Apple: Android is a tracking device [pdf]

#77

Post by kopollo »

eimrine wrote: post #33
cultureswitch wrote: post #25

I'd rather have Apple's hypocritical "only we may spy on our users" approach than Google's. But anyway, I use GrapheneOS.

Why is Apple's approach better and what is really different?

What's wrong with someone watching us? Aren't we already competing on social media to show where we are

Re: Apple: Android is a tracking device [pdf]

#78

Post by rekoil »

realusername wrote: post #75
rekoil wrote: post #73

Earlier quoted context omitted.

I'll give you that E2EE arrived late and is off by default. But: > For Find My, since they can even locate switched off phones They can't. Find My is actually truly end-to-end encrypted, at least the version used for when a device is off (I'm not 100% sure how encrypted the self-reported version is for powered on iPhones with data). Copy-pasting my summary about how Find My works from another comment in this post: >…

I'm aware that for airtags, the implementation should not be too bad. I'm talking about iPhone which are much more important. They can also be tracked close to real time with their gps coordinates so it cannot be passive, the phone has to report somewhere. And it's reporting in the background, there's no indication that its doing it.

Admittedly I have nothing to back this up, but judging by how well designed Find My is in this aspect, I'd be surprised if the implementation for the self-reporting one is that much worse, I suspect the re-did it in iOS 13 when Find My launched.

Was it ever possible to access your iPhones location through iCloud.com? I know Find My Friends was available there, but I don't remember if "Find My iPhone" was.

Re: Apple: Android is a tracking device [pdf]

#79

Post by sotix »

crossroadsguy wrote: post #49
imglorp wrote: post #21

Earlier quoted context omitted.

Forget about all the app and OS, maybe they're clean and maybe not. There's also the cell layer, which constantly negotiates with cell towers for sector and power as normal idling. So they know your location at least to tower (CGI), sector and delay (CGITA) and sometimes trilaterated (UTDOA) from ~1000m down to 10m accuracy. The towers' base station controllers need to keep logs anyway, so the cell company has record…

And when the SIM card will be gone, isn’t it gone already in USA for iPhones, you won’t even have the ability to remove that SIM. And you can be tracked all the time. Because we are already there - your phone is switched of but not really switched off.

My understanding is that modern phones still connect to cell towers without a SIM card in the device to allow for emergency calls.

Re: Apple: Android is a tracking device [pdf]

#80

Post by RockRobotRock »

fsflover wrote: post #66
RockRobotRock wrote: post #31

Earlier quoted context omitted.

Apple sells expensive hardware and Google sells ads and data. I agree that we will never know for sure what Apple does, but follow the incentives and you will know which company has more to lose.

https://news.ycombinator.com/item?id=34299433

damn
Post reply on HN