Apple will notify users about state-sponsored cybersecurity threats • Hacker News Board

Re: Apple will notify users about state-sponsored cybersecurity threats

#31

Post by funnyflamigo » Wed, Nov 24, 2021, 8:09 PM UTC

boomboomsubban wrote: post #6

So something like PRISM that targets everybody won't trigger a warning?

I doubt it.

Keep in mind this will only work for non-court-gag-ordered instances. If the US subpoenas Apple about an individual they won't be allowed to notify them.

I have no idea how this applies to other countries.

I think this is more like: "We noticed unusual API usage and we don't have a gag order so whatever it is, it's not likely to be good"

Re: Apple will notify users about state-sponsored cybersecurity threats

#32

Post by gambiting » Wed, Nov 24, 2021, 8:11 PM UTC

Will it let them know that their own phone has decided that they are a potential pedophile and their photos will be sent unencrypted to some tech centre god knows where where someone will decide whether to report them to authorities or not? Or is that ok to keep secret?

Re: Apple will notify users about state-sponsored cybersecurity threats

#33

Post by varispeed » Wed, Nov 24, 2021, 8:22 PM UTC

It's only possible because Apple is too big too fail. Probably they won't notify about the US snooping, but smaller countries often have smaller budgets that this company, so they can't really do anything about Apple pulling strings. It's a shame that smaller companies cannot do that without risking being closed down.

Re: Apple will notify users about state-sponsored cybersecurity threats

#34

Post by varispeed » Wed, Nov 24, 2021, 8:24 PM UTC

thih9 wrote: post #7

I'm surprised to see protection against state sponsored attacks implemented by a company as big as Apple. Is any other 'mainstream' company offering a similar feature? Warrant canary [0] comes to mind, but that is usually a message to all users, as opposed to notifying an individual user. [0]: https://en.wikipedia.org/wiki/Warrant_canary

> by a company as big as Apple

Would smaller company stand a chance against very much any state? If men in suits taken a CEO of a big company for "a talk" in the forest there would be a lot of fuss in the media, whereas small company would probably be scared to bits and never said a word.

Re: Apple will notify users about state-sponsored cybersecurity threats

#35

Post by kube-system » Wed, Nov 24, 2021, 8:27 PM UTC

I see a lot of people in the comments conflating legal requests and attacks. Regardless of your opinion on either of those issues, they are different things.

Re: Apple will notify users about state-sponsored cybersecurity threats

#36

Post by diegorbaquero » Wed, Nov 24, 2021, 8:33 PM UTC

funman7 wrote: post #12

What if you opted in to the terms of the Chinese App Store then switch to USA.

You are asked to accept new ones when changing store location

Re: Apple will notify users about state-sponsored cybersecurity threats

#37

Post by notkurt » Wed, Nov 24, 2021, 8:34 PM UTC

Has anyone put forward some theories as to how they are pulling this off? Are they tapping into iMessage Metadata, scanning crash logs, or something along those lines? While I totally understand the need for them to keep how they are doing this private, I do find it slightly concerning. Unless they are just flagging suspicious iCloud login attempts. If it’s relating to crash logs, it would be nice to know as I’m sure a bunch of privacy focused users have that disabled.

Re: Apple will notify users about state-sponsored cybersecurity threats

#38

Post by marcan_42 » Wed, Nov 24, 2021, 8:41 PM UTC

notkurt wrote: post #37

Has anyone put forward some theories as to how they are pulling this off? Are they tapping into iMessage Metadata, scanning crash logs, or something along those lines? While I totally understand the need for them to keep how they are doing this private, I do find it slightly concerning. Unless they are just flagging suspicious iCloud login attempts. If it’s relating to crash logs, it would be nice to know as I’m sure…

I assume they have iMessage metadata on what accounts the NSO accounts talked to. The contents are E2E encrypted, but unless they have explicitly promised not to keep logs, they probably have the metadata logged.

Re: Apple will notify users about state-sponsored cybersecurity threats

#39

Post by schleck8 » Wed, Nov 24, 2021, 8:47 PM UTC

It's one of the largest enterprises against state-funded specialists and intelligence agencies, this will be an interesting arms race.

Re: Apple will notify users about state-sponsored cybersecurity threats

#40

Post by schleck8 » Wed, Nov 24, 2021, 8:53 PM UTC

boomboomsubban wrote: post #6

So something like PRISM that targets everybody won't trigger a warning?

It's rare that programmes like PRISM surface publicly. I don't see how Apple would gather top secret intel on national surveillance programmes on their own, so there is a good chance they aren't even aware.