Hacker News Reader

Comment by jwtadvice | Hacker News Reader

Pixel/Google does not motivate a threat model under which to evaluate or understand their design and marketing promises, but we can take a hint from "protects your data if your phone falls into someone else's hands." - Namely thefts of opportunity.

Unlike other phone manufacturers, Google does not promise potential customers that your data will be protected from Google, it's partners and from law enforcement and mass surveillance programmes.

Therein this product doesn't provide a stronger security posture that competitors - and furthermore it's threat model and security properties do not meet what are in my opinion minimal reasonable requirements.

View on HN

>Unlike other phone manufacturers, Google does not promise potential customers that your data will be protected from Google, it's partners and from law enforcement and mass surveillance programmes.

Are you referring to Apple? Because they don't promise that either.

I used the term 'motivate' specifically because of the PR language intending for customers to evaluate the Apple product as something that could be used by those who need to use their phone for private and/or sensitive reasons.

Apple of course backdoors their phones for government surveillance access. But they do motivate a threat model that includes government surveillance.

I know parsing my comment in this way may seem difficult, but I used the terminology I did on purpose.

There are no illusions that Apple achieved the security properties that it has motivated.

Google Pixel does not even pretend to address the security concerns of journalists, politically active citizens, IT professionals, or individuals contacting attorneys.

> Apple of course backdoors their phones for government surveillance access.

Nice job slipping a completely unfounded lie into your response.

Starting with iOS 10, you can actually just mount the root filesystem disk image from iOS restore images. You are able to reverse engineer and audit any application or daemon that the OS runs. You can use open source tools (Such as idevicerestore) to perform an OS restore on your device, and point it directly at the filesystem disk image that you just audited the binaries of. That way you can be sure of what is being flashed onto your device if you have any doubts that the OS you just audited is the one going onto your device. No "blackbox" at all in this process.

I am looking forward to hearing any form of evidence regarding your claim.

How can you say you're able to audit any application or daemon without viewing the actual source code? Case in point - if the sslKeyExchange.c code had not been published the "goto fail" bug would likely still be in the wild.

Reverse engineering tools like IDA can be used to audit closed source code. However, this takes significantly longer than reading source code, and it's not exactly feasible to audit the entire operating system for something (hypothetically) intentionally hidden.

That is not true. In fact, the "goto fail" bug was only known because it was patched in iOS and then some folks dug into the SecureTransport sources. You may be thinking of the fact that, from what I understand, OS X was not yet patched at the time so this was considered big news (See here: https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-got...).

Definitely an issue, but seeing as it was patched in iOS (and thus discovered in the SecureTransport source code), it would most certainly not still be in the wild.

With regards to auditing: The machine code is available for review, you just need to invest some time into learning the ARM instruction set. Most users of HN have invested time into learning various programming languages and that is why the trope of "open source == more secure" is often repeated, but the truth is that ARM assembly is just another programming language and is almost never obfuscated to a point in which you would not be able to read through it and understand what is happening once you understand the instruction set.

Chronic: but the bootloader of the device is still encrypted and not subject to your audit (well, maybe you can audit it, but most people can't ;P), which totally undermines the chain of trust you just laid out...

Not for 32-bit, although fair point for 64-bit.

That said, an iBoot-level backdoor may not be as useful these days, considering Data partition is still protected with passphrase (and 10-attempt limit being SEP-enforced now).

I suppose you could argue root filesydtem access would be a concern, yet you would still need multiple zero-days to get persistence, defeat CS, etc.

While the argument regarding auditing is valid (for 64-bit), we both are aware that certain parties have privately been able to decrypt those. I highly doubt they would not say something if they had discovered a backdoor in iBoot.

> Nice job slipping a completely unfounded lie into your response.

Oh my.

Yes Apple backdoors their phones for government surveillance access.

There's no sneaking here. I'm saying it very clearly as a central tenet of my comment.

-----------------------

Here's a list of things that Apple will provide from Apple's own Guide for Law Enforcement Access:

- Device Registration (name, address, email address, telephone number, iCloud Apple ID)

- Customer Service Records

- iTunes (name, physical address, email address, and telephone number, purchase/download transactions and connections, update/re-download connections, and iTunes Match connections, iTunes subscriber information and connection logs with IP addresses, specific content purchased or downloaded).

- Apple Retail Store Transactions (cash, credit/debit card, or gift card transactions, type of card, name of the purchaser, email address, date/time of the transaction, amount of the transaction, and store location, receipt number)

- Apple Online Store Purchases (name, shipping address, telephone number, email address, product purchased, purchase amount)

- iTunes Gift Cards (sixteen-digit alphanumeric code, nineteen-digit code, any purchases, name of the store, location, date, and time, user account

- iCloud (music, photos, documents, iCloud email, encryption keys, Subscriber Information, iCloud feature connections, connection logs with IP addresses, Mail Logs, records of incoming and outgoing communications such as time, date, sender email addresses, and recipient email addresses, Email Content, Other iCloud Content, Photo Stream, Docs, Contacts, Calendars, Bookmarks, iOS Device Backups, stored photos, documents, contacts, calendars, bookmarks and iOS device backups, photos and videos in the users’ camera roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail)

- Find My iPhone (including connection logs)

- Other Available Device Information (MAC Address for Bluetooth, Ethernet, WiFi, or FireWire)

- Requests for Apple Retail Store Surveillance Videos

- Game Center (Connection logs with IP addresses, specific game(s) played)

- iOS Device Activation (including upgrades the software, IP addresses, ICCID numbers, and other device identifiers)

- Sign-on Logs (iTunes, iCloud, My Apple ID, and Apple Discussions, Connection logs with IP addresses, Sign-on transactional records)

- My Apple ID and iForgot Logs (password reset actions, Connection logs with IP addresses)

- FaceTime (logs when a FaceTime call invitation is initiated, content protected by 15 bits of entropy if secure enclave baked key is obtained from manufacturer)

And, from this thread on HN today (https://news.ycombinator.com/item?id=12977612): All call logs including contacts, timestamps, and durations including for third party applications on the phone like WhatsApp, Skype and Viber.

Nothing listed is a backdoor.

US law means that Apple must turn over data when demanded by authorities. These are access logs or files stored on Apple servers.

A backdoor would be granting access into your device so that authorities could access your non-icloud email, or data saved locally on device.

> Nothing listed is a backdoor.

I'm baffled. I like to think of the quality of HN comments as much higher.

Apple had options to make this data unavailable by design to themselves and to law enforcement. They chose a design so that they could provide this information. The phone does it without the user's consent.

However, I understand that there are people who would rather redefine terminology to suit their cognitive dissonance.

In any case we can agree on the following:

-----------

Apple provides a near majority of your sensitive information to law enforcement by the design of the product, and you can not use the product in a meaningful way without that information becoming available to state surveillance and state law enforcement.

It's not a backdoor because there is nothing bypassing the security of your iPhone.

All the data supplied comes from Apple's records, not your phone. If your phone was destroyed one day, and law enforcement requested this information the next, Apple would have no issue supplying it. They're not going to simply "not keep" records of your iTunes transactions and account details, for example.

Your complaints regarding the inability to use their product in a meaningful manner without letting Apple collect this data have merit.

There is no redefinition occurring here. Your claim was this:

> Yes Apple backdoors their phones for government surveillance access.

That very specifically is referring to the phone itself. Nobody would be arguing if you had said:

"Apple hands over non-encrypted information (such as webmail and other data that cannot be encrypted at a higher level) from iCloud and iTunes Store servers, in response to a valid legal demand"

This is silly, you can absolutely use the product in a meaningful way without exposing data. Just don't use iCloud or iMessage (just use SMS) problem solved; no personal anything will go to their servers.

Perhaps I am not following your logic correctly, but it sounds like you are saying "Apple says government threats are an issue, but then backdoors the phones for the government anyways." which, to me, paints Apple in a very poor light.

You are following my logic correctly.

To be fair, the amount of leverage the US exerts on businesses for military purposes is astounding. This should be factored into the understanding.

How would Google protect its customers from law enforcement and mass surveillance programs? The government can just force them to do whatever and issue a gag order to keep them quiet.

Apple is just putting on a show with their tough security rhetoric, they can't resist the US government if they really want some data.

I think the point that Apple is making is that they don't have the data in the first place (because of their device-side encryption).

Apple is doing more than putting on a show. They've actively trying to build ML products that don't involve sending everything back to the mothership ala Google, FB, etc., but rather store and execute on the local device. (The efficacy and user experience of these products remains to be determined.)

From a security standpoint, Apple wouldn't have anything to turn over, because they never had it to begin with. Google et al, hoover up everything the least bit interesting.

No, he's right. Apple is putting on a PR show. If a warrant is served to Apple they'll hand over whatever data they have on you including any metadata on your encrypted data. They also have teams working 24/7 to serve up this data to government officials and law enforcement. It's all in the leaked Apple/Podesta emails.

Your framing is disingenuous, considering that any large company will have staff ready to respond to legal / discovery demands. This is a legal process, not something Apple is doing out of their own volition.

I'm sure all large companies have staff to handle these requests for information, but this is the first time I've heard of a company creating a team that does nothing but hand over customer data 24 hours a day.

Apple VP Lisa Jackson:

>Please know that Apple will continue its work with law enforcement. We share law enforcement’s concerns about the threat to citizens and we work closely with authorities to comply with legal requests for data that have helped solve complex crimes. Thousands of times every month, we give governments information about Apple customers and devices, in response to warrants and other forms of legal process. We have a team that responds to those requests 24 hours a day. Strong encryption does not eliminate Apple’s ability to give law enforcement meta-data or any of a number of other very useful categories of data.

Plenty of telecoms have had 24 hour abuse desks, which generally handled this sort of thing. Even more specialized departments for law enforcement in the huge majors and you always had a 24x7 on-call legal counsel if needed. It is absolutely possible to get someone on in real time if you are Important(tm) enough and have a lawful reason that is life critical in nature.

Facebook, Google, Apple, Twitter, etc. all pretty much fall under the "telecom" label these days in what they do, so it's not surprising in the least.

Just expanding on that - not dipping my toe into any other part of this debate!

Yes.

For an understanding of what data Apple gives surveillance operations access to, the following list is enumerated in an older Law Enforcement Access document: https://news.ycombinator.com/item?id=12983081

It's also important to understand that the purpose for this surveillance (this following section being informed by the Snowden Disclosures) is not merely for investigative work or for tracking down terrorists. Intelligence work of this kind is used in HUMINT operations (mass propaganda), for industrial espionage, for diplomatic espionage and for signals collections (intelligence used to break into networks).

It is not clear whether Apple shares these concerns with the US government, or whether it shares lesser concerns that show up at a much lower frequency.

I agree with this. Government leverage on Apple is huge, as is the magnitude of public-private partnership. Mass surveillance of its products is not likely something that Apple would have pursued on its own.

However, it Apple has capitulated to a combination of carrots and sticks. Today, it enables surveillance of its customers.

Citation needed.

Reply on news.ycombinator.com