Hacker News Reader

Comment by kyrra | Hacker News Reader

Though I believe Apple bowed to China to give them access to Chinese citizen's iCloud data. But you can operate an iPhone without iCloud fairly easily, which is definitely nice. Doing more on-device helps them here.

https://www.theverge.com/2018/7/18/17587304/apple-icloud-chi...

View on HN

Also several of the iCloud services are E2E encrypted and designed to withstand adversarial clouds. They talked about it at Blackhat.[1]

Doesn't help things like mail or photos, of course, but it is extremely notable in the China context for one big reason: it does E2E encrypt messages. WhatsApp was banned from China when they implemented this. Apple stands out in this way... although they're probably getting away with it because most Chinese don't use Apple Messages.

[1] https://www.youtube.com/watch?v=BLGFriOKz6U

Yeah but even if they use e2e, which btw was found to be flawed at the protocol design level by prof. Matthew Greene and his team, they also automatically back-up the messages to iCloud with no way to disable that without disabling the whole of icloud. It would sure be nice if they changed that.

Can you elaborate on what you mean by "e2e was found to be flawed"? Is the paper available online?

Commenter probably meant this research[0].

[0] - https://blog.cryptographyengineering.com/2016/03/21/attack-o...

There is the option in Settings to disable storing Messages and Backups in iCloud.

...which does not affect the storing of Messages in device backups into iCloud.

This is categorically and demonstrably false. Backing up to iCloud is disabled by default, as is Messages in iCloud. Either can be enabled or disabled as desired with no ill effect on your device or the rest of iCloud usage.

iCloud backup is on by default.

No - setting up an iPhone from new doesn’t even require an iCloud account. If you set up iCloud it will enable backups, but even then you can disable them without disabling ‘all of icloud’ as GP claims.

The fact that iCloud is not required to activate does not change the fact that iCloud is on by default and iCloud backup is also on by default.

I suspect that there might be undiscovered software differences between iPhones sold in China and those sold in other markets. The Flag of the Republic of China (Taiwan) is not present on iPhones sold in China. It shows up as a box with a question mark in it.

If you're implying they secretly disabled iMessage encryption for the China locale: No Friggin Way. That would be discovered and publicized instantly.

Not to venture into conspiracy theory territory but the fact that they have the capability in software to modify the phone's behaviour based on which country the device was sold in is concerning enough to me. The Chinese gov. can put pressure on these large multinationals that rely on China's workforce and those companies can't do a great deal about it other than comply.

Which is why I have been crying for an iOS Time Capsule.

I don't want to touch iTunes and do computer backup, that is like a very geeky way do it and most people in China don't even have Laptop or Desktop. If they can make Dual Sim and other features targeting the Chinese market; Apple's second biggest market, why cant they make Time Capsule specifically for China. ( Making it China only will likely piss off the Chinese Government. They could release it worldwide to avoid this.)

There is an iPhone Time Capsule... it's called iTunes and it has support full, encrypted device backups via home Wifi for years...

"I don't want to touch iTunes and do computer backup, that is like a very geeky way do it"

Oops :(

They have iCloud for that.

Right, and that’s back-doored by the Chinese government (in China). So neither fits gp’s desired featureset of local & frictionless.

Evidence of back door?

https://www.reuters.com/article/us-china-apple-icloud-insigh...

The encryption keys for Chinese users are stored in China, and the government has full access to data and keys on those servers as per Chinese law. Maybe “backdoored” is the wrong word since they can walk in the front door.

Can't reply to the guy below you but there might be some truth to this. Companies running servers in China must give up the login keys to the government. iCloud in China is not operated by Apple themselves, but a Chinese partner vendor.

Exactly. It is not really a backdoor per se. And there isn't any law sitting in between your iCloud Data and government trying to collect it.

>full, encrypted device backups via home Wifi for years

I never knew that - this might be a much better option than iCloud backup

Have ou tried iMazing?

Isn't that iCloud? Or are you looking for an onsite backup?

My parents barely touch a computer and I haven’t backed up in ages.

I would immediately buy 3 if these.

Without a public statement even saying they disagree with it, which seems to go against their pro-privacy principles and goes against what they've done in other government-based privacy disagreements they've had. I wish they'd make actions against their principles more transparent lest people think it's just lip service they are paying to the masses.

Can’t you just select US sad your country when setting up the iCloud account and use a VPN? Or are Chinese devices different at the hardware level and only allow connecting to the Chinese (compromised) iCloud?

VPNs in China get blocked all the time.

Even private VPNs? I'm not that smart about networking but it seems like it would be difficult to distinguish an SSL/TLS connection to your DigitalOcean server because you're doing normal stuff and one where you're tunneling HTTPS through it.

Their deep packet inspection tech is very very good.

It's not hard to distinguish a VPN connection by behaviour pattern really. Some simple features to detect:

Both small packets and maxing out the window size in one stream. Lack of DNS queries from the host. Single connection dominating the bandwidth.

There's a reason for all of those of course, but put them together on a residential connection: almost certainly a VPN user.

And these are all really simple heuristics. In practice, we know you can identify which Netflix video are you watching just by the packet sizes/timing.

There was a post recently about how someone was able to set up his own vpn which bypassed it. Something about the server padding out its response with garbage data?

You are still piping all of your traffic through one server. This would not look like a regular usage pattern by any means.

You need a payment method with a billing address in the country.

I believe there are tricks you can use to bypass that (attempting to download a free app?).

I have Apple and Android phones.

I have a specific google account for my Android phones specifically because you can’t do anything on an Android without logging in. iPhones still work as phones just without cloud storage.

Maybe I'm missing something here but what can't you do on Android without logging in (other than Google services of course)? You can download apps to do pretty much anything you want without even touching the Play Store, as far as I'm aware you need an iCloud account to download any apps on an iPhone.

Yea, not sure what he's talking about. You can choose not to sign into Google and use the web browser to install either fdroid or Aurora as the app store. Pretty sure you need to sign into iTunes to use the apple app store and cannot install any ipa?'s.

> an iPhone without iCloud

Would it send less telemetry data to Apple?

No, but not turning on telemetry does.

You are asked every single OS update whether you want to enable telemetry or not.

And the default is no.

Reply on news.ycombinator.com