Hacker News Reader

Comment by placebo | Hacker News Reader

In an authoritarian regime with large masses of human and technological resources determined to have control over its population, nothing is really secure. Sending a message that can't be read by a third party? You're suspect. Have an illegal app installed on your registered "report to big brother" phone? Expect an unfriendly visit by big brother police. Don't have a "big brother" phone? There are various ways of sniffing you out. The bottom line is that while technology can help in the process, technology can't bring freedom from oppressing regimes. That is only achieved when a synchronised, large enough collection of people feel that they are willing to change things even at great personal risk. Authoritarian regimes know this, and thus put a lot of effort into using fear of consequences to suppress any hint of such development.

View on HN

This is precisely why it's important to make these tools (protocols/applications) part of the core layer of how businesses operate consumer-facing services online; it's only true if the ratio of "interesting" communication over these channels is high enough.

In an alternative timeline where ISPs where more strictly regulated and trusted and everything was cleartext HTTP, I'm certain that HTTPS/TLS would face pushback from regulators. There's no way it can be banned today, though. Similarly, you won't be marked as suspicious just from opening an encrypted TLS connecting over port 443 to an arbitrary endpoint.

I don't think it's too late. There is a significant probability that today's centralized incumbents will Myspace at some point in the future. These federated, decentralized and secure solutions could be the next iteration after that.

Oppressors can (and I think some already do) subvert HTTPS by mandating installation of government-issued certs so they can do their MITM.

That is an irrelevant detail. The comment you are responding to isn’t saying that https is foolproof. They are saying that it would help people to be more free of digital control if privacy respecting technology is so common that it isn’t suspicious when you use it.

I agree that it helps (though I'm probably more pessimistic about how much it helps). I wanted to counter the assertion that "There's no way it can be banned today, though" (which I should have quoted). Even a disconcertingly non-trivial number of western lawmakers make regular noises about requiring all encryption to be backdoored.

My sibling response was apparently already out of touch when I wrote it.

https://www.zdnet.com/article/china-is-now-blocking-all-encr...

I know there have been attempts (was it Iran and Kazakhstan that was in the news last year?), but is anyone aware of this actually being done in practice today? My understanding is that they were forced to roll back for practical reasons (which highlights my point).

If only Google and Apple would make a fully end to end encrypted chatting platform to take place of SMS that is fully federated and not controlled by a single entity, something the likes of Signal could support / join in on and other chat apps. When you turn crypto into something the masses use seamlessly it gets a little more complicated to figure out who the suspects are. Also default to not synching to the cloud, and explain why syncing to the cloud could be compromised.

From what I an tell, this is the goal of matrix.org - though full federation and identity portability is not there yet.

If spying on you is their business model, why would they build an app to prevent you from being spied?

Spying on you is not Apple's business model.

It is, alongside limiting what you can do with their leased equipment that people think they bought.

This made me jump. You make one excellent point, with appropriately shocking language:

When I can’t do what I want with my phone, I may as well be leasing it. Hmmm.

But I don’t believe Apple’s business model is to spy on me.

> But I don’t believe Apple’s business model is to spy on me.

"Location-Based Apple Ads: Your iPhone will send your location to Apple in order to provide you with geographically relevant ads on Apple News and in the App Store."

More: https://support.apple.com/en-us/HT207056

So not exactly "business model", but does it matter?

> But I don’t believe Apple’s business model is to spy on me.

Apple business is not spying on you, but Apple business is much easier to do if they do spy on you. Meaning they do it anyway, don't worry.

Almost every app in the App Store, per Apple's guidelines, has tons of spyware in it. Apple asserts that you agreed to this experience when you accepted the TOS of the App Store.

It's impossible to use an iPhone with any popular apps and not be constantly spied on. Insofar as Apple's business model is to make the (full of spyware) App Store successful, it's Apple's business model to spy on you.

Oh indeed it is. I spent years reading apple reports and my conclusion was that they want the data for themselves so they can sell it. Devices don't make much profit when you factor in how much is spent buying up almost all old devices that hit the market.

How much does Apple spend buying up old devices?

My impression was that Apple did trade ins to acquire stock to refurbish and resell in India, and to incentivize users to upgrade.

I would be pretty surprised to learn they were losing money on trade ins, and I've never heard of any kind of direct buy back.

> I spent years reading apple reports

Which ones?

Do you have any evidence of Apple selling user data?

It's right in Apple's privacy policy, see Disclosure to Third Parties section: https://www.apple.com/legal/privacy/en-ww/

They obviously sell user data in aggregate - not at a personal level, but which of the big tech companies sell personal data (maybe FB / Cambridge Analytica?)

Also, Apple has Google as the default search engine which Google pays billions for. Is that selling your personal data?

You mean the disclosure to third parties section that explicitly says "Apple does not sell personal information"?

I can't see anything in that section that says that they sell information to third parties, personally identifiable or aggregate (I would consider the latter to be "personal" data as well fwiw). Is there a specific sentence you're thinking of?

It seems to be talking about the necessary sharing of data that happens when Apple contracts with third party services to run their own business. E.g. when they ship you a product they need to provide your address to the courier company. Or when they pay an advertising company to run ads for Apple products targeting certain markets/their own existing customers (not the same thing as selling personal data to an advertiser so that they can run ads for other products using said data - that would be selling personal data)

As far as I can tell you're either using a definition of "sell" that is different to mine, or you're claiming Apple is using weaselly language to make it sound like they don't when they do (which is not unheard of of course). But you haven't provided enough information for me to really know what you're talking about - which is it, and why?

Also no, making the default search engine google is not selling personal data.

They target ads to your interests, default on:

"Ads that are delivered by Apple’s advertising platform may appear in Apple News and in the App Store. If you do not wish to receive ads targeted to your interests from Apple's advertising platform, you can choose to enable Limit Ad Tracking, which will opt your Apple ID out of receiving such ads regardless of what device you are using. If you enable Limit Ad Tracking on your mobile device, third-party apps cannot use the Advertising Identifier, a non-personal device identifier, to serve you targeted ads. You may still see ads in the App Store or News based on context like your search query or the channel you are reading. In third-party apps, you may see ads based on other information."

A third party being able to list ads on apples ad platform that target some collection of desired user data is not the same thing as said third party obtaining user data.

Third parties are buying ad listings, not user data. They have no way to extract user data from the ad platform, unless there's some kind of data leak.

If you think Apple is harvesting data off of bought back phones to improve their ad targeting that would also be a scandal (that I would expect some evidence of - otherwise it's just baseless speculation), but referring to it as "selling user data" is just obscuring what you're actually trying to communicate.

Unless those ads contain anything, that is loaded from the ad creating company, whichis then loaded in the user browser. Of course, no platform would allow requests to a third party …

None of the big tech companies sell user data.

Idk if you consider Twitter a big tech company, but they do: https://developer.twitter.com/en/pricing. I don't believe Google or FB does though.

That isn't selling user data. All that is on the site itself, they are just making it easier to access. I'm talking about their click streams and other things that are invisible to the public. That data no one sells because it is how they target their ads.

Twitter is literally selling data (tweets) that users generate via API.

The data is public and available to everyone. They are selling an API to it.

Funny that you should mention Signal as example for joining a federated service when they have actively and vocally moved away from federation.

https://signal.org/blog/the-ecosystem-is-moving/

When someone reads the above comment and thinks 'Oh well, it is a risk the user is willing to take by using these apps in an Authoritarian regime' should think again.

Targeting users who rely upon secure apps is becoming common in flawed democracies as well and more countries are eager to join that list. Several people, including minors were arrested in Kashmir when police found VPN app on their mobile during routine checks[0]. Government's logic being 'Why use VPN, if you are not a terrorist?'

At the same time journalists, activists are heavily dependent upon secure apps like this to make their voice heard outside, all the more reason for all of us who are lucky to not have gestapo knocking our doors because we used a VPN to watch PornHub to make usage of such secure apps (messaging, email, VPN etc.) very common.

[0]https://scroll.in/article/954711/in-kashmir-a-spree-of-arres...

I've pondered the merits of someone spreading a virus that just sends (small, but relatively constant and random) amounts of encrypted data (maybe to other infected devices, and various other endpoints). Spread it widely enough and everyone gets to communicate privately with plausible deniability.

Of course it doesn't even need to be real data, random gibberish would work too.

Perhaps. Back in the 80's, folks on Usenet would add words like "nuclear", "bomb", "spy", "communist" to their email footers and posting signatures, in hopes of overloading the (suspected/expected) NSA monitoring of traffic. I'm going to guess that sophisticated filters dealt effectively with such things back then, and even more sophisticated filters would deal with your random encrypted bits too.

Curious anecdote, some underground Japanese P2P networks have files with contents filled with references to Tiananmen, Tibet and the Uyghurs etc. probably to attract attention from CCP to deter Chinese users from downloading them.

Looks like this app uses TOR in long-range communication.

Although it's annonymous, your connection to the network is detectable and would trigger redflags in government monitoring software...

Yup. In communist Poland even having a typing machine was a big no-no unless you were a registered writer (because why would you have it if not to make leaflets, and if you're making leaflets you are clearly anti-government).

If you're getting mail from abroad you're already on a list. If you're getting encrypted mail - you'll probably disappear.

Authoritarian regimes are often far less technologically advanced than free countries. They will often import technology from free countries and be constrained by whatever freedom respecting decisions they've made.

China is an authoritarian regime that is as technologically advanced as the US and Western Europe, and they will gladly export freedom restricting technology.

This is like saying that the weapons advanced countries sell to less advanced countries are more "life-respecting".

Imagine a world where a gun sold is by the US to a poor wartorn nation. When the trigger is pulled, it does facial recognition to figure out who it is aimed at, and if it detects someone friendly to US interests, it will refuse to hit them.

> Imagine a world where a gun sold is by the US to a poor wartorn nation

There is no need to imagine it.

Reply on news.ycombinator.com