Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple dropped plan for encrypting backups after FBI complained

reuters.com

Post reply on HN
Print view View original

721–730 of 734 posts

Re: Apple dropped plan for encrypting backups after FBI complained

#721

Post by madeofpalk »

nemothekid wrote: post #126
snowwrestler wrote: post #96

Earlier quoted context omitted.

I thought iMessage private keys are somehow based on data in the "secure enclave" chip, and thus not able to be stored in the cloud. It's my understanding that Apple could add new "devices" to listen in on future conversations, but it can't read iMessage conversations in transit between existing devices. It can also read iCloud backups of conversation content, which are created by the client device after decrypting t…

If you lose your device and buy a new one and restore your device with a back up, all your messages will be returned. There’s no way to accomplish this without having the private key in the backup. EDIT: When I say there is no way to accomplish this, I’m talking specifically about the process that exists today where the user doesn’t have to remember a password other than their iCloud password (which today, can also b…

> all your messages will be returned.

Your messages are returned via the backup, not via the "iMessage servers". Once the messages are at rest on your device, they're no longer encrypted using your "iMessage private key".

Re: Apple dropped plan for encrypting backups after FBI complained

#722

Post by lern_too_spel »

scarface74 wrote: post #701
lern_too_spel wrote: post #678

Earlier quoted context omitted.

> You have to believe that the judicial branch actually would safe guard privacy and keep law enforcement from overreaching. These warrants become public record. I don't have to blindly believe it. I can look at the records and see that the US is not even close to China as far as government access to user data.

These records become public record? Unless the government screams “terrorism”. Ever heard of a FISA warrant? https://www.ajc.com/news/national/what-fisa-warrant/WqP428Eg...

The statistics of those are also public record and show that US surveillance is nowhere close to Chinese.

Re: Apple dropped plan for encrypting backups after FBI complained

#723

Post by lern_too_spel »

scarface74 wrote: post #702
lern_too_spel wrote: post #679

Earlier quoted context omitted.

> The “key server” does not in fact “generate public keys”. That's the point. It should not, but the security model of iMessage allows the key server to get away with it, which is almost certainly happening in China right now. Try reading the article and following the example. > But after reading research from security experts you have found a citation where Apple is generating a key pair from its servers and sending…

Again, if it Apple were in fact creating their own key pairs on their server and sending users the key pair, don’t you think someone would have discovered. But since it’s in a Wikipedia article, I guess that kind of closes the case.

> [If] Apple were in fact creating their own key pairs on their server and sending users the key pair, don’t you think someone would have discovered.

You once again misunderstand the vulnerability. The vulnerability is that China does this because China controls the keyservers in China.

As far as anybody discovering this, that would be very difficult because Apple does not let you install your own apps on the device and would not approve an app designed to detect this.

But even more, why would they bother? People who care about their privacy will simply avoid closed source software and especially closed systems like Apple's instead of trying to use a known compromisable system safely.

>But since it’s in a Wikipedia article, I guess that kind of closes the case.

I was pointing you to a place where you could learn about cryptography because you seem not to understand the basic concepts. The Wikipedia article does not describe this particular vulnerability.

Re: Apple dropped plan for encrypting backups after FBI complained

#724

Post by lern_too_spel »

ex3ndr wrote: post #700
lern_too_spel wrote: post #609

Earlier quoted context omitted.

I have used Android devices since 1.0. They have all had the ability to disable location history and the ability to disable Google Location Services (under various names). Apple doesn't even give you the option of not sending GPS locations to Apple. If any app requests your location, Apple gets it too. https://support.apple.com/en-us/HT207056

That’s just not enough for disabling it on Android. I am working with androids even before 1.0, but does this really matter?

> That’s just not enough for disabling it on Android.

Citation needed.

> I am working with androids even before 1.0, but does this really matter?

It matters if I am claiming that there is no point at which GGP's statement was true, which I am. If I am not, GGP could say that the version of Android he used "last time [he] used Android" did not allow him to disable location collection and that it predates my experience with Android's location settings.

Re: Apple dropped plan for encrypting backups after FBI complained

#725

Post by president »

scarface74 wrote: post #525
president wrote: post #518

Earlier quoted context omitted.

It doesn't take Bruce Schneier to understand how laws work.

And you still haven’t provided proof that it is required or that Apple has uploaded users private keys or given up private keys.

At this point, you're either a shill or a troll or did not earn your high school GED.

Re: Apple dropped plan for encrypting backups after FBI complained

#726

Post by president »

scarface74 wrote: post #703
commoner wrote: post #663

Earlier quoted context omitted.

You're missing the point. From your quote: > Until now, Apple appears to have handed over very little data about Chinese users. From mid-2013 to mid-2017, Apple said it did not give customer account content to Chinese authorities, despite having received 176 requests, according to transparency reports published by the company. By moving iCloud data and keys to China, the amount of data Apple handed to Chinese authori…

The linked Rueters article quoted a statement where Apple said “they are still in control of the keys.”

You need to brush up on your Cryptography 101 course before arguing with people about how asymmetric encryption keys work. There is nowhere that states that only one entity can have "control" of the keys. If you don't understand that, then I can see why you're so confused about this whole situation.

Re: Apple dropped plan for encrypting backups after FBI complained

#727

Post by mandeepj »

justapassenger wrote: post #191

Wonder if this will help to kill a meme, about how much Apple cares about users and what great values they have, how they're going to stand for the user, fight with governments, etc. While iPhone itself is pretty secure as a device phone (and Apple makes sure to remind you about that in each ad, public speaking, attacks on competitors, etc), as an ecosystem it's not secure. And it's like that on purpose - there's no…

> there's no good and easy option to backup your phone other than iCloud

of course, there is. You can easily back it up to your computer, and then transfer it to anywhere else.

Re: Apple dropped plan for encrypting backups after FBI complained

#728

Post by mhb »

fulldecent2 wrote: post #714
mhb wrote: post #41

Earlier quoted context omitted.

For local backup, iMazing is great. It also does other useful things. It costs money though and you can decide whether that's a feature or bug. https://imazing.com/

Was this previously called iFunBox or something else?

Wikipedia says Created by DigiDNA, the software was initially released in 2008 as DiskAid, enabling users to transfer data and files from the iPhone or iPod Touch to Mac or Windows computers. DiskAid was renamed iMazing in 2014.

https://en.wikipedia.org/wiki/IMazing

Re: Apple dropped plan for encrypting backups after FBI complained

#729

Post by rsync »

rovr138 wrote: post #655
cmcd wrote: post #165

Earlier quoted context omitted.

Are there any advantages of using borg over rclone?

Yes. Rclone simply copies data. If you `sync` `~/Documents` to your remote it will keep an exact copy. This is a simple backup since you only have one version. Anything deleted, the next time it syncs, gets deleted. Borg is a backup tool. Versioning is at its core. It does that efficiently by deduplicating file (chunks really) even if they’re not in the same location. So with Borg, if you create a backup 1 of `~/Docu…

"Rclone simply copies data. If you `sync` `~/Documents` to your remote it will keep an exact copy."

...

"This is a simple backup since you only have one version. Anything deleted, the next time it syncs, gets deleted."

This is correct. It is widely advised to not consider a "sync" like this a proper backup.

However, for what it's worth, rsync.net does support rclone[1] and because of the ZFS snapshots that are created and maintained[2] in your account, you can just do a dumb sync because the retention is handled by the snapshots.

I am not sure if rclone is really the right tool for plain old cloud backups - I think rclone distinguishes itself for the ability to transfer data between cloud providers.[3]

[1] https://rsync.net/products/rclone.html

[2] ZFS snapshots reside in the .zfs/snapshot directory inside your rsync.net account.

[3] ssh user@rsync.net rclone file/in/rsync/net/account s3:/some/bucket

Re: Apple dropped plan for encrypting backups after FBI complained

#730

Post by alfiedotwtf »

neop1x wrote: post #621
JoBrad wrote: post #583

Earlier quoted context omitted.

You can back them up locally.

I like it. If you want, you can make local encrypted backup. If you are lazy (and lots of terrorists and drug dealers probably are) you just flip the iCloud switch on at the first prompt. :) I have read that airport security is also not 100% effective but it is enough for these kinds of problematic people.

If you re-remember to flip the switch back. I was SHOCKED that my Apple Time Machine backup of my encrypted drive after restore was NOT encrypted!
Post reply on HN