Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple dropped plan for encrypting backups after FBI complained

reuters.com

Post reply on HN
Print view View original

91–100 of 734 posts

Re: Apple dropped plan for encrypting backups after FBI complained

#91

Post by mtgx »

metafunctor wrote: post #6

What the... I was under the impression that iCloud backups are end-to-end encrypted. This is a HUGE problem.

Nope. I actually thought this was well known.

What did suck on Apple's part was that they wouldn't allow you to disconnect the actually end-to-end encrypted iMessages from the iCloud backups for many years.

So since most people kept their iCloud enabled, that meant their "iMessage end-to-end encryption" was nothing of the sort, as all messages had a copy that Apple could read on its servers.

I actually don't know if this is still true since I haven't used an iPhone in some time, but I sure hope it isn't anymore.

Re: Apple dropped plan for encrypting backups after FBI complained

#92

Post by panarky »

antonyh wrote: post #65
panarky wrote: post #20

Earlier quoted context omitted.

If you "need" an iPhone more than you "need" a competitor with end-to-end encrypted backups, then you've voted for Apple.

If only there was a viable competitor phone. The choice is iPhone or some flavour of Android. Even if Android had E2E encrypted backups, it leaks is so many other unpleasant ways that it's not even a choice. For me it's a vote for less tracking, or at least less invasion. It's not saying it's perfect or even close. There's a ton of things I'd change on iOS if I could. So yeah, I 'vote' Apple because the alternative i…

> Even if Android had E2E encrypted backups

They do. Including an independent third-party security audit.

> it leaks is so many other unpleasant ways

I recall Android security used to lag behind Apple at the device level, but I'm not sure that's still true with current hardware and OS. Could you educate us on the current state of Android data leaks?

For me, my device should have full-disk encryption, sandboxed apps and fine-grained control over app permissions. Both iPhone and Android have that.

Intentionally leaving iCloud insecure in the absence of legal compulsion is a sneaky evasion of all the much-ballyhooed device-level security.

Re: Apple dropped plan for encrypting backups after FBI complained

#94

Post by croo »

inetknght wrote: post #9
panarky wrote: post #5

Earlier quoted context omitted.

You vote every time you decide to buy or not to buy.

That's not how that works at all. You can buy something you need because you need it and that's not at all a vote saying you like the management of how it was produced.

Pricy high grade smartphones are consumer grade stuff not something you "need". You can absolutely vote with your wallet.

Maybe if you develop for it but then again why did you choose Apple's platform?

Re: Apple dropped plan for encrypting backups after FBI complained

#95

Post by CiPHPerCoder »

_bxg1 wrote: post #80
CiPHPerCoder wrote: post #43

End-to-end backup encryption is hard. Apple had faced criticism from cryptographers for failing to implement it. https://blog.cryptographyengineering.com/2012/04/05/icloud-w... The fact that they started working on the problem then abandoned it after the FBI complained is disappointing, especially to Apple consumers. But all it means is the status quo marches on. Headlines like this vindicate my decision to never pur…

And which phone do you use in its place to participate in basic aspects of modern life?

Please define your terms.

Why do I have to use a phone in its place? Apple products aren't a basic human necessity. I like to think I can just use a phone for the sake of wanting a phone, not to replace the void that not being an Apple consumer leaves in my soul, or something.

What exactly do you mean by "basic aspects of modern life"?

I have a desktop PC, a laptop, a work laptop, a LineageOS (Android-based) phone, and a VR headset for gaming. Anything I want out of modern tech, I either already have or doesn't exist yet.

Re: Apple dropped plan for encrypting backups after FBI complained

#96

Post by snowwrestler »

mrtksn wrote: post #57

Apple has a list for that: https://support.apple.com/en-us/HT202303 These are end to end: Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information QuickType Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords The messages also end to end but the backup contains the private key. The moral of…

I thought iMessage private keys are somehow based on data in the "secure enclave" chip, and thus not able to be stored in the cloud. It's my understanding that Apple could add new "devices" to listen in on future conversations, but it can't read iMessage conversations in transit between existing devices.

It can also read iCloud backups of conversation content, which are created by the client device after decrypting the message. But that's not the same as storing the private key itself in the backup.

Happy to have my understanding updated...

Re: Apple dropped plan for encrypting backups after FBI complained

#97

Post by aiisjustanif »

newscracker wrote: post #90
dpau wrote: post #72

Earlier quoted context omitted.

Just a reminder, Apple ceded control of its iCloud management in China to a state-controlled company, in addition began storing its encryption keys in China in order to "comply with local regulations". So whether or not your backups are encrypted is almost a moot point, given that the government can submit a lawful demand for your data at any time.. Apple will store some iCloud encryption keys in China, raising secur…

That’s only for devices where the region is set as China. Why would it be a moot point elsewhere for that reason?

Injustice anywhere is a threat to justice everywhere.

Re: Apple dropped plan for encrypting backups after FBI complained

#98

Post by panarky »

brosinante wrote: post #82
panarky wrote: post #35

Earlier quoted context omitted.

It's mostly marketing bullshit. Apple and Microsoft both tried to build ad businesses, but when they weren't as successful as Google, they turned lemons into lemonade by launching data privacy PR campaigns against Google. Meanwhile, Apple and Microsoft quietly censor their products in China, surrender data to Chinese authorities, and now we find Apple is intentionally leaving iCloud data insecure. Presumably Google w…

Yeah, the current privacy dystopia is obviously just evil apple and microsoft sticking it to noble google.

Certainly not.

But distinguishing PR bullshit from actual practice is essential when navigating the dystopia.

Re: Apple dropped plan for encrypting backups after FBI complained

#99

Post by fsflover »

nexuist wrote: post #75
CiPHPerCoder wrote: post #43

End-to-end backup encryption is hard. Apple had faced criticism from cryptographers for failing to implement it. https://blog.cryptographyengineering.com/2012/04/05/icloud-w... The fact that they started working on the problem then abandoned it after the FBI complained is disappointing, especially to Apple consumers. But all it means is the status quo marches on. Headlines like this vindicate my decision to never pur…

>Headlines like this vindicate my decision to never purchase an Apple product. What else can you buy? Surely not Android...do you live without a smartphone (serious question, not judging)?

Waiting for Librem 5.

Re: Apple dropped plan for encrypting backups after FBI complained

#100

Post by derefr »

panarky wrote: post #35
WilTimSon wrote: post #17

Reminds me of WhatsApp claiming it had encryption everywhere and then this [0] dropped. Except, in this case, I'm actually surprised. Didn't Apple publicly claim that it wouldn't bow down to any demands from the agencies? [0]: https://www.theinquirer.net/inquirer/news/3061660/whatsapp-i...

It's mostly marketing bullshit. Apple and Microsoft both tried to build ad businesses, but when they weren't as successful as Google, they turned lemons into lemonade by launching data privacy PR campaigns against Google. Meanwhile, Apple and Microsoft quietly censor their products in China, surrender data to Chinese authorities, and now we find Apple is intentionally leaving iCloud data insecure. Presumably Google w…

A good way to figure out whether this kind of claim is marketing bullshit, is to look for a PR claim that goes the other way: that Apple or whoever helps the FBI find uploaded images of child sexual abuse. If they are matching on your data, they can’t be encrypting it; if they’re encrypting it, they can’t be matching on it. It’s one or the other.

And, well, Apple have confirmed that they‘re matching on your data[1]. So, guess what?

[1] https://www.scmagazine.com/home/security-news/apple-scans-ic...

Post reply on HN