Apple’s New Privacy Technology May Pressure Competitors | Hacker News Reader

Apple’s New Privacy Technology May Pressure Competitors

technologyreview.com

63 pointskawera44 comments

Unfortunately nobody is selling the phone I want: an actual open-source (probably linux) phone. I had the original iPhone, but won't get another one unless they go open-source. I have an Android, but I hate it's closed-off, blobby mess. I'm extremely glad Apple is pushing privacy, but I just can't support them until they put their money where their mouth is. I'd love an alternative to these, but I've yet to see any decent ones that are available to me.

Apple is on a PR campaign to sell privacy to users the past few years. Do customers care though?

Yes, post the Edward Snowden revelations, many people around the world have woken up to the fact that their privacy, or whatever they imagined to have of it, is being compromised at many levels by many players.

Apple has been beating the privacy drum louder every time it makes an announcement on its software, hardware and features, and at the same time, the silence from the other big players (like Google, Facebook, Microsoft) seems damning on them. People who do keep up with tech news know about these differences.

People who are worried about this and who can afford to buy Apple devices (in a worldwide market where very cheap Android devices rule) would likely do so even in the face of losing some flexibility and freedom (compared to what they could do on Android). For this to take off in a bigger way, Apple could at least do the following two things:

1. Sell devices with good hardware at price points that are considered cheap enough (not necessarily "cheapest") in developing countries too.

2. Improve significantly on the software experience and storage front. For example, providing free cloud storage as large as the capacity of the Apple device purchased (or even more) and avoiding competitors like Google Photos taking over Apple customers (and their data) for photo storage and sharing is one thing. Another example is improving maps, which is utterly terrible compared to Google maps in many places around the world.

> Do customers care [about privacy]?

A data point: Yesterday, a German net politics outlet published a representative poll conducted on behalf of the German government, which showed that 92% of citizens polled want the government to take a stronger stance on data protection. Source: https://netzpolitik.org/2016/bundesregierung-befragt-bevoelk...

I can't read German, was the question:

Should your phone help protect against criminals stealing your identity?

Should paedophiles be allowed to swap photos of children in secret?

Neither/both.

How much should politicians care about data privacy?

Proponents of either of your examples would have answered "lots".

Meh, that's phrased in a way that is hard to say "yeah" to. I mean, if you ask someone "do you want ice cream?", who would really say no?

In the main probably not, sadly.

That might not matter though. People ask their "tech friends" about phones and computers, I know people ask me all the time. The "tech friend" is much more likely to care about privacy and to bring it up as a concern when their friends ask them about iPhone vs Android for instance.

They do care, even if they don't fully grasp what details they should care about.

Since we're often that "tech friend", we should know what we're talking about:

iOS Security white paper: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Apple's privacy pages: http://www.apple.com/privacy/

How iOS Security Really Works: video of a session from WWDC 2016 — https://developer.apple.com/videos/play/wwdc2016/705/

I think they like the idea of it, but don't really understand the implications. Based on the top free apps, it does not seem to be a "real" requirement...

Pokemon Go, Facebook, Snapchat, YouTube, Instagram

Does anyone know if the "differential privacy" is done on the device before send the data to Apple? Seems unlikely, but oddly couldn't get an answer from Apple.

From the article: "In the version of differential privacy Apple is using, known as the local model, software on a person’s device adds noise to data before it is transmitted to Apple. The company never gets hold of the raw data."

Yes, that's the whole point. Apple's servers never see the raw data.

It looks like it is done on the device based on the framework header : https://github.com/JaviSoto/iOS10-Runtime-Headers/tree/maste...

Interesting. I thought that with DP the user data is anonymized by a random function with the value range based on the complete sample set. I also expect that the data is encrypted before transmission and I expect some kind of unique signature which is somehow stored on the device. The transmission itself is certainty logged on client and server side.

If I understand this framework correct the epsilon range for the randomization can be selected by hand before the transmission and also the number of collected parameters is not limited. Why is this called "differential privacy"?

Perhaps named because the system is based on differences between the true value and the reported value .... and then summing the aggregate data removes these 'differences'.

If a data collector can choose the epsilon range and the linked parameters by oneself, s/he could choose small (irrelevant) or too large (expandable) ranges and could try to cross reference the result via data-mining (already collected data).

True.

"[...] software on a person’s device adds noise to data before it is transmitted to Apple. The company never gets hold of the raw data."

So I guess yes?

Why unlikely? Doing it anywhere but in the device would defeat the purpose of the whole system.

I am fairly happy with my "hardware stack" right now: iPad Pro, several Linux laptops, leased Linux servers, and a nice Android phone. Great gear.

However, because of privacy issues, and even as a FSF member, I can imagine a possibility of 10 years from now just using Apple solutions if they keep promoting privacy and security.

My preference would be all open source in my hardware but I am not sure if small production libre hardware will ever be competitive.

If Apple really cared about privacy they wouldn't ask for your data. But, they quickly realized they needed your data to even be remotely competitive. It's funny that they criticize Google and other companies for using your data, but seem to think their impervious to the criticism because they're using "differential privacy". Apple is no better than the other companies using your data and trying to cloak their objectives with a PR campaign to justify their actions is typical Apple hypocrisy.

I have yet to see evidence of Apple selling personal data in the same way that Google does. I don't trust them, because they are closed off, and could be collecting it nefariously, but we really don't know if they are being genuine or not.

Google doesn't sell personal data. I'm amazed how many people don't understand this. Google makes their money by allowing advertisers to target certain demographics - the same way Apple tried to with their failed iAds service.

Possibly poor phrasing on my part, but that doesn't affect my point.

Also, Google stores personal data, which makes it an issue. Privacy isn't just about sales, it's also about malicious actors having access to it.

Apple, as do countless other companies, also store personal data and use it for personal gain.

I'm not defending apple, I'm just saying we don't know what they collect, or how they use it. Google clearly has a business model that relies on gathering the most data and using it.

And Apple doesn't have a business model, either direct or indirect, for collecting and using your data? We're in the age of context. Every company that wants to play in this game needs as much data as they can get about you. Apple is no exception, but they're going to use their PR machine to deflect the negative connotations surrounding it.

Oh, I totally agree that it's possible, and even likely that they can and do use your data. That's one of the reasons I don't use their products. I'm saying that they don't rely on it nearly as much as Google, and at the end of the day, we don't know what they collect.

How are they going to apply this to data sent to the iCloud? Is that data encrypted client-side?

Something smells fishy here.

Its done on device before its ever sent to iCloud.

When people talk about apple they are always quick to call out that "Apple has all your data", yet are complicit with google snarfing up everything they can.

Until Apple can fix this PR image, then they wont be pushing competitors to do anything.

I don't think that Apple has a PR problem regarding privacy when compared with Google. Especially looking at the privacy adverse stance Microsoft has taken with Windows 10, Apple seems like the smallest privacy evil out there. I personally will be switching back to iOS with my next phone after using Android for three phone generations.

The smallest privacy evil is still Linux. (Which, of course, is not an OS most people consider.)

Never hear that criticism of Apple before. That's more of a Google criticism, isn't it? The usual criticism of Apple is that their products are overpriced, overhyped & overly locked down. (Not my opinion by that's the default criticism.)

Even non-sophisticated users get that Apple sells devices and therefore doesn't need all of their data vs. Google who sells ads based on mining their data.

The recent case where Apple basically told the FBI to pound sand when they requested Apple create a custom version of iOS to allow them to brute-force the passcode of the shooter in the San Bernardino attack showed everyone that Apple is willing to defy the Justice Department even in mass shooting.

You can't buy publicity like that.

But the same MS researcher that developed "differential privacy" has said and explained how its not really effective except for in short terms studies. I'm surprised a publication coming from MIT would not bring that up. It seems like its just "clever" marketing on Apples part. Also Chrome already employees "differential privacy" for w/e thats worth.

Do you have a quote for the first point? It doesn't sound (i) correct, or (ii) like something Cynthia would say.

Its inherent in the understanding of what "differential privacy" is. But please listen to her explain it herself, http://www.sciencefriday.com/segments/crowdsourcing-data-whi...

Basically, its either your statics approach meaninglessness and maintain the individuals privacy or "overly accurate estimates of too many statistics is blatantly non-private"

More so, is there proof of the second quote that Chrome uses differential privacy?

Not sure if this[0] is exactly what you're looking for but, I think it's baked into chromium[1].

[0]http://static.googleusercontent.com/media/research.google.co...

[1]https://www.chromium.org/developers/design-documents/rappor

It's mentioned in the article: RAPPOR.

Apple and their PR, as always.

Reply on news.ycombinator.com