Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple dropped plan for encrypting backups after FBI complained

reuters.com

Post reply on HN
Print view View original

411–420 of 734 posts

Re: Apple dropped plan for encrypting backups after FBI complained

#411

Post by IfOnlyYouKnew »

_bxg1 wrote: post #206

> aboyt how much Apple cares about users No company cares about anything. A company is not a person. Apple, because of its privacy-marketing, is incentivized to be the privacy player in the market. But only so far as consumers keep them honest about it. They got away with this loophole because it stayed under the radar; if it gets enough attention and enough customers show that it matters to them, it could change. On…

> No company cares about anything. A company is not a person.

Personification is a useful concept. Companies do have some mechanisms that lead to consistently different decisions compared to other companies in similar situation.

You're like the thousandth person objecting to the concept of HN, with always the same air of revelatory smartitude. But it's not contrarian insider knowledge. It's simply the inability/unwillingness to understand basic symbolic speech.

Re: Apple dropped plan for encrypting backups after FBI complained

#412

Post by Ajedi32 »

zaarn wrote: post #401
Ajedi32 wrote: post #398

Earlier quoted context omitted.

The same way you trust anybody? If you're so paranoid that you believe literally everyone is out to get you, then you're not going to be able to function in any society, let alone one as interconnected and interdependent as our own.

But this is about trust. With open source, anyone who understands even a little bit of code can atleast attempt to understand it. You can hash the source code and verify that what you have is the same that the developer shipped. There is no hash function for hardware.

How do you trust your hash program? How do you trust the cryptographers who came up with the hash algorithm? How do you trust your compiler is faithfully interpreting the source code you're reading?

IMO if you're at the point where you believe you can't trust multiple decentralized, independent, multi-jurisdictional bodies all telling you the same thing: that the hardware they've tested matches the published design, you've reached a level of paranoia where no amount of reassurance, technological or otherwise, will satisfy you.

I suppose if you really wanted to you could build your own X-Ray machine from scratch and check the design yourself. That's probably not much more difficult than going line-by-line and manually verifying the source code of your entire software tool chain because you don't trust anyone else who's read the source code enough to believe them when they tell you they've already verified that everything looks correct and that your text editor probably isn't lying to you about the contents of your source files. Which is to say probably totally impractical, but again, that's kinda my point.

Re: Apple dropped plan for encrypting backups after FBI complained

#414

Post by matwood »

natch wrote: post #391
matwood wrote: post #381

Earlier quoted context omitted.

There is a plausible argument that Apple needed to give a little in order to avoid the creation of laws against any encryption. And/Or also avoid laws that required a backdoor to everything. I know I'm going to be called a fanboy or too generous to Apple, but given that the government has used every opportunity to call out Apple for not helping (when they have helped where they could) there is a line here that Apple…

What you say makes sense. Still, if that’s the case, then when they decided not to go down the user-is-in-full-and-absolute-control path for encryption of iCloud backups, they should have publicized it loudly and with extreme clarity on what exactly was happening and where the lines were. So that users could make informed choices.

It has been known and talked about on HN for a long time that only certain things are E2E encrypted on iCloud. And, if full privacy was the goal, then either the user can only do local backups or no backups at all.

Re: Apple dropped plan for encrypting backups after FBI complained

#415

Post by scarface74 »

madars wrote: post #293
GeekyBear wrote: post #251

Earlier quoted context omitted.

Linux offers the ability to run virtual machines, does it not?

Apple EULA used to (still does?) prohibit virtualization of macOS on non-Apple hardware, so this setup could get flaky (need to patch around new hardware detection mechanisms when upgrading the OS).

iTunes runs on Windows....

Re: Apple dropped plan for encrypting backups after FBI complained

#417

Post by scarface74 »

president wrote: post #295
tomaskafka wrote: post #208

Earlier quoted context omitted.

Two things: 1) There is no way Apple would be allowed to sell iPhones in China, without China government having access to anything. So, I assume that Apple users in China have e2e encrypted exactly nothing. 2) I have a strong suspicion that those 'enter your Apple ID password because your account needs it' message really means 'a government has requested your data and even though it's encrypted, we will nag you about…

Regarding #1: iCloud in China is operated by a mainland Chinese company and subject to that company's terms and conditions. So you can pretty much assume iCloud data is completely accessible by the government. Source: https://support.apple.com/en-us/HT208351

Apple uses third party data centers, if it can't host encrypted data on a Chinese server without China having access to the data, there is something wrong with the encryption.

Re: Apple dropped plan for encrypting backups after FBI complained

#418

Post by Technetium »

TheGrassyKnoll wrote: post #141
jasonsync wrote: post #130

Earlier quoted context omitted.

https://www.sync.com provides end-to-end encrypted cloud storage options. Disclaimer I work there.

So does https://spideroak.com/ (I have no affiliation)

They deleted all of my data when one of my payments didn't go through, without notifying me. They are impossible to contact outside of passive aggressive email support. I deeply regret trying to trust this company with my data, which is now gone. Do yourself a favor before trusting them and give them a call and to ask about their services.

Re: Apple dropped plan for encrypting backups after FBI complained

#419

Post by zzzcpan »

zaroth wrote: post #380
zzzcpan wrote: post #266

Earlier quoted context omitted.

> They can grant access to a key, but they cannot themselves be the key. My assumption is that device recovery is such a special case, that it can use very different algorithms than those used in phones today, they could be very computationally expensive and turn fingerprints into usable keys. And of course there is no need for anyone to store them or being able to match them individually or even just tie to an ident…

There are two things that make this problem “hard” if not “intractable”. Encryption keys are precise integer values (or can be represented as such) and they gain a large part of their security from two facts; a key that is wrong by even one bit will appear totally wrong / disclose zero information, and two, the key space is unfathomably large. To turn a fingerprint directly into an encryption key would require first;…

I found some research on fingerprints [1]. At 512 dpi fingerprint sensors have 0.01 bits per pixel of information mutual between samples but still individual, meaning that 160x160 sensors can give 256 bits of information usable for keys. And there are multiple fingers, so it seems enough to derive an encryption key from and even some room for redundancy.

Refreshing it every few years isn't a big deal (as obviously none of it will be used directly as an encryption key for all of your data, but only to encrypt an actual encryption key).

[1] https://backend.orbit.dtu.dk/ws/portalfiles/portal/180163248...

Re: Apple dropped plan for encrypting backups after FBI complained

#420

Post by selebrazin »

mosselman wrote: post #369
magduf wrote: post #326

Earlier quoted context omitted.

You want me to pay for a Windows license to run a Windows VM on Linux, all just so I can back up an iPhone? I don't have to do any of this crap with an Android phone.

True, but you do get wrung out for personal data in order to sell you ads. There is always that.

And do you believe that running Windows in a virtual machine prevents Microsoft from getting the telemetry data and who knows what else? While you're right that running Android does expose (some of) your data to advertisers, with Windows, we're not even sure what exactly is leaving your machine the last time I checked.

Or are you suggesting that an average Linux user who wants to back up their iPhone needs to buy and install Windows in a VM, and then is further expected to tinker with ingress/egress network rules to make sure no data is being sent over to Microsoft? I'd say that's a tall order.

Post reply on HN