Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Platform Security (Jan 2026) [pdf]

help.apple.com

Post reply on HN
Print view View original

41–50 of 205 posts

Re: Apple Platform Security (Jan 2026) [pdf]

#41

Post by jtbayly »

wcfrobert wrote: post #28

Apple's commitment to privacy and security is really cool to see. It's also an amazing strategic play that they are uniquely in the position to take advantage of. Google and Meta can't commit to privacy because they need to show you ads, whereas Apple feels more like a hardware company to me.

modeless linked to this article earlier today:

https://james.darpinian.com/blog/apple-imessage-encryption/

My current understanding of the facts:

1. Google defaults to encrypted backups of messages, as well as e2e encryption of messages.

2. Apple defaults only to e2ee of messages, leaving a massive backdoor.

3. Closing that backdoor is possible for the consumer, by enabling ADP (advanced data protection) on your device. However, this makes no difference, since 99.9% of the people you communicate will not close the backdoor. Thus, the only way to live is to assume that all the messages you send via iMessage will always be accessible to Apple, no matter what you do.

It's not like overall I think Google is better for privacy than Apple, but this choice by Apple is really at odds with their supposed emphasis on privacy.

Re: Apple Platform Security (Jan 2026) [pdf]

#42

Post by candiddevmike »

vrosas wrote: post #36
wcfrobert wrote: post #28

Apple's commitment to privacy and security is really cool to see. It's also an amazing strategic play that they are uniquely in the position to take advantage of. Google and Meta can't commit to privacy because they need to show you ads, whereas Apple feels more like a hardware company to me.

[flagged]

All while slowly stuffing (more?) ads into their software.

In a lot of ways Apple is as aligned to data privacy the same way other "platforms" are: to gatekeep the user data behind their ad service. It's better than selling your data, maybe, but you're still being tracked and monitored.

Re: Apple Platform Security (Jan 2026) [pdf]

#43

Post by isodev »

wcfrobert wrote: post #28

Apple's commitment to privacy and security is really cool to see. It's also an amazing strategic play that they are uniquely in the position to take advantage of. Google and Meta can't commit to privacy because they need to show you ads, whereas Apple feels more like a hardware company to me.

> Apple's commitment to privacy

We know now that it was all marketing talk. Apple didn’t like Meta so they spun a bunch of obstacles. Apple has and would use your data for ads, models and anything that keeps the shareholders happy. And we don’t know the half of the story where as a US corp, they’re technically obliged to share data from the not-E2EE iCloud syncs of every iPhone.

Re: Apple Platform Security (Jan 2026) [pdf]

#44

Post by dangus »

wcfrobert wrote: post #28

Apple's commitment to privacy and security is really cool to see. It's also an amazing strategic play that they are uniquely in the position to take advantage of. Google and Meta can't commit to privacy because they need to show you ads, whereas Apple feels more like a hardware company to me.

Apple has ads. See the App Store, Apple Maps is also planning to roll out advertising.

Re: Apple Platform Security (Jan 2026) [pdf]

#45

Post by isodev »

candiddevmike wrote: post #42
vrosas wrote: post #36

Earlier quoted context omitted.

[flagged]

All while slowly stuffing (more?) ads into their software. In a lot of ways Apple is as aligned to data privacy the same way other "platforms" are: to gatekeep the user data behind their ad service. It's better than selling your data, maybe, but you're still being tracked and monitored.

The worst part is since Apple is technically not a 3rd party, many of the rules don’t apply to them even though they bring the same harm to the users. Did you notice the new “creative suite” has analytics with identities linked to your Apple account turned on by defend? Free Pages/Numbers is not so free anymore.

Re: Apple Platform Security (Jan 2026) [pdf]

#46

Post by dangus »

vrosas wrote: post #36
wcfrobert wrote: post #28

Apple's commitment to privacy and security is really cool to see. It's also an amazing strategic play that they are uniquely in the position to take advantage of. Google and Meta can't commit to privacy because they need to show you ads, whereas Apple feels more like a hardware company to me.

[flagged]

> Apple gives zero fucks about security.

Hyperbole doesn’t help your point. They definitely care about security, their profits depend on it.

Re: Apple Platform Security (Jan 2026) [pdf]

#47

Post by digiown »

surajrmal wrote: post #40
digiown wrote: post #24

Earlier quoted context omitted.

GrapheneOS also doesn't give you the encryption keys. If you run the official version, there is no way for you to extract the data from your device at all beyond what app developers will let you access. This means that you do not own the data on your device. The backups are even less effective than Apple's, although they say they will work on it. The developers also appear to believe that the apps have a right to ins…

You were not going to be able to use those apps anyways, so what does it matter to you? I, and I suspect many, agree with the purpose of attestation. The problems around it are strictly around establishing good ways to teach apps who they should trust, not around attestation itself. By putting your head in the sand, you'll never improve the situation.

> teach apps who they should trust

Ah, the apps^Wgovernment (look at that page, most of it is government IDs) should be able to discriminate against me for daring to assert control over my own device. And GrapheneOS is saying:

Hey government! We pinky promise to oppress the user just the same, but even more securely and competently than Google/Samsung!

> what does it matter to you

It shows that the developers maybe don't fully have your best interests at heart?

Re: Apple Platform Security (Jan 2026) [pdf]

#48

Post by OGEnthusiast »

Noaidi wrote: post #33
wcfrobert wrote: post #28

Apple's commitment to privacy and security is really cool to see. It's also an amazing strategic play that they are uniquely in the position to take advantage of. Google and Meta can't commit to privacy because they need to show you ads, whereas Apple feels more like a hardware company to me.

That people fall for this corporate BS while Tim Cook is giving gold bars to Trump and dining and dancing with him When people are being murdered on the streets by ice is just amazing to me.

Well that’s what Americans voted for. So I don’t think anyone cares that every CEO (definitely not just Tim Cook) is schmoozing with Trump.

Re: Apple Platform Security (Jan 2026) [pdf]

#49

Post by derbOac »

wcfrobert wrote: post #28

Apple's commitment to privacy and security is really cool to see. It's also an amazing strategic play that they are uniquely in the position to take advantage of. Google and Meta can't commit to privacy because they need to show you ads, whereas Apple feels more like a hardware company to me.

It's all tempered by them ultimately controlling what you can put on your phone though.

As was demonstrated in LA, it's starting to have significant civil rights consequences.

Re: Apple Platform Security (Jan 2026) [pdf]

#50

Post by digiown »

armadyl wrote: post #35
digiown wrote: post #24

Earlier quoted context omitted.

GrapheneOS also doesn't give you the encryption keys. If you run the official version, there is no way for you to extract the data from your device at all beyond what app developers will let you access. This means that you do not own the data on your device. The backups are even less effective than Apple's, although they say they will work on it. The developers also appear to believe that the apps have a right to ins…

> The developers also appear to believe that the apps have a right to inspect the trustworthiness of the user's device, by offering to support apps that would trust their keys [1], locking out users who maintain their freedom by building their own forks. That is not a bad thing. The alternative is not having apps that do these checks available on the platform at all. It’s ridiculous that someone should expect that ev…

> Attestation is also a security feature

I don't actually disagree with this. The auditor is a perfectly valid use of it. It's good to be able to verify cryptographically your device is running what it's supposed to.

The problem is when it transcends ownership boundaries and becomes a mechanism to exert control over things someone doesn't own, like your bank or government controlling your phone. It is one of the biggest threats to ownership worldwide.

Note also that getting "trusted" comes at the cost of other security features, such as spoofing your location securely to apps:

https://news.ycombinator.com/item?id=44685283

Post reply on HN