131–140 of 355 posts
Apple has always been a gated community, but now there’s a guard at the gate checking everything that goes in and out. This is something most users probably don’t want. It has me personally considering what a future without Apple would look like.
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
Most "alarmist" articles have two points you cannot really ignore, not if you don't want to end up living in interesting times one day. 1) Even plain access logs — basically what a HTTP request, or a TCP connection can tell you — is a lot . Gather those for a couple of days, and you have a good map of the user. More so if you have an ID of machine and the actual executable hash. 2) "But we are the good guys" is a non…
Earlier quoted context omitted.
Isn’t OCSP an open standard for handling certificate revocations? The standard specifies plaintext, because the standard can’t assume that the client has a way to form an encrypted connection to the revocation list.
Wouldn't an anonymity scheme such as [1] work in this context? Send only part of the hash of the app's certificate, and have the server send you all possible revoked certificates? [1]: https://blog.cloudflare.com/validating-leaked-passwords-with...
Earlier quoted context omitted.
Their iMessage situation?
They backup the private key to iCloud unless you manually disable backups. So even though iMessage is advertised as E2E encrypted, for the vast majority of users, Apple can read each and every message. (And even if you disable backups, Apple can still read most if not all of your messages, because the persons on the other side of the conversations have not disabled backups)
This is the reason people laugh at this website.
Earlier quoted context omitted.
And their participation in PRISM https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...
What does "participation" in PRISM mean? > Apple: "We have never heard of PRISM"[115] "We do not provide any government agency with direct access to our servers, and any government agency requesting customer data must get a court order."[115] * https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%... Certainly American companies are subjects to warrants and NSLs, but Google (to give one example) had its dark f…
No, that's a separate thing. They do both. See the "you should use both" slide.
https://github.com/iamcryptoki/snowden-archive/blob/master/d...
As to the apple claims that they didn't participate in PRISM, I think they were just lying. Clapper lied to congress as well, so this isn't unheard of. They would likely have breached their government contract by telling the truth. That being said, them having never heard about the program name might be true because it might not have been known to them under that name, but that's just a detail.
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
Isn’t OCSP an open standard for handling certificate revocations? The standard specifies plaintext, because the standard can’t assume that the client has a way to form an encrypted connection to the revocation list.
Even doing unauthenticated TLS is better than what they do now, because the current situation allows for full passive monitoring.
Earlier quoted context omitted.
I think there were aspects of PRISM that required cooperation from providers like Google. Like the NSA would send queries to them and they would return emails or what have you that match those queries. Though of course this “cooperation” is required by law.
If there's a court order, (FISA: https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveilla... , or otherwise) companies have to comply. So I don't really see how one can blame a any company for that.
Earlier quoted context omitted.
> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816
if they keep doing like this I will block their entire ASN .
Earlier quoted context omitted.
I don't quite understand why anyone would send data in clear text anymore, let alone Apple.
It's explained in the article, there's a loop if you want to verify a certificate and you need the certificate to verify the certificate
Apple knows this. They have cryptography experts.
Taken in context with their backdooring of their e2e messenger and collaboration with military intelligence on FISA 702, I tend not to give them the benefit of the doubt any longer. Apple knows how to take pcaps.
There are only so many times the OS design gets to leak either keys or plaintext remotely before you need to stop assuming ignorance over malice.
I don’t know how many times that is, but it’s less than ten, probably less than 5, and because it’s a count of legitimate “assume ignorance”, then “goto fail”[2] also counts in the tally.
Between this OCSP plaintext telemetry leak, and iMessage default key escrow, scrapping their plan for e2e backups at the behest of the FBI that fixes the key escrow backdoor[3], and “goto fail” not authenticating TLS, we’re at 4.
I’m not even counting the recent story about Apple’s history of willing collaboration with intelligence agencies to make a custom classified firmware for the iPod to aid in espionage.[1]
As Goldfinger’s famous saying goes: “Once is happenstance. Twice is coincidence. The third time it’s enemy action.”
[1]: https://news.ycombinator.com/item?id=24212520
[2]: https://www.zdnet.com/article/apples-goto-fail-tells-us-noth...
[3]: https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...