Apple’s Tim Cook Delivers Blistering Speech on Encryption, Privacy

> For years we’ve offered encryption services like iMessage and FaceTime because we believe the contents of your text messages and your video chats is none of our business.

Sounds great, but take note that it's none of their business today and we know they can be compelled to spy on their users by NSLs.

They control the key infrastructure with their closed-source software that runs on their closed-source hardware.

If they wanted to go into the business of sucking up all of your private messages and parsing them to sell advertising or if the government wants to read some messages, they wouldn't need to do anything besides issue you a different key.

iMessage won't even let you look at the fingerprints of your friends, and it won't warn you if they've changed. [1]

[1] http://blog.quarkslab.com/imessage-privacy.html

This is marketing folks. Apple's behavior towards Google changed dramatically after Android starting getting traction, and this sudden pivot towards pro-privacy is an Apple's attempt to damage the reputation of it's biggest competitor. Apple hasn't been consistently speaking with the same voice on privacy, both before or after Snowden, and Tim Cook's comments IMHO look cynically designed.

Apple collects plenty of personal data in their cloud services:

1) iTunes and App Stores can track your browsing and purchase data. This is likely used to model and create profiles of your app store behavior so as to revenue maximize what's offered or displayed to you as alternate suggestions for what you might like.

2) Their streaming media services will have data on music preferences. Beats Audio will know whether you like Classic Rock or Jazz, or Beyonce.

3) iCloud Photo Library is not encrypted client side in a way that prevents Apple from decrypting it on the server, so like Google Photos, Apple will have your photos. Apple is not good with cloud services, it's their weak point, so naturally their incentives are to argue against better competing services.

4) iOS ecosystem is freemium based and there are tons of iOS apps in the store that show apps or collect analytic data. You can't claim to value privacy, run a walled garden, and then let third parties collect data to make your ecosystem monetizable and viable. It's benefitting from data collection indirectly, but looking like you're clean.

Now, you can make an argument that you trust Apple more, and make the usual arguments about business model motives, but that's just arguing that Privacy doesn't matter as long as the person violating your privacy isn't monetizing it. Just because Apple isn't monetizing it now doesn't mean they won't later, especially if hardware revenue tops out. If your want total protection, you can't rely on "trust", you have to rely on not sending plaintext in the first place. That rules out iCloud as well.

Overall, Apple may be painting themselves into a corner like Google's "Don't be evil" phrase, where they go all-in on privacy claims so much, that people will over scrutinize any exceptions or violations of principle. When you cloak yourself in piety, people start looking for hypocrisy.

As an example of boxing ones self in, certain kinds of services simply are impractical to run completely client side right now, and homomorphic encryption/computation isn't there yet to make server side computations on ciphertext feasible for many types of services you'd want to offer.

Take for example, organizational assistance, image search, voice recognition. Apple can't improve it's Siri quality without getting actual voice samples from tons of users and storing them so they can use machine learning algorithms to improve accuracy. That's not really feasible to do completely client side. Likewise, if you're trying to train up an image clustering service, you could try running them on publicly published Flickr professional photos, but it won't give you a good sample of real world photos that people take.

Apple may be working on a Google Now service that runs locally, but this might be fundamentally limited in how good it, or Siri can get, and so Apple's ambitions of an intelligent assistant could be limited. Apple also may be working on a search engine, but fundamentally, the iPhone can't store the index for 40 billion documents, which means any search service they offer will have to send your queries to the server, which again, creates an audit trail.

My point is, you may agree with Apple's arguments, but other individuals have been making those philosophical arguments for ages -- those without $180 billion in cash and a huge empire of phones under assault from competitors -- so when Apple execs parade around talking about privacy, you should have the same skepticism you have for any other executive with a vested interest in hawking their products.

Think PayPal. The bank pays Apple Pay, Apple Pay pays the vendor. Google Wallet worked sort of like this through the dummy MasterCard card (MasterCard knew about the payment and the vendor, but not sure if it knew who you were).

But as Sophistifunk says, this would be an incredibly hard sell for an industry already extremely reluctant to team up with anyone or anything new.

I like the idea that doing the right thing can be profitable, and don't see why a business should be criticized for aligning interests with its customers. It's a better way to enforce privacy than laws.

I understand the sentiment. As a long time Mac user it just gets tiring to hear again and again that Macs are overpriced junk from people who have never used a Mac before.

But I also didn't understand the god germans line.