121–130 of 355 posts
There will be a day when all apps on a mac will only be installable from the app store. Developers will be forced to buy macs and subscribe to Apple’s developer program to support it. Customers will be trained to not care. And HN Apple fanboys and fangirls will try to justify why this is a Good Thing(TM).
Earlier quoted context omitted.
I don't quite understand why anyone would send data in clear text anymore, let alone Apple.
It's explained in the article, there's a loop if you want to verify a certificate and you need the certificate to verify the certificate
There will be a day when all apps on a mac will only be installable from the app store. Developers will be forced to buy macs and subscribe to Apple’s developer program to support it. Customers will be trained to not care. And HN Apple fanboys and fangirls will try to justify why this is a Good Thing(TM).
We’ve been hearing that for years, yet it hasn’t happened. Apple seems to recognize the value of the Mac as an general computing platform.
They just keep making stuff not private so you have to choose between security versus privacy.
A well thought system would be able to provide both.
Earlier quoted context omitted.
They backup the private key to iCloud unless you manually disable backups. So even though iMessage is advertised as E2E encrypted, for the vast majority of users, Apple can read each and every message. (And even if you disable backups, Apple can still read most if not all of your messages, because the persons on the other side of the conversations have not disabled backups)
Can Apple read your iCloud storage? I’m not saying that it is, but shouldn’t that be encrypted at rest with a customer-specific key?
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Earlier quoted context omitted.
I think there were aspects of PRISM that required cooperation from providers like Google. Like the NSA would send queries to them and they would return emails or what have you that match those queries. Though of course this “cooperation” is required by law.
If there's a court order, (FISA: https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveilla... , or otherwise) companies have to comply. So I don't really see how one can blame a any company for that.
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
> I don't follow the "browsers and loops" argument. To log in to my banking account, I need the correct password. No problem, I keep it in a password manager. To open the password manager, I need the correct password. No problem, I keep it in a password manager. To open the password manager, I need the correct password. No problem, I keep it in a password manager. To open the password manager, I need the correct pass…
Technically what I’m describing is that you can vary the behaviour of OCSP lookups such that if you’re already looking up an OCSP certificate to establish an SSL connection to an OCSP server, downgrade and check over HTTP only when trying to connect to the OCSP server itself. Yes, it would mean one more TLS connection to a random server. Yes, it would mean an extra OCSP lookup. But just one, and just for the OCSP server itself. Which means privacy is preserved in regards to which developer certificate you’re checking. It would be only checking Apple’s OCSP server certificate in the clear, which it could equally cache easily.
Earlier quoted context omitted.
It's explained in the article, there's a loop if you want to verify a certificate and you need the certificate to verify the certificate
Check server certificate OCSP first, send subsequent queries via SSL.
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
Isn’t OCSP an open standard for handling certificate revocations? The standard specifies plaintext, because the standard can’t assume that the client has a way to form an encrypted connection to the revocation list.
Apple has always been a gated community, but now there’s a guard at the gate checking everything that goes in and out. This is something most users probably don’t want. It has me personally considering what a future without Apple would look like.