Hacker News Reader

With a datetime and IP, you can geoIP any time in the future. It's a single ETL operation. So you treat it like they do, one way or another.

This assumes they don’t scrub it before storing it, which we know they do for some services, and we have no information about others.

We can’t in fact treat it like they do. We can only treat it like they might be able to.

Anyone monitoring the traffic outside of Apple can do it, as well. IIRC TLS client certificate information is not encrypted on the wire, but I'd need to review modern TLS protocol negotiation to confirm. This would allow anyone monitoring Apple's upstream, passively, to perform this same location logging that Apple does.

Apple knows this, so shipping systems that leak information in this way is tacit acceptance of the military spying going on on the networks to which Apple's servers are connected.

“Anyone monitoring the traffic outside of Apple can do it, as well”

Well this is true of every single connection made by every single app on every single device, for every upstream.

That means everyone is tacitly accepting the military spying going on on the networks to which their servers are connected.

That’s not actually an unreasonable position as far as I’m concerned, and you previous comments about this being true unless Tor is embedded have some validity. I say some because I’m unconvinced that Tor is quite ready to handle all traffic yet.

What is unreasonable is your focus on Apple.

By excluding the fact that your complaints are a general problem with TCP/IP and apply to essentially any service, you don’t seem to be doing a great job of informing people about the reality of the problem.

It’s also worth noting that if your position has now moved to how the tracking could be being done by someone monitoring Apple’s network rather than Apple themselves, you are tacitly acknowledging that your claim that Apple is keeping records of your location are just speculation.

"There's a camera in your bathroom, but how do you know it's recording?"

He’s just saying it’s possible to do so.

This claim that Apple are tracking your location because they use TCP/IP to receive connections, has been made many times now.

Nobody has so far presented evidence that Apple does in fact geolocate people or even that they persistently store IP address information related to user accounts.

I don’t know for sure that they do not, but I do know that they are aware that keeping IP addresses is a potential privacy leak, and so at least some of their services are definitely designed to scrub ip addresses from records at the point of ingestion and replace them with anonymized keys before they are passed on to services within the company.

So they know that keeping IP address logs is a potential privacy issue and are working to alleviate that.

I would be surprised if they do this for everything yet, but as far as I can see Sneak is making only a theoretical accusation, and not one which he has more than speculation about.

As far as I can see, statements like these...

“Apple knows when you leave home, or arrive at the office, or travel to a different city, all with no Apple ID, no iCloud, and no location services. This has always been the case on all devices using iOS, too.”..

...are complete bullshit as written, even though we can’t rule out the possibility.

“ Apple doesn’t retain a history of what you’ve searched for or where you’ve been.” is on Apple’s privacy page here: https://www.apple.com/privacy/features/

So if someone can find evidence for such accusations, perhaps there is some legal liability for Apple.

Perhaps Apple doesn't log your hardware UUID + IP. You'll have to take their word for it.

But there's even less guarantee that the government doesn't log that information.

After all, Apple dropped plans of implementing E2E encryption of iCloud backups after the FBI asked them [1]. So "Apple doesn't retain that info" might boil down to semantics since it might be allowing someone else to do it.

[1] https://www.cnbc.com/2020/01/21/apple-dropped-plan-for-encry...

Well the iCloud backups not being encrypted yet is a serious problem.

Weirdly, this isn’t news - anonymous sources have said before that it was due to FBI pressure.

But this doesn’t have anything to do with Apple logging locations.

If sneak’s claim was correct, there would be nothing we could do about it.

If we’re talking about iCloud backups, at the very least you can turn those off and do them locally.

I’m pretty sure that even if e2e backups do come, they won’t be on by default because of the problem of users managing their own keys.

Apple had at least a partial implementation of e2e backup that was resilient to users losing their passwords, via something like friends-and-family secret sharing to perform data recovery.

The implementation was scrapped.

There are ways of solving these problems, throwing up hands and saying "it can't be done anyway" is silly. Apple has done a lot of things that couldn't be done: a computer without a floppy or serial ports, a phone without a keyboard, a headset without cables between your ears.

Building the iPhone was difficult. Building APNS and iCloud was difficult. Building the App Store was difficult. Building the Apple Watch was fucking difficult. Building the Ax line of mobile chips was difficult. Building the M1 was difficult. Don't forget about airpods, homepods, and all the other mindbendingly hard shit Apple does all the time now.

Apple does insane technical achievements on a regular basis. Secret sharing for e2e backups is well within their capabilities. Google even managed to e2e encrypt Android backups.

The problem is that Apple serves at the pleasure of the US military intelligence apparatus, and they know it.

It doesn't take a weatherman to know which way the wind blows.

“it can't be done anyway”

Nobody is saying this.

Also I agree with you - e2e secret sharing is possible, although hard for users with just one device - I.e. a lot of people.

And yes, Apple has solved a lot of fucking hard problems, slowly, and incrementally.

Just because they haven’t done it yet doesn’t mean they won’t.

You have no evidence at all that any of this is because “Apple Serves at the pleasure of US military intelligence”.

You keep making claims that are pure speculation as if they are true.

I actually agree with keeping pressure up on Apple to implement E2E backups.

I guess you don’t think that’s ever going to be possible though.

There are ways to communicate over the internet that don't disclose the source IP of the client doing the connecting. Tor also uses TCP/IP, so your oversimplification of my post is... not accurate.

> Nobody has so far presented evidence that Apple does in fact geolocate people or even that they persistently store IP address information related to user accounts.

We're talking about IP address logs related to hardware serials, which cannot be changed. User accounts can.

If you are saying that by using Tor, origin information can be hidden, I’d say that’s true.

So for everything not using such a method, what I said is true, which is almost everything.

If you said “Apple should use Tor for everything so that eavesdroppers cannot deduce people’s locations via GeoIP” that would be a fair statement.

Sayid “Apple keeps records of your location history”, is speculation which you have never substantiated, despite repeated challenges.

However what I said still holds despite this small exception.

IP address logs certainly can be changed before storage.

Apple has to log client IPs on these systems to prevent abuse, to stop people doing things like scraping every public key for every iMessage user and then publishing the diffs.

IP to ISP/Location mapping is just a lookup table, and can be done at any time now or in the future.