Live data from Hacker News

Apple dropped plan for encrypting backups after FBI complained

reuters.com

161–170 of 734 posts

Re: Apple dropped plan for encrypting backups after FBI complained

#161
post #107

Earlier quoted context omitted.

General public are generally ignorant about risks in the tech they use. That doesn't mean they don't care about their privacy. There's an assumption that laws and safeguards are in place so technology in general can be trusted and transacted on. In other words they trust in us "the tech circle" to police ourselves and assert security and privacy. It's not circle jerk about privacy. It's a duty we have by being in the…

Exactly. The general public is never going to say “I demand end to end encryption and complete privacy” because they don’t know how all the tech works. But they’re surely going to expect that their private text messages are private and their private pictures are private. People expect privacy as a default and sharing as an option, and they rely on the “experts” (tech companies, lawmakers, etc) to help them.

Not exactly. Some people may not understand and also not care and I'm sure there are many many people who that fits. When you're talking about surveillance level vs. someone hacking your iPhone that's not really a comparison. Of course people don't want their private messages stolen, but that's not really the case with most surveillance. Not that I'm in favor of it necessarily but there are merits.

Surveillance and privacy aren't the same thing but this is the FBI and people are bringing up snowden. In general I think you're right privacy is just expected for personal messages, but at some point when it's just data I don't think most people care, and may in fact support some level of surveillance.

Re: Apple dropped plan for encrypting backups after FBI complained

#162
I believe this has been the case for sometime hasn’t it? I vaguely remember reporting indicating this was true during the San Bernardino case and that Apple handed over that backup. Either way I do remember reading the Apple law enforcement guidelines a year or two ago and this was the case. iCloud data is not secure from law enforcement.

My project list has implementing a WiFi backup Windows/iTunes VM for this specific case. Does anyone know how iOS backups will be handled on personal PCs once iTunes is discontinued?

Re: Apple dropped plan for encrypting backups after FBI complained

#163
post #52

Earlier quoted context omitted.

Eh, maybe, maybe not. What guarantees are there that the backups actually get deleted? Storage is cheap these days...

If you delete your remote backups, they are likely be deleted, eventually. If you don't delete your remote backups, they won't be deleted. There's no business case for keeping backups around for Apple, unless they suddenly became an ad company and started mining your backups for personalization data.

There is a business case - charge the FBI or any government agency for the cost of restoring/delivering it to them, or use the contents to improve any machine learning they are conducting, and I'm sure there are others.

For the longest time Facebook couldn't actually delete photos that you requested the deletion of. They could remove it from indexes so it couldn't be found, but if you had the link it would still be available (akamai cdn). Because, to them, either the cost of the hosting was miniscule compared to the cost of writing the software to ensure things actually got purged from the CDN.

Re: Apple dropped plan for encrypting backups after FBI complained

#164
post #72

Earlier quoted context omitted.

Just a reminder, Apple ceded control of its iCloud management in China to a state-controlled company, in addition began storing its encryption keys in China in order to "comply with local regulations". So whether or not your backups are encrypted is almost a moot point, given that the government can submit a lawful demand for your data at any time.. Apple will store some iCloud encryption keys in China, raising secur…

That’s only for devices where the region is set as China. Why would it be a moot point elsewhere for that reason?

"It's not happening in my country" is a naive argument. You might not care if human rights activists and HK protesters are affected. But Apple's actions in China set a precedent for other countries to follow. If a country demands that Apple "comply with local laws" by providing encryption keys or else risk losing access to that marketplace, Apple will comply, regardless of its effect on user privacy.

Re: Apple dropped plan for encrypting backups after FBI complained

#165
post #56

What the... I was under the impression that iCloud backups are end-to-end encrypted. This is a HUGE problem.

You should look into the 'borg' backup tool - it has become the de facto standard for remote backups because it does everything that rsync does (efficient, changes only backups) but also produces strongly encrypted remote backup sets that only you have a key to ... your cloud provider has no access to the data. The borg website is here: https://borgbackup.readthedocs.io/en/stable/ and a good description of how it wor…

Are there any advantages of using borg over rclone?

Re: Apple dropped plan for encrypting backups after FBI complained

#167
post #5

Earlier quoted context omitted.

You vote every time you decide to buy or not to buy.

You vote if you actually have a choice. What choice is there beyond Apple or Google in terms of smartphones? And I mean actual, ergonomic, everyday convenient choice -- my mother will firmly refuse me if I said "I'll buy you a phone but will have to tinker a full weekend to make it half-privacy-aware". And even if she was on board, she'll just yell at me if she can't do a basic task (this is a controversial topic aro…

> Google is an ad company

Apple is also an ad company.

Apple's advertising business is currently $2 billion, growing rapidly, on track to $11 billion by 2025.

https://9to5mac.com/2019/11/15/apple-ad-revenue/

Re: Apple dropped plan for encrypting backups after FBI complained

#168
post #160

Earlier quoted context omitted.

This hard line is too facile. If you are paranoid about malicious code updates, then making part of your stack open-source doesn’t matter. I could push an update to your OS that reads the keys out of your BitWarden.

Of course, there are open source operating systems out there...

Yeah, I always verify the hashes of updated binaries match what I compile myself in parallel. Also that takes too much time so I just never update anything and have a homebrew version of 'Damn Vulnerable Linux'.

/s

Re: Apple dropped plan for encrypting backups after FBI complained

#170
post #128

Earlier quoted context omitted.

Yes, but the key is stored in your iCloud backup if you use it. As soon as you disable iCloud backups it will roll the key for iMessage and they will be effectively E2E encrypted. When Messages in iCloud is enabled, iMessage, Business Chat, text (SMS), and MMS messages are removed from the user’s existing iCloud Backup, and are instead stored in an end-to-end encrypted CloudKit container for Messages. The user’s iClo…

> Yes, but the key is stored in your iCloud backup if you use it. As soon as you disable iCloud backups it will roll the key for iMessage and they will be effectively E2E encrypted. Assuming this is true, you still don't know what people on the other end will do, meaning it is never actually E2E encrypted.

E2E usually means from endpoint device 1 (my iPhone) to endpoint device 2 (my friend’s iPhone). What the other person will do with it doesn’t factor into the conventional definition of E2E.
Post reply on HN