Hacker News Reader

Comment by threeseed | Hacker News Reader

Something that doesn't get enough attention.

iCloud Keychain stores the passwords, SSH keys, client side certificates etc for third party sites. That means that sites like Facebook, Google etc would be compromised on the biggest scale in history if Apple were to hand over encryption keys to the Chinese government. Not to mention the national security implications e.g. my work VPN credentials are in iCloud Keychain.

There is no way Apple would be stupid enough to allow this situation to persist without informing users unless they maintained the keys and it was a moot point. Otherwise they are inviting themselves up for all sorts of legal issues. Not to mention people who travel to China for holiday/work purposes.

View on HN

Apple doesn't even have the encryption keys for iCloud Keychain. They've taken a very hardcore secure approach to this that is explicitly designed for "adversarial clouds". This isn't true for all iCloud data, but the most sensitive stuff like keychain and health data use end-to-end encryption.[1]

What's impressive is they've implemented a backup solution for this that still retains end-to-end encryption. They use HSMs to encrypt a keychain "escrow" backup using your device passcode. The HSMs protect against brute forcing and Apple has no way to bypass -- they literally put the firmware administration keys in a blender.[2] It's pretty cool.

[1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf

[2] https://www.youtube.com/watch?v=BLGFriOKz6U&feature=youtu.be...

> Not to mention people who travel to China for holiday/work purposes.

Like a lot of Apple employees themselves, considering so much of the manufacturing is there. I would love to be a fly on the wall of their infosec team.

Exactly. And I worked at Apple and it's not like we were given special phones with enhanced security. It's just a standard VPN to log on to internal sites.

And of course the problem with keychains like this is that surely amongst one of your previous accounts is the password you used for your VPN and/or work email.

Interesting. Google treated remote access from China or employees based in China differently even before Aurora:

http://fortune.com/2011/04/15/inside-googles-china-misfortun...

Maybe in ten years or more someone (Farris?) will describe the details behind the scenes about the cat-and-mouse, the unexplained outages, etc.

Interesting read. The ending is grim and sad when you read it now. Lee's words from 7 years ago now ring hollow and false:

Kai-Fu Lee now says that if you look at China’s behavior over a long horizon—20 or 30 years—it’s clear that the trend is toward more openness. The incidents that led to Google’s retreat were “a perturbation” in this movement, mainly because Chinese leaders had reached their limits. “The next generation will come up in less than two years,” he says. “They’re younger, more progressive, many American-trained, and many have worked in businesses and run banks—they’re going to be more open.”

Considering China back slided in the past decade (opening up before 2008 then hitting reverse afterwards), we will have to wait and see. The current leadership came of age during the cultural revolution, which probably has a lot to do with the current trend to authoritarianism, many them only got honorary degrees when the schools reopened in the late 70s. The next generation of leadership should be much much different.

Has it actually backslided, or has enforcement just caught up with the technological capabilities of the people trying to avoid it?

Was China actually more free in the 90s, or the 00s, or was it just easier to get away with it?

China was more open in the 80s, less open in the early 90s, and then increasingly open until 2008. After 2008, it went down hill.

> and then increasingly open until 2008

Could you cite any examples? I'm asking about China, not Hong Kong. Every time I ask this question, I am consistently pointed to repression in Hong Kong.

I’m only referring to mainland. 1980s obviously building up to 1989, where there was a huge regression after Tiananmen. Then it started opening up again, working it’s way to the Olympics to show the world that China was no longer closed socially and economically (we could even access Facebook and gmail back then, note that CNN was blocked in 2002 but not in 2008 and not today). After the Olympics, everything was cut back: more censorship, internet great fire wall blocking, crackdown in minority areas, and so on, building continuously until today.

Yeah, I don't know what kind of leaders he was thinking of when he said the next generation would come up in two years. At least at the very top, it might take decades.

This seems to be a global trend. Trump in the US, populism and fascists in Europe and Jinping in China.

You don’t understand how iCloud Keychain works and are spreading FUD. GP already linked the white papers which explain why what you are saying is inaccurate.

Some data stored on iCloud (like iCloud Keychain) is commingled (not quite the right word, but the right word escapes me — mixed up with) with passcodes and hardware keys from the local device. https://support.apple.com/en-us/HT202303

Entangled?

Reply on news.ycombinator.com