Earlier quoted context omitted.
I used the term 'motivate' specifically because of the PR language intending for customers to evaluate the Apple product as something that could be used by those who need to use their phone for private and/or sensitive reasons. Apple of course backdoors their phones for government surveillance access. But they do motivate a threat model that includes government surveillance. I know parsing my comment in this way may…
> Apple of course backdoors their phones for government surveillance access. Nice job slipping a completely unfounded lie into your response. Starting with iOS 10, you can actually just mount the root filesystem disk image from iOS restore images. You are able to reverse engineer and audit any application or daemon that the OS runs. You can use open source tools (Such as idevicerestore) to perform an OS restore on yo…
Pixel Security
51–60 of 152 posts
Re: Pixel Security
#52Earlier quoted context omitted.
I used the term 'motivate' specifically because of the PR language intending for customers to evaluate the Apple product as something that could be used by those who need to use their phone for private and/or sensitive reasons. Apple of course backdoors their phones for government surveillance access. But they do motivate a threat model that includes government surveillance. I know parsing my comment in this way may…
> Apple of course backdoors their phones for government surveillance access. Nice job slipping a completely unfounded lie into your response. Starting with iOS 10, you can actually just mount the root filesystem disk image from iOS restore images. You are able to reverse engineer and audit any application or daemon that the OS runs. You can use open source tools (Such as idevicerestore) to perform an OS restore on yo…
Oh my.
Yes Apple backdoors their phones for government surveillance access.
There's no sneaking here. I'm saying it very clearly as a central tenet of my comment.
-----------------------
Here's a list of things that Apple will provide from Apple's own Guide for Law Enforcement Access:
- Device Registration (name, address, email address, telephone number, iCloud Apple ID)
- Customer Service Records
- iTunes (name, physical address, email address, and telephone number, purchase/download transactions and connections, update/re-download connections, and iTunes Match connections, iTunes subscriber information and connection logs with IP addresses, specific content purchased or downloaded).
- Apple Retail Store Transactions (cash, credit/debit card, or gift card transactions, type of card, name of the purchaser, email address, date/time of the transaction, amount of the transaction, and store location, receipt number)
- Apple Online Store Purchases (name, shipping address, telephone number, email address, product purchased, purchase amount)
- iTunes Gift Cards (sixteen-digit alphanumeric code, nineteen-digit code, any purchases, name of the store, location, date, and time, user account
- iCloud (music, photos, documents, iCloud email, encryption keys, Subscriber Information, iCloud feature connections, connection logs with IP addresses, Mail Logs, records of incoming and outgoing communications such as time, date, sender email addresses, and recipient email addresses, Email Content, Other iCloud Content, Photo Stream, Docs, Contacts, Calendars, Bookmarks, iOS Device Backups, stored photos, documents, contacts, calendars, bookmarks and iOS device backups, photos and videos in the users’ camera roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail)
- Find My iPhone (including connection logs)
- Other Available Device Information (MAC Address for Bluetooth, Ethernet, WiFi, or FireWire)
- Requests for Apple Retail Store Surveillance Videos
- Game Center (Connection logs with IP addresses, specific game(s) played)
- iOS Device Activation (including upgrades the software, IP addresses, ICCID numbers, and other device identifiers)
- Sign-on Logs (iTunes, iCloud, My Apple ID, and Apple Discussions, Connection logs with IP addresses, Sign-on transactional records)
- My Apple ID and iForgot Logs (password reset actions, Connection logs with IP addresses)
- FaceTime (logs when a FaceTime call invitation is initiated, content protected by 15 bits of entropy if secure enclave baked key is obtained from manufacturer)
And, from this thread on HN today (https://news.ycombinator.com/item?id=12977612): All call logs including contacts, timestamps, and durations including for third party applications on the phone like WhatsApp, Skype and Viber.
Re: Pixel Security
#53Just FYI in case anyone is considering buying a Pixel: I strongly urge you not to. http://kasrarahjerdi.com/2016/11/dont-buy-anything-made-by-g... They have no Google provided support, if you drop the phone and break it your only option (if you didn't buy the third-party warranty upsell) is to take it to a repair shop. I called the ones near me, none had seen or touched the device before. Don't spend $800 on a phone…
What phones have warranty against dropping included?
It's not warranty or free repairs he is asking for isn't it? He is asking for paid support.
Re: Pixel Security
#54Earlier quoted context omitted.
No, he's right. Apple is putting on a PR show. If a warrant is served to Apple they'll hand over whatever data they have on you including any metadata on your encrypted data. They also have teams working 24/7 to serve up this data to government officials and law enforcement. It's all in the leaked Apple/Podesta emails.
Your framing is disingenuous, considering that any large company will have staff ready to respond to legal / discovery demands. This is a legal process, not something Apple is doing out of their own volition.
However, it Apple has capitulated to a combination of carrots and sticks. Today, it enables surveillance of its customers.
Re: Pixel Security
#55Just FYI in case anyone is considering buying a Pixel: I strongly urge you not to. http://kasrarahjerdi.com/2016/11/dont-buy-anything-made-by-g... They have no Google provided support, if you drop the phone and break it your only option (if you didn't buy the third-party warranty upsell) is to take it to a repair shop. I called the ones near me, none had seen or touched the device before. Don't spend $800 on a phone…
Wait - What kind of phone manufacturer offers accident coverage right out of the box?
>I can’t send my $800 phone to the manufacturer and pay some extra money to get it repaired like I could if this was a Samsung or Apple device.
>Hey Google, if you want to pivot into a real brand: You need to provide real support. No other flagship phone tells people “well, good luck” if they have a common incident break the device.
Re: Pixel Security
#56Earlier quoted context omitted.
No, he's right. Apple is putting on a PR show. If a warrant is served to Apple they'll hand over whatever data they have on you including any metadata on your encrypted data. They also have teams working 24/7 to serve up this data to government officials and law enforcement. It's all in the leaked Apple/Podesta emails.
Your framing is disingenuous, considering that any large company will have staff ready to respond to legal / discovery demands. This is a legal process, not something Apple is doing out of their own volition.
Apple VP Lisa Jackson:
>Please know that Apple will continue its work with law enforcement. We share law enforcement’s concerns about the threat to citizens and we work closely with authorities to comply with legal requests for data that have helped solve complex crimes. Thousands of times every month, we give governments information about Apple customers and devices, in response to warrants and other forms of legal process. We have a team that responds to those requests 24 hours a day. Strong encryption does not eliminate Apple’s ability to give law enforcement meta-data or any of a number of other very useful categories of data.
Re: Pixel Security
#57I have not seen so many gotos in many many years. I guess it's the programming model in this case. I am sure this bit of code is going to be audited quite closely.
The use of goto in C for error and exception handling is good practice. It keeps the code easy to read, and also provides common code for error and/or exit handling. You'll see this paradigm used a lot in large open source C projects, such as the Linux kernel and QEMU. In my experience, a lot of closed source C projects ban goto outright, in (IMO) an overly dogmatic adherence to the idea that all goto use is spaghett…
Not that I think C should add these features, goto does these jobs okay, and there's enough stigma that it's unlikely to be used foolishly. But I think it's worth keeping in mind as we think about future languages.
Re: Pixel Security
#58Earlier quoted context omitted.
Your framing is disingenuous, considering that any large company will have staff ready to respond to legal / discovery demands. This is a legal process, not something Apple is doing out of their own volition.
I'm sure all large companies have staff to handle these requests for information, but this is the first time I've heard of a company creating a team that does nothing but hand over customer data 24 hours a day. Apple VP Lisa Jackson: >Please know that Apple will continue its work with law enforcement. We share law enforcement’s concerns about the threat to citizens and we work closely with authorities to comply with…
For an understanding of what data Apple gives surveillance operations access to, the following list is enumerated in an older Law Enforcement Access document: https://news.ycombinator.com/item?id=12983081
It's also important to understand that the purpose for this surveillance (this following section being informed by the Snowden Disclosures) is not merely for investigative work or for tracking down terrorists. Intelligence work of this kind is used in HUMINT operations (mass propaganda), for industrial espionage, for diplomatic espionage and for signals collections (intelligence used to break into networks).
It is not clear whether Apple shares these concerns with the US government, or whether it shares lesser concerns that show up at a much lower frequency.
Re: Pixel Security
#59Earlier quoted context omitted.
> Apple of course backdoors their phones for government surveillance access. Nice job slipping a completely unfounded lie into your response. Starting with iOS 10, you can actually just mount the root filesystem disk image from iOS restore images. You are able to reverse engineer and audit any application or daemon that the OS runs. You can use open source tools (Such as idevicerestore) to perform an OS restore on yo…
> Nice job slipping a completely unfounded lie into your response. Oh my. Yes Apple backdoors their phones for government surveillance access. There's no sneaking here. I'm saying it very clearly as a central tenet of my comment. ----------------------- Here's a list of things that Apple will provide from Apple's own Guide for Law Enforcement Access: - Device Registration (name, address, email address, telephone numb…
US law means that Apple must turn over data when demanded by authorities. These are access logs or files stored on Apple servers.
A backdoor would be granting access into your device so that authorities could access your non-icloud email, or data saved locally on device.