Why should users believe that (closed source) iMessage encryption is free from backdoors when we know that Cook will dance around sensitive truths?
And why should the US government be satisfied with a fully encrypted iMessage given that Apple will cave to demands given enough pressure?
At least in China, you can probably assume iMessage is back-doored given that iCloud content in mainland China is operated by a Chinese internet company. Apple quietly posted this last week on their support page:
"iCloud services in China mainland are now operated by Chinese internet services company Guizhou on the Cloud Big Data Industrial Development Co., Ltd., (GCBD). This allows us to continue to improve iCloud services in China mainland and comply with Chinese regulations."
It goes on to say:
"iCloud services and all the data you store with iCloud, including photos, videos, documents, and backups, will be subject to the new terms and conditions of iCloud operated by GCBD."
Source: https://support.apple.com/en-us/HT208351
EDIT: After some research, it looks like the iCloud handover actually happened last year (https://www.theregister.co.uk/2018/01/11/icloud_china_goes_t...).
>Apple has already publicly said in court filings, and under threat of perjury, that they don't make any exceptions for China. From Apple's filing [1]:
>Finally, the government attempts to disclaim the obvious international implications of its demand, asserting that any pressure to hand over the same software to foreign agents “flows from [Apple’s] decision to do business in foreign countries . . . .” Opp. 26. Contrary to the government’s misleading statistics (Opp. 26), which had to do with lawful process and did not compel the creation of software that undermines the security of its users, Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. See Dkt. 16-28 [Apple Inc., Privacy, Gov’t Info. Requests]; Federighi Decl. ¶¶ 6–7. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests. See Federighi Decl. ¶ 5.
and a declaration from Craig Federighi personally [2]:
>Apple uses the same security protocols everywhere in the world.
>Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device.
>It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services.
>I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct.
When China wants something from iCloud they do it the same way that law enforcement does it everywhere in the world, which is through Apple.
[1] https://assets.documentcloud.org/documents/2762131/C-D-Cal-1...
[2] https://www.documentcloud.org/documents/2762118-Federighi-De...
Also note your documents are from 2016, these events mostly started in 2017.
"...You understand and agree that Apple and GCBD will have access to all data that you store on this service, including the right to share, exchange and disclose all user data, including Content, to and between each other under applicable law."
Shouldn't this be cause for concern?
[1] https://www.apple.com/legal/internet-services/icloud/en/gcbd...
[2] https://www.apple.com/legal/internet-services/icloud/en/term...
>Originally, iCloud data was stored on Apple-controlled servers, with the Cupertino company holding the encryption keys. Apple announced a year ago that this would change to comply with new laws in China, and that data for Chinese iCloud accounts would be moved to a server run by Guizhou-Cloud Big Data (GCBD), a company owned by the provincial government.
>However, I have spoken to Apple today, who confirmed that it still holds the encryption keys, and states categorically that they have not been made available to either GCBD or China Telecom.
https://9to5mac.com/2018/07/18/chinese-icloud-data-china-tel...
Because in the vice interview you keep citing he specifically dances around answering that question.
The servers were nationalized and the TOS agreement was changed since that 9-to-5 article came out.
Maybe Apple isn't giving access, but forcing the users to move to data centers which are later nationalized, and Then forcing users to agree to give access to that same state-owned company doesn't sound like they are restricting access anymore.
>Get a physically isolated instance of Azure for your cloud computing services—operated by 21Vianet, a company based in China.
Besides censorship and spying on users, China probably doesn't want it's company's data hosted in a place the US's 3 letter agencies can access it via an NSL.
https://azure.microsoft.com/en-us/global-infrastructure/chin...
I would be asking AWS about the future of AWS Hong Kong which has historically has had special freedoms from China. See current events for more on that.
Typical issue is the ICP License ( https://en.wikipedia.org/wiki/ICP_license ), which is why Western companies set up shop in Hong Kong.
I'm hopeful China would have a lot to lose by pulling the plug, since Hong Kong is a valuable interface to the West, but it might happen sooner or later with how unstable geopolitics is becoming.
https://www.chinalawblog.com/2019/10/chinas-new-cybersecurit...
The inspection team has complete access to the network system. Inspection can cover both the technical aspects of the network system and the data/information maintained on the servers. See Article 10. The inspectors can fully access the system and they are permitted to copy any data they find. See Article 15. The only restriction on the inspectors copying the data in your company’s system is that the inspectors must provide you with a receipt. Though Article 10 “restricts” access to matters involving national security, the definition of national security in China is so broad that there is no real limitation on what can be accessed, copied and removed.
I remember a hilarious 24h trip to Shanghai because the Chinese law firm had found somebody who was well connected and willing to talk to us. It was somebody's cousin. In the day long meeting, the lawyers were entirely tight lipped and refused to give any legal opinion, merely reading the letter of the law back to us (which is not useful at all in China). The only person who was willing to give any guidance (and preciously little at that) was the cousin.
It was simultaneously very serious, with lots of money at stake, hilarious, exhausting, exhilarating, difficult, full of (cultural, not legal) learnings, and very, very frustrating.
As someone who is going through this process currently (WFOE), the easiness of the thing was probably exaggerated by your lawyers ;). The most annoying thing is that it is quite hard to get a definitive answer of the kind of licenses one needs, who grants them, and especially the criteria to meet.
Yeah, it's qualitatively the same problem. Just there is prior art for physical goods. And I put the "easy" in scare quotes for a reason! Good luck!
Apple has been kind of marginal quality wise for awhile, mostly being better than the alternative because the alternative is garbage. But their handling of this makes much of what they say suspect.
I personally think it's a bit more complicated than that.
Although register an account is easy, maintain such account is a pain. First, not all Chinese citizen can get an international credit card that support US dollars, so no way to purchase apps; second, for those who can get one, App Store may not allow to use it because it’s not a valid US card; third, even they can use that card for purchasing apps, US App Store, iTunes Store may not have those Chinese specific apps or music; last not to mention that the behavior of an US account using non US card outside US for a really lone time may trigger anti fraud protection.
Would that also mean an individual wanting to avoid five eyes surveillance can register their account in China?
How do I know if my data is on the Chinese iCloud? I've been to China once and connected to iCloud.
As one can log in and out of multiple Apple IDs (from different countries) in the App Store without breaking anything synced with one's primary iCloud account, it's very likely that Apple encourages this as a best practice.
Quietly? They issued a support article and it was big news in most news outlets when it was released.
It’s time to stop being deluded. I’m going to stop paying premium for apple and assume all my devices are hostile by default.
What the actual fuck Apple.
Also, the privacy people talked about these days is more focusing on how these data got stored and used by companies and advertisement agencies. They shouldn’t use your data for profit without appropriate consent.
All the companies here in US will follow court orders and hand over personal data when they required. In this case, no company can again the court and refuse to provide data.
Back to this case. You can assume your dats is safe here in the US, because it’s protected by the laws.
I honestly don't think that you can assume your data is safe in the US. The laws are lax and not well-enforced (and are mostly civil in nature anyway). The US may be better than China on this score, but it's worse than a lot of other modern nations.
The reasons China's government has decried the app are bogus, but those false reports and allegations do not originate with Apple.
However, Apple appears to be accepting those reasons at face value and probably because Apple is kowtowing.
Regarding whether iMessage is free from backdoors, Apple has given no reason for anyone to believe they are outright lying about the technical features of their software and hardware or their position regarding privacy.
In other words, Apple appears to be caving into pressure from the Chinese government and Apple are openly admitting this surrender.
However, Apple has not to date lied about what they are doing and we do not yet have a reason to doubt their representations about the security of their encryption.
Except if you live in China and have backups/storage on iCloud used by the various things you do with your iPhone.
Here is another model: an organization that supports falsehoods to placate someone powerful in a small matter, like hosting an app, can be trusted to placate the powerful in a more important matter.
early 19th century: from Chinese kētóu, from kē ‘knock’ + tóu ‘head’.
Today, they showed that they are willing to lie under sufficient influence.
This sole data point is sufficient to tarnish what was assumed to be a perfect record.
There is no such thing as 99.999% integrity. Apple either has 100% integrity or is inviting you to play russian roulette with it’s products and services.
We might have already rolled the dice enough times - 1.4e9 active devices trusting apple about 10 times a day for 282 days this year = 3.948 trillion rolls of the dice. A 0.001% chance of betrayal by Apple is 39.4 million betrayals this year (approximately the population of Canada)
Did you read the original link, or the memo it linked to?
"the app was being used maliciously to target individual officers for violence and to victimize individuals and property where no police are present."
This was written by Tim Cook, speaking for Apple. That is Apple lying about what they are doing.
That is a ludicrous interpretation of that statement, in my opinion. Apple is being told by the government of a nation they're operating under that the law has been broken and that those things happened. What is Apple supposed to do in this case? Tell China "we don't believe you" and then what? You think China is going to change its tune? Or do you think Apple can get away with saying "Ok, fine! We're not going to do business here!" with zero repercussions?
This is not Apple lying. This is Apple making public what they were told by the Chinese government. Apple is not the bad guy here. China is.
Once again, Apple is in complete control of their App Store. They are the ones who decided to remove the app because of financials. This is the price of doing business in China.
What veracity? He is a businessman in a trillion dollar company. He says what pleases the market -- the domestic and the foreign one, not his personal beliefs...
The first priority is always profits or growth.
If one sincerely cared for the environment for example, would stop tons things that Apple is doing, not just one. The CEO of a multinational churning consumer gadgets by the shit-loads only cares for the environment to the degree that said caring doesn't impact the bottom line.
>Why should users believe that (closed source) iMessage encryption is free from backdoors when we know that Cook will dance around sensitive truths?
Well, that's an easier thing to answer, because there would be leaks from Apple employees (NSA had leaks, for Apple it would be many times easier) if that was the case. Tons of engineers would know.
>And why should the US government be satisfied with a fully encrypted iMessage given that Apple will cave to demands given enough pressure?
Because Apple will also cave to their demands.
Besides it's another thing to please some foreign customer by caving in to remove an app (especially if said foreign customer is a sovereign state and the app is anti-policy -- companies are not in some obligation from the US or otherwise to side with protesters), and another thing to e.g. cave in to China and give them a backdoor to iMessage as you seem to imply as a potentiality. In fact the latter would be treason (or close) for a US-based company and have much more serious repercussions...
Thus Apple is more secure?
>Apple doesn't sell your data, it protects your privacy, will fight government agencies asking for user's data, etc.*
That's a quite recent thing, say starting around 2015 or so, as a differentiating branding to Google, Amazon, and Facebook. They might mention it here and there, but they didn't tout it all the time before, and almost none before 2012 with Jobs. And Apple had already had its huge rise by that point. It's not like the "privacy conscious" are a large enough market to make for the later growth. In fact, if anything, the privacy conscious would have moved to Apple first.
Plus, Apple is not "pro privacy" because it's some political champion of privacy, but simply because it's business model (hardware, software, services tied to them) doesn't need selling ads and user data. Whereas Facebook's and Google's whole business model revolves around turning user info to targeted ads...
Apple's image was "the computer for the rest of us", "empowering people", etc. Even the 1984 ad was about corporate sameness and drudgery of then computing, not about some anti-government rebellion.
Apple was never in politics or taking some stance to world affairs (besides "Against AIDs" etc), and before Cook came out (and the cultural/marketing climate was friendly to jumping on the bandwagon), they'd never cared for the LGBT movement either.
Apple doesn’t sell your data because it’s not their business model.
Most people don’t care about privacy, if they did, they wouldn’t use Facebook or Google.
When Apple split with Google, they did so over access to customer data. At the time wall street was salivating over the huge profits to be gained from mining customer data, and Google was dangling billions of dollars in front of Steve Jobs' face to get him to fold. He didn't, and also turned down lucrative deals offered by Facebook.
That was all at a time when user privacy was widely seen as a marginal issue, and long before big privacy breaches regularly got into the mainstream press. Apple could have made huge amounts of money, but instead they turned those deals down and instead spent billions of dollars building their own maps and engineering iMessage with end-to-end encryption. No other tech company has come even close to Apple's record on user privacy and security. I can't even think of another one that's even tried.
That's what's so upsetting for me over this HK Maps issue. I know they have a lot at stake, including the livelihoods and safety and security of thousands of employees in China, but I still think they made the wrong call on this.
iMessage is pretty secure, but there are practical limits to how secure it can be, while also enabling cloud backups and data recovery options. Here's a somewhat sensationalised take, which does go into the practical reasons for the limitations. What it doesn't point out is that if you don't enable iCloud backup (maybe just backing up to iTunes), your secure keys never go to the iCloud servers so there is actually a way to stay secure even in China.
https://medium.com/bob-kfir-tech/how-secure-is-imessage-8cc7...
They instead opted to pursue a business model that played to their own strengths.
You seem to believe that Apple's iMessage service is somehow exempt from Lawful Intercept requirements. Let me quote from those in the EU (China's requirements could be more lenient, but I somehow doubt that):
"3.3 If network operators/service providers initiate encoding, compression or encryption of telecommunications traffic, law enforcement agencies require the network operators/service providers to provide intercepted communications en clair."
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C...
Lawful Intercept has a fatal flaw. It doesn't require the service provider to have encryption keys for the traffic, and they can't provide what they don't have.
If your service can't comply with regulation when requested or inspected, then your service will be disallowed until you can.
That's an easy one: the encryption happens client side and thus any backdoor has to sit on the clients and, if it exists, would be available to security researchers. There is no guarantee of it happening, but I believe some of those researchers reverse engineer whatever binary apple published and then check it for backdoors.
Of course there are still tricks that apple could pull, like adding backdoors only to targeted phones, changing the filesystem to present one version of the binary to the OS command that executes it and another to anyone else (like security researchers), extracting the unencrypted message contents using chips that sit on the memory bus (e.g. baseband), etc. But these tricks are harder to pull off and are still detectable as they happen on end-user devices.
They definitely won't say "yeah there is a backdoor". Ultimately, you need to trust them.
Apple REALLY must be coerced into allowing app sideloading (and accept push notifications not only through APNS)
Or they could just beef up progressive web apps...
I was thinking about the complexity of the world the other day, and how so many people hold diametrically opposed beliefs, but often based on solid reasoning and genuine facts. How could this be?
If you think about it, the modern world is so complex, with so many facts (some of which are actual facts, some of which are popular opinions now considered to be fact), with all of the inter-connected, Nth order cause and effect going on, how is a person who wants to be as objective as possible supposed to actually come up with a reasonable model of what's going on, even if they're willing to put in the work? People skilled in communications and the psychology of persuasion can pick and choose a subset of "facts" and put together plausible and completely contradictory descriptions of the very same story, and done correctly it's very difficult even for the vigilant to know you're being duped. So what's a person to do?
What I came up with is the idea that yes, one should indeed take "facts" into consideration, including some sort of notion of trustworthiness for each fact, but what's missing is the value of lies in coming up with one's model of reality. So, when trying to figure out what the real deal is on any given situation, don't first look for the facts, but rather the obvious lies - if you can find obvious lies or misrepresentations of reality coming from powerful (politicians or corporate leaders) or influential people (the media), this is probably a good trail to follow to lead you toward the most important parts of the truth. Of course, there's lots of complexity involved here as well, you have to consider the nature of the bias from the messenger, compare versions of the lie across different outlets, etc etc etc, but in many cases I suspect this is a highly productive approach for maximizing the correctness of one's models.
So in this case, as the article points out, "However, over the past several days we received credible information....that the app was being used maliciously to target individual officers for violence". Obviously a lie, although in this case, considering Tim Cook's no dummy I expect he knew everyone would know he's lying, so I wouldn't form any specific conclusions on this, other than money >>> honesty and principles for him, but why should we expect more from him than any other important person in Western society....this is just how we are. Despite the wonderful sounding platitudes we tell ourselves, this is our culture. And the Achilles heel that I believe China will be able to continue to exploit indefinitely, because I simply can't see it ever changing, it has become so normalized that hardly anyone can even recognize it anymore.
EDIT: Thinking more, with this being so obvious once you're aware of it, I can't imagine this is a unique theory I've come up with. Does anyone know a name for this style of thinking?
If you don't already watch it, you may really enjoy "The Good Place". (Any additional elaboration would be a spoiler.)
No company should be expected to back or foment a revolution somewhere, from my perspective they're looking out for their own beet interest and the best interest of their customers.
I'm curious about how you came to this conclusion.
Are you saying that would have no effect on freedom for the users?
This is really the key phrase here. What we know for sure is: Google and Facebook services do not work in China while Apple and Microsoft's do.
(And yes, either way the phone's baseband will be adulterated by Chinese ISPs at the government's behest, but modern smartphones isolate themselves from their baseband pretty well, so this only matters if you're using your phone as a phone [calling/texting], instead of as a tablet with a data modem.)
So Apple has made it clear that if China wants something, the tech details won't matter. "Oh, I'm sorry, we don't have that information to give you." "Well, start keeping it from now on, but don't tell them, because telling them would offend us, and you don't want that...."
2018:
"The iPhone maker’s latest Transparency Report reveals it received 32,342 demands from governments around the world to access 163,823 devices, with 80 per cent of the requests granted."
Come on, seriously? This is what they ADMIT to worldwide.
Here's on China: https://www.apple.com/legal/transparency/cn.html
Again, what they admit to. And that's only on the second half of 2018. With all their regular anti-consumer practices on hardware, you're really going to imagine they're champions of individual freedoms and privacy?
This is an interesting statement and has important implications here in the United States as well: who's the bigger entity? The Multinational Megacorporation or the Country? Who dictates terms to whom? If a company wishes to do business in a country shouldn't they be expected to follow their laws? We need to be very careful in how we answer this question because we're at risk of losing our own democracy to a corporatacracy.
Yes, the iPhone has the best secure enclave.
However, there is nothing stopping Apple from making separate builds with extra "features" for the Chinese market, and installing them. Same keys, OS version chosen by region. Boom. Chinese version acceptable to Chinese government, rest of the world secure. Easy.
From my experience in this area, I would expect the Ministry of Industry and Information Technology to accept nothing less.
How does Apple advance freedom in China?
1: https://www.cyberscoop.com/android-malware-china-huawei-zte-...
Chinese local chat app like WeChat, or customized Android from Xiaomi or Huawei, they have back doors, which allow Chinese gov access data directly.
Spyware from unintentional vulnerability vs. intentional back doors are different.
If there is one myth that the past couple of weeks have conclusively debunked, it is the idealistic conceit that the presence of western businesses in the Chinese market will inevitably liberalize China.
However, Hong Kong is a special administration region, and has historically enjoyed high level of judicial independence. When Apple takes the clue from a Chinese government newspaper - not even a legal request - and do the CCP's bidding proactively, it crosses a line. This is not compliance. This is self-censor.
You can argue that Hong Kong is part of China, and therefore Apple's operation in Hong Kong should comply with Chinese law. But what is next? China also claims sovereignty over Taiwan, will Apple self-censor Taiwanese App Store soon? Will Apple removes the Taiwanese flag from Taiwanese iOS users if China government demands so [1]?
It's also sad to see Apple pushes back on US government requests because they can, and kowtows to the Chinese governments without their having to even sending a take-down request! If one day Apple fires some employee because the Chinese government thinks he/she "hurt Chinese people's feeling" in a personal tweet [2], I will not be surprised!
[1] https://www.engadget.com/2019/10/09/apple-removes-taiwan-fla...
[2] https://www.washingtonpost.com/sports/nba/nba-statement-diff...
Taiwan is an independent country, no matter Chinese gov admits it or not. It has their own government, laws, military etc.
Hong Kong is not, it’s only a special area belonging to China. When British handed it over to China years ago, China promised the situation will not change for 50 years. Although it’s a lie, it shows that China will have full control of HK eventually.
I'm sure you think you just explained this, but it completely escaped me. How is yanking this app in the best interest of their customers?
Let's break "their customers" into 3 groups:
1. Protestors in HK. It clearly isn't in their best interest . So not those customers, right?
2. Non-protestors in China (including HK). You're argument is that this way they can still enjoy Apple products? Even though those products can no longer be trusted not to betray them to any whim of a hostile government?
3. Customers outside China. The argument here seems to be that Apple makes lots of money in China and that an Apple that makes tons of money in China and outside of China is better for non-Chinese customers than an Apple that makes tons of money outside of China but not inside of China.
This third group and justification is the most interesting to me. I stipulate that I have put words in your mouth. So let me take those words out of your mouth and just say this is the only way I can make sense of what you wrote.
When I follow this train of thought the only way I can see it being true is if Apple's very existence is threatened if some other company were able to fill the void in China, then leverage that to gain so much market power outside of China that they could squash Apple. And even that alone doesn't make things worse for (former) Apple customers. The only way that would be worse is if this hypothetical competitor's products were actually worse than Apple's and only able to dominate the market because of the market power they enjoy due to Apple's absence in the Chinese market.
That is such a stretch that I feel your argument should be dismissed. Can you fill in the holes of my understanding to help me see things your way?
I think this is an extremely important discussion because it seems to be the mindset held by a lot of decision makers. Is the NBA worried that they will stop making many $millions if they don't expand into China? That is, not only will they not double or triple their profits; they will actually stop making money outside of China? Is Disney worried about this? Are Microsoft and Amazon? Is it a fight for survival? Or is it pure naked greed?
I hope you’re joking.
Huh?
> No company should be expected to back or foment a revolution somewhere, from my perspective they're looking out for their own beet interest and the best interest of their customers.
Profit is not an adequate moral compass. I deeply disagree that by forming a corporation, individuals who would otherwise have ethical obligations are somehow no longer obligated to behave ethically. You're literally claiming that it's okay to enable the violation of human rights for profit.
I imagine the app cached a lot of the map data locally and used a native renderer.
I don't believe that more people -- especially on HN -- are focusing less on the web as a means to get around the "wall garden" than focusing on sideloading.
This is the line you want to draw? "I didn't help them tear gas the protestors, I just made it harder for protestors to avoid being tear gassed?"