Every story about Apple and privacy chooses to omit thus huge piece of info.
Why should anybody trust them now? What has changed to make anybody believe they aren't still lying about privacy?
"Not" being a partner in PRISM doesn't mean much; it just means you're legally obligated to handle that paperwork by hand. Like every other company in the country, you're still required to comply with a valid 702 directive.
“We have never heard of PRISM. We do not provide any government agency with direct access to our servers, and any government agency requesting customer data must get a court order,” stated Apple spokesperson Steve Dowling.
http://www.cheatsheet.com/technology/is-apple-lying-about-it...
Other investigative reporters have worked out what PRISM was. Now we're all pretty sure we know. But that doesn't mean the tech companies at the time had any clue. It is somewhat unlikely that the thing that sent them 702 directives was, to them, referred to as "PRISM".
Generally, I find, when PRISM gets introduced into a discussion about Internet privacy, the discussion gets rapidly dumber. I'm not saying that's happening here, but it's a risk. If you're going to talk about it, you should have better sourcing than whatever the hell "The Cheat Sheet" is.
One thing we're certain of, however, is that Apple has the signing keys. They also encrypt their firmware and even other apps to hide how they work.
I hope you're not expecting them to open source the secure enclave.
The calls and messages should be end-to-end encrypted but they are in control of the PKI so they could probably eavesdrop if they wanted.
On stage at Black Hat, Ivan Krstic claims that hash function to have been a Vitamix blender.
Almost always, when companies claim to encrypt things serverside, they're doing something shady. And it is always preferable that secrets be kept on devices and never touch servers. But Apple is taking the problem seriously.
Thank you for this kind of information. Very grateful to have this stuff at hand.