Hacker News Reader

The relevance of criticism on Apple's privacy stance is in pointing out the limits of Apple's commitment to privacy.

Companies like Signal are founded on privacy and encryption, but with Apple, privacy is a nice-to-have, limited to its other business objectives (like how Apple is "committed" to reducing waste to the extent it can sell dongles, chargers, and earbuds separately, but not in terms of repairability). You can count on Apple to value the appearance of privacy, and in protecting information from third parties without user consent, but not so much being private from Apple itself.

For example, here's an article on Apple and privacy from a couple months ago https://www.politico.eu/article/apple-privacy-problem/ .

Speaking of which it is a little weird that Apple sells iOS on having superior privacy to an Android device when Safari will still frequently hit a Google CDN in order to load open-source fonts that they could readily just ship themselves.

Maybe this is just a shallow read of it, but it feels like sort of a similar dichotomy to that between Apple's rhetoric about objectionable content on app stores and... well, its inclusion of a web browser.

Apple's marketing is quite genius. They spun iOS being a closed system into a plus.

You can't install your own apps. Safari is not fit for PWAs. Repairability is not encouraged. All of this is for your own benefit and privacy. Want those things? Go to Android and sacrifice your privacy.

With this approach, Apple comes out looking privacy-focused, justified for their App Store fees, and their stance on right to repair.

I'm not educated enough to know if those restrictions are absolutely needed for privacy or privacy is a blanket excuse for how Apple operates.

It's more of an opportunity left by Google. If Google wasn't a spyware company masquerading as a search engine company, their team of brilliant engineers could create the most open, most reputable, most user friendly, and most privacy protecting system on the planet.

I still hope something like this happens one day. There is definitely a need for privacy-enabled Android that is compatible with major brands. I'd gladly pay €50 more for it. This system would have to be mostly API-compatible with Android so that developers could easily recompile their apps for it. There is a huge smoking hole waiting to be filled. Librem 5 (when it's released...) is simply not enough and frankly speaking simply too expensive for a popular privacy solution.

There are positive and negative aspects to it being a closed system, just as there are positive and negative aspects of Android's open system. Marketing just chose to emphasize the positive aspects. Not really a genius play, IMO, that's just what any marketing team does.

Good point, but iOS was a closed system from the get-go and this was seen a drawback of iOS back then. The privacy focused marketing started 3-4 years ago.

And at the same time, MacOS phones home every time you run anything, and logs exactly what you ran, on what you ran it, and where you ran it. Inb4: "This isn't a privacy issue, it's a security feature".

It's a great read. Why not link to it?

https://sneak.berlin/20201112/your-computer-isnt-yours/

To be completely honest, I was about to, but got distracted. Thanks for linking it.

I think the distinction nowadays is what happens with the data after it has been collected. We are way past data being collected.

Running on linux, with software I can to a fairly large extent control, I beg to differ. This is also the default, and not some crazy power-user iptables/proxy filter shenaningans either.

>and in protecting information from third parties without user consent

Is this true for every country where Apple operates? Especially where it's forced to host servers in? We know for certain that Apple cannot do its business in certain high value market(s) unless it offers unrestricted access to its customer's data.

But we don't see *privacy applicable to U.S. or X countries only disclaimer in any of it's marketing or promo materials. An uninformed Journalist or Human rights activist can be at severe risk due to this.

Especially when,

> Cook argued that people choose iOS specifically so they won’t have to make risky decisions with sensitive data.[1]

[1]https://www.theverge.com/2021/5/22/22448139/tim-cook-epic-fo...

Yes but the privacy people need to be less angry about it and life in general. When signal makes a phone I will certainly consider it. Until then Apple is the only game that really makes sense that is still mainstream and usable without having to accept a bunch of bugs and subpar performance.

I completely agree, and would love to see a competitor to Apple in terms of privacy focus.

I think the reason we don't see it from competitors is that Apple is years ahead of everyone else in terms of customer experience, and privacy is part of that experience, so they focus on it.

You just have to look at how many different models of phones Samsung sell vs how many Apple sell to see how unfocused Apple's biggest competitor is. They will throw anything and everything at the wall to see what sticks. There's no focus on privacy because there's no focus on anything.

There are competitors: The Linux phones (pinephone, librem). In fact, privacy has been one of the selling points of desktop Linux forever. The problem is it doesn't sell, or at least it hasn't till now.

This is what Apple is trying to change, basically convince people (through ads) that they need to care about their privacy, because they know it's a competitive advantage they have when compared to the other big companies.

Privacy was also a selling point of BlackBerry/RIM and was successful but it’s hard enough to convince people it’s worth switching over to Firefox from Chrome so I think you’re right.

It is interesting that Apple can market themselves as protecting our privacy if for no other reason than all their competitors do the bare minimum.

>the reason we don't see it from competitors is that Apple is years ahead of everyone else in terms of customer experience

If I might offer a less glowing perspective

Apple is a highly vertically integrated company unlike anybody else in the "top end" of SV. They don't "need" your data

Facebook only exists as a website, so of course they want to data mine you to death, use psychological tricks to keep your eyeballs scrolling their website so they can shovel ads at you

Google effectively gives away Android. They make money by data mining you for advertisements and through providing a wide array of services (Gmail, Maps, Search etc) to augment the things you do on a day to day, in exchange for the reams of data it provides about you

Amazon doesn't really data mine you nearly as much, since their business is more selling you physical goods (or the dominance of AWS, depending on your point of view)

Microsoft wants to chase after what Google and AWS are doing, though their products feel more like pale imitations than anything. Granted that isn't particularly new for them (Zune vs iPod then is Bing vs Google today)

Apple doesn't "need" your data. They have no reason to. They've created products that effectively half of the first world wants to buy through iPhones and iPads

They've spent two decades working to build themselves an outright fortress. They sell you a phone they make, which runs apps from their app store that requires developers to play by their rules

The amount of money Apple makes simply by collecting its 30% revenue cut on everything done on iPhones alone dwarfs what they could get if they even attempted to muscle in on Google in the ad revenue business

To add to your point: Apple uses privacy as a weapon against the other FAANGs. When they add adblock software they reduce the bottom line of their competitors. Less resources for Google and Facebook is eventually more money for Apple.

However the point of GP still stands: people can take advantage of Apple tactics and probably enjoy more privacy by default.

Personally I'm not using Apple devices for a number of reasons and I still believe I'm OK with my privacy because of a number of precautions. Most of them are out of the reach of non tech people, but given that I'm a tech person I can avoid to buy from Apple and still give as little data as possible to Google and Facebook.

> I see a bunch of comments talking about how Apple is being self serving and not at all altruistic when they defend our privacy.

Right, I don't want Apple to help safeguard my privacy out of a sense of altruism. That company would be highly vulnerable to ambitious managers moving up the ranks.

And besides, nothing's a zero-sum game. Securing a better outcome for yourself doesn't require self-flagellation from your trading partner.

The better outcome is the one we have, where the company's motives are genuinely aligned with their customers' motives. Where there is bankable incentive to do the right thing.

As another comment pointed out Signal as one software, we also have Purism[0] for privacy-minded hardware

[0] https://puri.sm/

Neat that there's a competitor to system 76. I'll have to look into them later.

I use a T500 I plucked from the trash for secure libre street cred. No blobs anywhere afaik.

T500 has blobs at minimum: CPU microcode, UEFI boot firmware, EC firmware, GPU firmware, HDD/SSD firmware, Ethernet/WiFi firmware, battery controller firmware, display firmware etc.

While true, those issues are present even in system76 and purism. They're even worse because the T500 doesn't have a dedicated GPU or TPM. I know the combination of hardware I have in my T500 has all FOSS drivers and I assume purism is the same.

I have it mostly as a toy and I'm sure most purism customers are the same.

The only other company I could think of that is playing in this privacy game is: Signal. And well they are a nonprofit and they prove that privacy is not only made affordable for the rich and affluent and anyone can have private communication whether they donate to Signal or not.

And Signal still leaks phone numbers to people, that's why I refuse use it for group chats. For encrypted 1-1 with people I already know it's fine though.

Better than Zynga, right? Corporation which has leaked kids data. Clones games, manipulates kids and adults in spending thousands of $$$ on virtual things, screwed employees from stock compensation.

It's easy to criticize, right? Signal and Apple are at-least doing better than Zynga.

I'm not sure if this is what happened, but if you tracked down where someone works and are using that to attack them, that is a serious abuse and the sort of thing we ban accounts for—so please don't do anything like that on HN. (If you didn't do anything like that, ignore this comment.)

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...

https://news.ycombinator.com/newsguidelines.html

Get a Twilio number and use it for pretty much everything.

Twilio is awesome, I even have my Twilio workflow configured to receive "2FA" calls and hit the # key without my intervention, and I have it set up mess with unknown callers by putting them on hold indefinitely with music.

Wouldn’t using Twilio effect the security of 2FA?

Yes, but I don't do phone-based 2FA; I only use U2F or TOTP.

When I have a massive, immobile desktop in front of me it makes no sense that the desktop isn't the 2FA device, and that I'm asked to go search for an easy-to-steal tiny 5" device.

Also, I don't believe in phone numbers being 1:1 correlated with a device; for convenience I should be able to take a call from any device that I happen to have with me. So phone numbers should never be used for 2FA IMO.

Why use 2FA at all then? It doesn’t seem like you’re gaining any security using it.

They insist on it, not me.

I'm all for 2FA if it uses U2F but if it's going to be phone-number based I'd rather pass. That isn't an option though, so I automate the phone response.

Care to share evidence before making such allegations.

https://community.signalusers.org/t/hide-phone-number-entire...

>I'm willing to pay a premium of probably hundreds of dollars on a phone because I want privacy, and nobody else will even consider selling me one?

how much of a premium are most of the target market willing to pay however.

Google, Facebook, and Amazon don't sell privacy because privacy goes directly against what their business strategy is.

Samsung has based their stuff on Android an OS that, heavily influenced by Google, I suspect might be difficult to make as private as Apple can make its stuff. I suspect Samsung does not care about privacy because it has determined it will not make much money from it, and that most of the market that cares about privacy will go to Apple.

I don't know why Microsoft doesn't care as I think it would totally align with their business goals.

The idea that a company can "sell" privacy is completely fabricated by those who are collecting vast amounts of data about users.

Revenue-producing mass data collection by "tech" companies creates a "privacy" issue. Is the solution to "sell" privacy. Of course not. Data collection makes more money. That is why "tech" companies offer so many things to users for "free". There would be little or no money to be made in selling these things, relative to using them as fronts for data collection and surveillance.

Apple does not try to claim, "We make no money from collecting data on Apple customers." Instead they claim they protect customers' privacy from other companies, who also want to collect data on Apple customers.

When Apple itself stops collecting data about users, only then can I start to consider Cook's claims that the issue of privacy is so important. At present, Apple's actions do not match its statements. There is no privacy from Apple and the company has built datacanters to hold vast amounts of private data collected from customers.

These companies have certainly swooned some, judging by the comments I see on HN, into believing they must make "tradeoffs". How did we reach a point where anyone could believe that a company who is collecting vast amounts of data on users of its products is some sort of privacy crusader or privacy merchant. Anyone who cared about privacy would not be doing surveillance and data collection.

The only answer I can come up with is that these people who cannot see any alternative besides "tradeoffs" were born into a world of where companies were already engaged in dragnet data collection from the internet as a "business", and they never saw what the internet was like before this nonsense began. They honestly do not know what a reasonable level of "privacy" is because they never had it.

The idea of "paying for privacy" is no different than paying protection money to a mafia or paying ransom to a ransomware group. The solution is to stop the wrongful behaviour, not to make payments to the organisations that are engaged in it.

Show me a phone that works as well as my iphone plus has better privacy and I'll be the first one laying my money down on the counter. I don't think you need to remind us of the dead obvious trade off of apple vs android vs linux, we're all techies around here.

The willingness to pay big for privacy is a signal that you are an interesting person to track.

Privacy is fundamental human right. Don't need to be interesting person.

Indeed. I don't have anything special (in my current world / country) to hide, but I still want to hide it.

It tells one bit about us: that we are privacy conscious. Nothing else really.

I think the point is that it signals someone with a lot of money since they can spend hundreds on something they could live without.

Or that you’re someone who understands they are accepted by the government and societies of today, but weren’t yesterday, and might not be tomorrow.

There are still countries where being LGBT is a capital crime, where the colour of your skin will be used against you, or where your political affiliations can be used against you.

When governments and societies start to turn against people who are different from them, the mass surveillance and profiling makes it much easier to locate all of these people to round them up.

Two major critiques:

1- Privacy should be the default, free as in beer, not a pay-per option

2- Apple is all willing to break its own encryption to cooperate with law enforcement. See the recent example https://www.theregister.com/2021/05/17/sci_hub_apple_fbi_cla...

Microsoft definitely sells privacy to business customers. For consumers they are probably just trying to lead gen for business sales.

Microsoft’s privacy efforts are limited to what’s minimally required to achieve certain data storage or other compliance conformance.

Even worst, consumer products like Windows 10 and tools like Visual Studio Code come with extensive telemetry and tracking enabled by default. Remember recently the office 365 fiasco when they thought it will be ok to track employees and make reports out of it?

Microsoft's privacy policy for sharepoint says thst Microsoft employees have accesss to all data in sharepoint.

So Microsoft's privacy is worth as much as its poorest paid employee with access.

Do you have a reference for that?

Yes, the privacy policy issued by Microsoft to your company regarding SharePoint.

> The interesting question to me is, why is it that they are literally the ONLY large tech company that is willing to offer me this tradeoff?

Maybe other corporations consider it unethical to charge their customers a premium for a false sense of privacy and security?

> Samsung, Google, Facebook, Amazon and Microsoft don't sell privacy

And neither does Apple, they just sell you on the promise of privacy. The reality is quite far removed from the perception most customers are given by their marketing and PR campaigns.

Apple might be a bit more stringent on enforcement of data sharing with third parties compared to other large tech corps, but that doesn't magically mean your privacy is invulnerable through their devices and services.

There have been multiple cases of them being caught out being hypocritical in regards to privacy, there have been multiple data breaches of Apple services and platforms to varying degrees of severity. Since the recent Epic lawsuit, it's also been revealed that Apple decided to not notify some 150 million of their customers who were victims of a data breach.

Anyone who actually thinks Apple cares even remotely about their privacy is living in a fantasy land. Unless you think being not alerted of your personal data getting exposed in a data breach of their systems is somehow not in your privacy's best interests.

If you accept that corporations are not driven by ethics, then that doesn’t make sense.

> they just sell you on the promise of privacy. > there have been multiple data breaches of Apple services and platforms

What makes Apple different, is the decision to design all their products and services in a way that limits (or avoids all together) collection user information. For example, almost all of the "smarts" of the iPhone are executed on the device, without sending your data like location and pictures to Apple's servers for processing.

Apple also enforces through App Store review that app developers are mindful of user's privacy and every instance where data is collected needs to be explained and properly justified.

Regarding the story about the 128 million infected devices, it was a virus which infected developer Macs, resulting in some apps also including malicious code. No user data was leaked and it seems end-users suffered no ill-effects cf. https://www.macrumors.com/2021/05/07/xcodeghost-malware-2015...

Of course, no product and service can be 100% secure forever... hacks and malware happen sometimes. That's when practices like app isolation or sandboxing (which is very strict on the iPhone) and explicitly asking users for permissions (so apps can't just choose to get any sensor telemetry they want) comes into play. If an app has been compromised, then the malware is limited to the permissions already granted to the compromised app. Nothing more.

Privacy as a product or feature is generally considered a regression, mainly because people see it as a value, not a value add.

The line of thought goes, what's privacy worth to you? What's security worth to you? The price, likely, will fly upwards until it is saturated to nil.

>None of them have any altruistic motives either, so I can only conclude that they either don't want my money or they're really bad at what they do?

That's a non sequitur.

I don't think privacy is a thing that most people happily pay, same as security. Only Apple can sell privacy feature bundled with luxury devices.

I have a similar sentiment.

But when apple introduced ads to the App Store, a part of me became quite sad.

Like no amount of money would ever be enough...

If that is the case, the please stop glorifying every single apple IPhone or product release like it is a gift from god and that Steve jobs and Tim cook can do no wrong.

Straw man. Who does that?