Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private Cloud Compute: A new frontier for AI privacy in the cloud

security.apple.com

Post reply on HN
Print view View original

301–310 of 393 posts

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#301

Post by JimDabell »

CGamesPlay wrote: post #121

All of this is interesting, but how easy is this to circumvent? When Apple changes their mind for whatever reason, don't they just return a key to a fake PCC node, which would bypass all of their listed protections? Furthermore, what prevents Apple from doing this for specific users?

iOS won’t send requests to it unless that node appears in the transparency log.

If it appears in the transparency log, the whole world will be able to see that a suspicious node has started serving requests.

If Apple changes iOS to remove that restriction, the whole world will be able to see that change because it’s client side.

If Apple tries to deliver a custom version of iOS to a single user, the iOS hardware will refuse to run it unless it has a valid signature.

If it has a valid signature, that copy of the firmware is irrefutable evidence that Apple is deliberately breaking its privacy promises and spying on people in a way they specifically said they wouldn’t, which would be extremely harmful to their business.

Apple seems to be going all-out in binding themselves in a way that makes it as difficult as possible to do what you are suggesting.

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#303

Post by [deleted] »

noahtallen wrote: post #178
hexage1814 wrote: post #168

The thing with cloud and with anything related to it, anything that connects to the internet somehow... is that, unless it's open source and the servers decentralized, you are always trusting SOMEONE. Sure, Apple might make their best to ensure nobody – but them – have access to your data... but Apple controls all the end points. It controls the updates your iPhone receives, it controls the servers where this happens…

I don’t think that’s completely fair. It basically puts Apple in the same bucket as Google or OpenAI. Google obviously tracks everything you do for ads, recommendations, AI, you name it. They don’t even hide it, it’s a core part of their business model. Apple, on the other hand, has made a pretty serious effort to ensure that no employee can access your data on these AI systems. That’s hugely different! They’re going…

[deleted]

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#304

Post by mbesto »

hexage1814 wrote: post #168

The thing with cloud and with anything related to it, anything that connects to the internet somehow... is that, unless it's open source and the servers decentralized, you are always trusting SOMEONE. Sure, Apple might make their best to ensure nobody – but them – have access to your data... but Apple controls all the end points. It controls the updates your iPhone receives, it controls the servers where this happens…

They already have your private pictures. What difference is it that it's now running AI?

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#306

Post by talldayo »

theshrike79 wrote: post #216
visarga wrote: post #134

Earlier quoted context omitted.

mandatory 30 day retention policies or something like it

You can't mandate retention on stuff you're not storing anyway - or because of encryption can't store.

You would think that, but cell carriers have been found to retain both plaintext and encrypted traffic for several years in some cases: https://www.vice.com/en/article/m7vqkv/how-fbi-gets-phone-da...

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#307

Post by talldayo »

whynotminot wrote: post #290
TremendousJudge wrote: post #286

Earlier quoted context omitted.

That's a false dichotomy. You may have to trust someone but that someone could be something else than an opaque for-profit company.

Give me some examples of benevolent non profits that provide anywhere near the level of consumer services as a company like Apple.

I'll do better, here's a benevolent nonprofit that goes beyond what Apple provides to ensure top-notch consumer service: https://grapheneos.org/

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#308

Post by dyauspitr »

paul2paul wrote: post #186

We don't need "a new frontier". I want to be the only one who holds the private key to my encrypted data. I think it's pretty lame to sell privacy when it's not.

The problem with that is it’s not possible for you to be the only one to hold the private key and have the cloud run your data against a model.

Re: Private Cloud Compute: A new frontier for AI privacy in the cloud

#309

Post by talldayo »

whynotminot wrote: post #264
Spooky23 wrote: post #257

Earlier quoted context omitted.

It’s not about technology. It’s about their business. Apple generally engineers their business so that there isn’t an incentive to violate those access controls or principles. Thats not where the money is for them. Behavior is always shaped by rewards and punishments. Positive reinforcement is always stronger.

One hundred percent this. All these conversations always end up boiling down to someone thinking they’re being clever for pointing out you have to trust a company at the end of the day when it comes to security and privacy. Yes. Valid. So if you have to trust someone , doesn’t it make sense for it to be someone who has built protecting privacy into their core value proposition, versus a company that has baked violati…

It's not about being clever, it's about being perceptive. Apple's cloud commitment has a history of being sketchy, whether it's their government alliance in China, the FIVE-EYES/PRISM membership in America, or their obsession with creating "private" experiences that rely on the benefit of the doubt.

Apple doesn't care about you, the individual. Your value as a singular customer is worthless. They do care about the whole; a whole that governments can threaten to exclude them from if they don't cooperate with domestic surveillance demands. How far off do you really think American iCloud is from China? If Apple is willing to backdoor one server, what's stopping them from backdooring them all? If they're willing to lie about notification security, what's stopping them from lying about server integrity too?

And worst off, Apple markets security. That's it; you can't go verify their veracity outside the dinky little whitepapers they publish. You can't know for sure if they have privacy violation baked-in to their system because you can't actually verify anything. You simply have to guess, and the best guess you can make gets based off whatever Apple markets as "true" to you. In reality, we can do better with security and should probably expect more from one of the largest consumer technology brands in the world. Simply assuming that they aren't violating user privacy is an absurd thing to gamble your security on.

Post reply on HN