Hacker News Reader

I actually intend for my private data to die with me. I have gone out of my way to guarantee that it will. In my view, if I haven't published it, then it shouldn't be accessible.

I have absolutely nothing to hide. I have simply always treated my privacy as something that was valuable in it of itself. Perhaps even more valuable than the photos I clearly opted to not share with others, to go off your example.

I also don't understand why it's so absurd for some people to conceptualize non-malicious things you wouldn't wasn't to share with anyone but yourself. Hell, I have tons of notes and things I write to myself that I definitely do not want to be seen by anyone. They simply weren't written with the intention to be read by others. So I don't sympathize with desire to make a deceased person's private things accessible, even to family. Let it burn. It might have been the owner's intention all along.

Since you're responding to me I'm assuming you mean me, but I have no problem conceptualizing non-malicious things you would want to keep private.

The problem here is that a lot of the stuff stored on phones falls somewhere between "dies with me" private and "should pass on to my family" private. Or "should be recoverable if I lose my key" private.

Strong encryption makes it impossible to recover in the event of a lost key or pass on to family in the event of your death. So that's not necessarily a great default for, say, decades of family photos. It would be a huge tragedy if that was lost.

The good news is that Apple does provide tools to opt-in to stronger security, rather easily. For example, the Notes app was recently upgraded with note-level strong encryption. That might be a good solution for your most private notes, without endangering the survivability of your digital memories and assets.

Yes, It's different for everyone. I didn't mean to accuse of being one of those people, I was speaking generally there. I'm sorry if my phrasing was bad. My main concern is that people are scared to admit they use the best, because they will be accused of being criminals. The stigma is harmful.

Imagine if somebody is writing down there dreams, writing there intimate deep thoughts, tracking symptoms of a medicine, using drugs recreationally...etc. These things might be very very private and be totally abusable outside of context.

That's what a last will is for: "...and the passphrase for my inheritable private stuff is 12345; it's the file named Blah.xyzzy.foo on my desktop, decryptable using BazBarFoo (installed)."

Most people don't write wills. Their assets shouldn't be lost forever as a result. That would be terrible.

It would be better to opt-in to auto-destruct-when-i-die, not opt-out. It's more of a special case. E.g. create encrypted notes for super secret stuff you want to die with you, but let the default security for photos and documents be "private but recoverable in the event of death or forgotten key."

Not to mention, writing that password down in a will would be pretty bad from a security standpoint while you're alive.

Yes, autodestruct should probably be opt-in.

Most people don't stick their wills to their monitors with post-its (there are other secrets in there after all, and many people would like to know those); the legal system has mature tools that are surprisingly good at keeping such secrets secret until the release conditions are met. A will is a Solved Problem, with highly reliable solutions - consider the ways to prove that it is indeed to be opened. Contrast with most computerized solutions and "solutions" thereof, mostly hinging on some form of dead man's switch.

> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key.

Would you really expect Apple to recover the data in this scenario for the next of kin? I certainly wouldn't, and I wouldn't want them to.

I definitely would if it was a regular iCloud Photo Library with decades of family history, pictures of the kids growing up, etc. Imagine all that being lost. It's not what most users would want.

If there was something the deceased person truly wanted hidden from their next of kin, they could use stronger encryption for that. The Notes app, for example, allows for note-level strong encryption. But it's not an ideal fit for the more typical use case.

Anyway, they do it.[1]

[1] http://www.cnet.com/news/widow-says-apple-told-her-to-get-co...

I think they do when they get a court order authorizing it from the estate.

One of the "knock it out of the park" features of icloud is that it lets you trivially share photostreams (It's the one service that I've found close to flawless) - so all those shared pictures are still available to the family who you shared them with should you pass away.

I certainly don't know if Apple should, without a court order, share any of my data that I haven't explicitly shared with next of kin if I passed away.

I'm wondering though - what happens if I stop paying my $2.99/month for 200 GB - will any of my existing photos be wiped out of shared photostreams?

They do require a court order, reportedly.

The problem with requiring explicit sharing is that a lot of people don't realize they need to do it to properly navigate these future events. Just look at how many people fail to write wills. You wouldn't want real-world assets to automatically get destroyed because you failed to write a will, even though there may be some things in there you didn't want to pass down. The "failsafe" mechanism there is, a court figures it out. So that's apparently what Apple is doing.

But keep in mind this is not just about next-of-kin. It's also about the ability for you to recover your life if you forget your password. That is why Apple will always have a "backdoor" into iCloud.

> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. So Apple wants and needs to provide an alternative way to recover the account. (For example, they will provide access to a deceased person's account if their spouse can obtain a court order proving the death and relationship.)

A pretty interesting point.

Photos are probably good to recover... unless they were photos of something horrible you did (beat up someone, sent photos of your anatomy, etc.).

What about text messages? Again, it could express what kind of person you are. Do all iOS users have unwitting diaries that will be unlocked at our death in the form of our iMessage and SMS history?

In 400 years, will our ancestors point out, "Wow, great-great-great-grandma was pretty awful, did you see this text they sent once?" in a way that removes context from the message written at the time. This is something we can't know about our ancestors... and probably for the best, since otherwise we might be disappointed in our ancestors.

Or maybe that's an okay thing?

Over the past few years services have been slowly starting to phase in a way to specify a person who can "inherit" access to your account in the event of your death. I know Facebook has it fully set up now (you can go into your security settings and specify a "Legacy Contact"), and I expect that in the near future it'll be a standard part of any service that intends to operate long enough for this to become a worry.

That is also an interesting point. It certainly comes up often when next-of-kin go through the private physical possessions of the deceased and discover secret love letters, diaries, etc. They probably wanted those to stay private.

But for bank account records, most photos, etc., you probably don't want those to disappear in the event of your death. You want those to pass on.

Given the choice between the two defaults, it makes a lot of sense for Apple to make "accessible to next of kin" the default, and "dies with you" the opt-in.

>The reason iCloud data will always be accessible by Apple, and thus governments, is [...] so that Apple can offer customers the very important feature of accessing their own data if they forget or otherwise don't have the password. That is an essential feature, and why this aspect will never change.

And may the era of homomorphic encryption schemes come and thus render moot the need for Apple and other companies to access unencrypted data as a plausible excuse when performing back-end processing/recovery on their client's data.

edit: well, to correct myself, as you said that wouldn't obviate the need for the feature of "recover data without password, after passing some other security tests"

There's an easy way Apple could offer a true cryptographically secure cloud backup service - support local backups with a physical keystore. Make it an advanced option but use it as an excuse to sell users a Time Machine backup unit with RFID built in to read a security key.

Apple could make truly secure systems user friendly if they wanted to. It seems they may see some value in doing so.

Local backups are not cloud backups. But there's already at least one 3rd party cloud backup provider that provides zero-knowledge encrypted backup as an option, with the caveat that the data will be forever lost if you lose the key (or die, etc.) [1]

It's just not an option that your average person would want for their family photos.

[1] https://www.backblaze.com/business-security.html

> The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments.

Q: Can't I already encrypt my iCloud data via a keychain?

I'm not exactly sure what you mean. iCloud data is reportedly encrypted at rest. The issue is that Apple has the decryption key. And they keep it in order to recover you from a lost password event, so that is likely to always be true forever.

Having said that, you can add another layer of your own encryption to certain data that is stored in iCloud, like for example the latest Notes app in iOS 9.3. Apple won't have that key.. but the app warns you the data will be lost if you lose it. You could also encrypt files you store in iCloud Drive using an encryption app. But you wouldn't be able to do this with other data that is managed by iOS like iCloud backups or photo libraries.

Quite the opposite: your keychain is stored as part of your iCloud data.

I guess you could send pre-encrypted data to iCloud to try to avoid Apple's backdoor... but of course if you do that from an Apple device, there is no guarantees...