Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple dropped plan for encrypting backups after FBI complained

reuters.com

Post reply on HN
Print view View original

631–640 of 734 posts

Re: Apple dropped plan for encrypting backups after FBI complained

#631

Post by thathndude »

alfiedotwtf wrote: post #572
thathndude wrote: post #541

Earlier quoted context omitted.

If unencrypted iCloud back ups is the price for us getting to keep fully encrypted devices, so be it

If backups aren't encrypted, then neither is your device

But backups to iCloud are optional. Apple has to strike a balance.

This is cliche as can be, but the trade off is security for convenience.

Fact is, iOS is consumed largely by people who want convenience. They don’t want to lose all of their data if they forget their passwords.

But for those people who are ok with that type of unforgiving paradigm, then don’t use iCloud backups, and you’re all set.

Re: Apple dropped plan for encrypting backups after FBI complained

#632

Post by theshrike79 »

post_below wrote: post #364
tomc1985 wrote: post #300

Earlier quoted context omitted.

Yeah, but what are the reasonable alternatives? Android, with its freewheeling stance on privacy and app permissions? Do they even let you disable location tracking any more?

Depending on what functionality you're willing to give up, an Android device can pretty easily be used as a more private option thanks to the latest iteration of Google's privacy settings. If you're willing to root your device, you can have the best of both the functionality and privacy worlds. That only applies to motivated and reasonably tech savvy users of course, out of the box iOS is still the better privacy opt…

If you can root your device, so can the bad guys.

Re: Apple dropped plan for encrypting backups after FBI complained

#633

Post by VvR-Ox »

echelon wrote: post #584
mistersquid wrote: post #323

Earlier quoted context omitted.

> Wonder if this will help to kill a meme, aboyt how much Apple cares about users and what great values they have, how they're going to stand for the user, fight with governments, etc. In this instance, Apple decided to continue to not encrypt iCloud backups because, according to one source, > […] the company did not want to risk being attacked by public officials for protecting criminals, sued for moving previously…

> Apple has a balance to strike between the issues of encryption, privacy, and law enforcement [...] No, they do not. If Apple wants a reputation for privacy and respecting its customers, then it has to put them first. Don't apologize for them making this user-hostile choice. We could be merely a generation away from the hell hole that is social credit. We can't afford to keep ceding ground on privacy. We have to eng…

1. Yes, they have to. At least in the US any company has to cooperate with the law enforcement as you might know. The only choice to do business in the US or based on US governed soil is to comply with them.

2. Apple at least put some effort into this matter because otherwise there would not be so much media attention to breaking into iPhones. To get data from android on the other hand seems to be no problem at all.

3. We are already in hell but we do not yet see the flames surrounding us.

4. If collective choice matters so much we are all doomed and you know it. Try telling the Joneses about encryption etc. - they will still use WhastApp, Facebook and the likes because it is so convenient over a way of burden and hard work to get there or even live without all these "magical devices and services".

Re: Apple dropped plan for encrypting backups after FBI complained

#634

Post by chrischen »

lern_too_spel wrote: post #547
scarface74 wrote: post #539

Earlier quoted context omitted.

I have not changed the subject. Apple clearly delineates which data is e2e encrypted and which data is not. Those same standards apply in the US and China - unless you have evidence otherwise. I no more trust my privacy to the US government than a Chinese citizen should trust China.

> I have not changed the subject. You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data, but you changed the subject to talk about systems where the private key is on device, which does not apply to iCloud. You absolutely did change the subject. > Those same standards apply in the US and China - unless you have evidence otherwise. Those same standards don't ac…

> Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. In the US, that is Apple, so Apple has access to that data. In China, that is the Chinese government. Therefore, the Chinese government has access to all Chinese iCloud and iMessage data.

Seeing as how Apple complies with FBI and law enforcement requests to get iCloud data, that is definitely not the case in the US.

Re: Apple dropped plan for encrypting backups after FBI complained

#635

Post by jackjeff »

tomaskafka wrote: post #208
mrtksn wrote: post #57

Apple has a list for that: https://support.apple.com/en-us/HT202303 These are end to end: Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information QuickType Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords The messages also end to end but the backup contains the private key. The moral of…

Two things: 1) There is no way Apple would be allowed to sell iPhones in China, without China government having access to anything. So, I assume that Apple users in China have e2e encrypted exactly nothing. 2) I have a strong suspicion that those 'enter your Apple ID password because your account needs it' message really means 'a government has requested your data and even though it's encrypted, we will nag you about…

The only thing in that list that would is of interest to a government are messages. Fortunately no-one really uses iMessage in China. People use WeChat and (you guessed it) the Chinese government has access to these.

As for the End-to-End encryption of iMessage it is a bit overrated. Apple does the key management for you. So theoretically they could pretend that the key of your interlocutor recently changed (because new phone or something), it would just work transparently. So if a "nefarious" entity were to gain access to iMessage servers, they could use that technique to decrypt, "on the fly", the messages of whoever they want to spy on, without the clients knowing that this even occurred.

When you use "WhatsApp" you have the ability to get some kind of warning when the interlocutor's key has been updated. It's also possible to check each others' identity by scanning some kind of QR Code. But the app does not really put any emphasis on which accounts have been verified. Signal is about as bad as WhatsApp. My guess a government that wants to spy on your WhatsApp/Signal messages probably could, because most people would notice the key change warning nor understand what it means.

Only Apps which makes a big fuss about key management (Threema for example) are properly End to End encrypted, with no possibility for Big Gov to hack into servers and spy on you by adding their keys to conversations. But then they would probably just hack the OS on your phone at this stage. In fact that method, is probably better than messing around with iMessage/WhatsApp servers. You bypass ALL forms E2E encryption, and you get access to everything else, with one swift hack. I bet the NSA and their Chinese equivalents have such hacks in reserve for very juicy targets they want to spy on.

With the kind of unlimited budget the NSA has, it's hard to imagine something they cannot hack. That is why big A-list targets like Bin Laden went totally off-grid for communication.

Re: Apple dropped plan for encrypting backups after FBI complained

#636

Post by andreasley »

proidgeree1 wrote: post #103
andreasley wrote: post #84

Earlier quoted context omitted.

While Apple doesn't force its users to use iCloud, they also don't provide an alternative way to do full backups of iOS/iPadOS devices over a network. Yes, you can plug an iPhone into a Mac, but that doesn't scale.

You can set local auto backup over wifi in itunes right?

Yes, but that only works in local networks and after connecting via USB once – and the backup is always stored on a single computer. So it may be acceptable for personal usage, but not suited for an enterprise environment where you want to centrally manage hundreds of devices and provide some redundancy for your backup system.

Re: Apple dropped plan for encrypting backups after FBI complained

#637

Post by 72deluxe »

kalleboo wrote: post #593
novok wrote: post #322

Earlier quoted context omitted.

You would probably need the kernel / filesystem to keep track of it to keep it efficient. And even then that is iffy if you implement it as a kernel extension vs. something integrated into filesystem code. I've found arq backup overall slow once you start hitting 0.5TB overall. It's a design issue.

> You would probably need the kernel / filesystem to keep track of it to keep it efficient I believe most operating systems have a mechanism for this. E.g. on macOS it's called fsevents, Linux has inotify

Yes, these utilities would probably need something in them such that fswatch implements (https://emcrisostomo.github.io/fswatch/) - very useful.

Re: Apple dropped plan for encrypting backups after FBI complained

#638

Post by scarface74 »

Silhouette wrote: post #607
scarface74 wrote: post #585

Earlier quoted context omitted.

So it’s difficult to get data off of your device - even though you can get pictures and video off of your device like any camera and most other documents are stored in their own folders on iCloud - that you can get to either using the iCloud Drive app for Macs or Windows or by logging into iCloud.com.

Have you forgotten that the entire point of this discussion was that iCloud is not properly encrypted, which is why it is such a problem that local transfer of all data is so difficult?

So now we are going back to needing some type of app to backup and encrypt since there are no “standard protocols” that can do encrypted backups and restores.....

Re: Apple dropped plan for encrypting backups after FBI complained

#639

Post by scarface74 »

lern_too_spel wrote: post #591
scarface74 wrote: post #552

Earlier quoted context omitted.

You started this thread by responding to somebody discussing the Chinese government's access to all iCloud data If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” Those same standards don't actually protect your data from whoever controls the iCloud server or whoever controls the iMessage key server. If the private key is generated by the same entity or “key server” that g…

> If some of the data is e2e encrypted using private keys,China doesn’t have access to “all data” You have two mistakes in this sentence. 1. None of the iCloud data (mail, docs, drive, etc.) is E2E encrypted. Some of the data stored in iCloud (like keychain backups) is encrypted prior to being sent to iCloud (using symmetric encryption, not with asymmetric key pairs). China has access to the data that was ultimately…

The “key server” does not in fact “generate public keys”. It distributes public keys. But you can’t decrypt a message with public keys - that’s kind of the point...

But after reading research from security experts you have found a citation where Apple is generating a key pair from its servers and sending the private key to the client?

Re: Apple dropped plan for encrypting backups after FBI complained

#640

Post by scarface74 »

DevKoala wrote: post #532
scarface74 wrote: post #435

Earlier quoted context omitted.

Do you have any evidence that Apple rearchitected their system to have access to private keys that it doesn’t have access to anywhere, to have access to give it to China?

> It is the latest development in a pattern of Apple acquiescing to Beijing’s demands. Last July, Apple deleted VPN apps from the App Store that let mainland Chinese internet users evade censorship. Apple’s lawyers have also added a clause in the Chinese terms of service that states both Apple and GCBD may access all user data. Apple has not responded to requests for comment. > Meanwhile, Chinese laws do not protect…

Well, after actually reading the Reuter’s article that the verge citation is based on...

Apple says the joint venture does not mean that China has any kind of “backdoor” into user data and that Apple alone – not its Chinese partner – will control the encryption keys. But Chinese customers will notice some differences from the start: their iCloud accounts will now be co-branded with the name of the local partner, a first for Apple.

Post reply on HN