Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Photos phones home on iOS 18 and macOS 15

lapcatsoftware.com

Post reply on HN
Print view View original

71–80 of 1001 posts

Re: Apple Photos phones home on iOS 18 and macOS 15

#71

Post by walterbell »

dev_tty01 wrote: post #43
walterbell wrote: post #16

> On macOS, I can usually prevent Apple software from phoning home by using Little Snitch. Unfortunately, Apple doesn't allow anything like Little Snitch on iOS. On Android, NetGuard uses a "local VPN" to firewall outgoing traffic. Could the same be done on iOS, or does Apple network traffic bypass VPNs? Lockdown mentions ads, but not Apple servers, https://lockdownprivacy.com/ . Apple does publish IP ranges for diff…

>On Android, NetGuard uses a "local VPN" to firewall outgoing traffic. Could the same be done on iOS, or does Apple network traffic bypass VPNs? Lockdown mentions ads, but not Apple servers, https://lockdownprivacy.com/ . Why is NetGuard more trustworthy than Apple?

NetGuard firewall doesn't run on iOS, so there's no point in comparing to Apple. For those on Android, NetGuard is open-source, https://github.com/M66B/NetGuard

On iOS, Lockdown firewall is open-source, https://github.com/confirmedcode/Lockdown-iOS

Re: Apple Photos phones home on iOS 18 and macOS 15

#72

Post by walterbell »

JustExAWS wrote: post #46
walterbell wrote: post #39

Earlier quoted context omitted.

Some iOS apps synchronize data with standard protocols (e.g. IMAP, WebDAV, CalDAV) to cloud or self-hosted services.

And that doesn’t help with internally stored data within apps, settings, which apps you have installed on what screen, passwords, etc

iOS supports local device backups.

Re: Apple Photos phones home on iOS 18 and macOS 15

#73

Post by latexr »

CapcomGo wrote: post #70
latexr wrote: post #35

Earlier quoted context omitted.

> This is what a coverup looks like. That’s starting to veer into unreasonable levels of conspiracy theory. There’s nothing to “cover up”, the feature has an off switch right in the Settings and a public document explaining how it works. It should not be on by default but that’s not a reason to immediately assume bad faith. Even the author of the article is concerned more about bugs than intentions.

Sure it is. This isn't a feature or setting that users check often or ever. Now, their data is being sent without their permission or knowledge.

Which is wrong but doesn’t make it a coverup, which by definition assumes trying to hide evidence of wrongdoing.

Re: Apple Photos phones home on iOS 18 and macOS 15

#74

Post by TYPE_FASTER »

I think the user should be prompted to enable new functionality that sends data to the cloud. I think there should be a link to details about which data is being sent, how it is being transmitted, if it is stored, if it is provided to 3rd-parties, and what is being done with it.

Maybe this is exactly what the GDPR does. But it is what I would appreciate as a user.

I have seen how sending metrics and crash dumps from a mobile device can radically improve the user experience.

I have also seen enough of the Google bid traffic to know how much they know about us.

I want to enable sending metrics, but most of the time it's a radio button labeled "metrics" and I don't know what's going on.

Re: Apple Photos phones home on iOS 18 and macOS 15

#75

Post by scosman »

ustad wrote: post #67
scosman wrote: post #11

"I don't understand most of the technical details of Apple's blog post" I do: - Client side vectorization: the photo is processed locally, preparing a non-reversible vector representation before sending (think semantic hash). - Differential privacy: a decent amount of noise is added the the vector before sending it. Enough to make it impossible to reverse lookup the vector. The noise level here is ε = 0.8, which is q…

You're presenting a false dichotomy between "perfect user understanding" and "no user choice." The issue isn't whether users can fully comprehend homomorphic encryption or differential privacy – it's about basic consent and transparency. Consider these points: 1. Users don't need a PhD to understand "This feature will send data about your photos to Apple's servers to enable better search." 2. The complexity of the pr…

I don't believe I said or implied that anywhere: 'You're presenting a false dichotomy between "perfect user understanding" and "no user choice."'? Happy to be corrected if wrong.

Closest I come to presenting an opinion on the right way UX was "I'm not sure what the right call is here.". The thing I disagreed with was a technical statement "the only way to guarantee computing privacy is to not send data off the device.".

Privacy respecting design and tech is a passion of mine. I'm pointing out "user choice" gets hard as the techniques used for privacy exceed the understanding of users. Users can intuitively understand "send my location to Google [once/always]" without understanding GPS satellites. User's can't understand the difference between "send my photo" and "send homomorphicly encrypted locally differentially private vector of e=0.8" and "send differentially private vector of e=50". Your prompt "send data about your photos..." would allow for much less private designs than this. If we want to move beyond "ask the user then do it", we need to get into the nitty gritty details here. I'd love to see more tech like this in consumer products, where it's private when used, even when opted-in.

Re: Apple Photos phones home on iOS 18 and macOS 15

#76

Post by stackghost »

JustExAWS wrote: post #66
stackghost wrote: post #61

Earlier quoted context omitted.

Do you use a phone?

Yes. I also don’t use Plex, have my own file syncing service running, run my own email server, etc. I also don’t run a private chat server that people log into - I’m like most of the iPhone and Android using world

Maybe lay off the sanctimonious attitude then.

Re: Apple Photos phones home on iOS 18 and macOS 15

#77

Post by [deleted] »

JustExAWS wrote: post #59
Gabriel54 wrote: post #38

Earlier quoted context omitted.

In response to your question in the parent comment, no, I do not use iCloud. And I do not sync any of the things you mentioned here. If someone already consented to using iCloud to store their photos then I would not consider the service mentioned this post to be such a big issue, because Apple would already have the data on their servers with the user's consent. edit: I will just add, even if we accept the argument…

Do you start fresh with an iOS installation after each upgrade or do you back up your iPhone using your computer and iTunes?

[deleted]

Re: Apple Photos phones home on iOS 18 and macOS 15

#78

Post by jazzyjackson »

oneplane wrote: post #57
lysace wrote: post #32

Earlier quoted context omitted.

> - OHTTP relay: it's sent through a 3rd party so Apple never knows your IP address. The contents are encrypted so the 3rd party never doesn't learn anything either (some risk of exposing "IP X is an apple photos user", but nothing about the content of the library). Which 3rd party is that?

I don't have a list on hand, but at least Cloudflare and Akamai are part of the network hops. Technically you only need 2 hops to make sure no origin or data extraction can be done.

O good, cloudflare gets one more data point on me, a ping every time I add a photo to my library.

Re: Apple Photos phones home on iOS 18 and macOS 15

#79

Post by jazzyjackson »

oneplane wrote: post #53
gigel82 wrote: post #41

Earlier quoted context omitted.

The "network" mention was in reply to your comment about "participating in a network" which was never the case for one's personal photos (unless explicitly shared on a social network I guess). I did read the article, yes :) Maybe our photos are not sent bit-by-bit but enough data from the photos is being sent to be able to infer a location (and possibly other details) so it is the same thing: my personal data is bein…

No, your photos aren't sent, also not 'pieces' of it. They are creating vector data which can be used to create searchable vectors which in turn can be used on-device to find visual matches for your search queries (which are local). You can imagine it as hashes (created locally), some characters of that hash from some random positions being used to find out if those can be turned into a query (which is compute intens…

My understanding as the blog laid it out was that the cloud service is doing the vector similarity search against a finite database of landmark feature vectors, but they are performing that mathematical function under homomorphic encryption such that the result of the vector comparison can only be read with a key that never left your device, so it's just adding a tag "Eiffel tower" that only you see, but the feature vector is sent off device, it's just never able to be read by another party.

Re: Apple Photos phones home on iOS 18 and macOS 15

#80

Post by lapcat »

scosman wrote: post #75
ustad wrote: post #67

Earlier quoted context omitted.

You're presenting a false dichotomy between "perfect user understanding" and "no user choice." The issue isn't whether users can fully comprehend homomorphic encryption or differential privacy – it's about basic consent and transparency. Consider these points: 1. Users don't need a PhD to understand "This feature will send data about your photos to Apple's servers to enable better search." 2. The complexity of the pr…

I don't believe I said or implied that anywhere: 'You're presenting a false dichotomy between "perfect user understanding" and "no user choice."'? Happy to be corrected if wrong. Closest I come to presenting an opinion on the right way UX was "I'm not sure what the right call is here.". The thing I disagreed with was a technical statement "the only way to guarantee computing privacy is to not send data off the device…

The choice is between "use an online service" or "don't use an online service". That's simple enough for anyone to understand.

Apple can try to explain as best it can how user data is protected when they use the online service, and then the user makes a choice to either use the service or not.

In my case, I have don't even have a practical use for the new feature, so it's irrelevant how private the online service is. As it is, though, Apple silently forced me to use an online service that I never wanted.

Post reply on HN