Why would governments push back, when this hole which has already been used will _always_ be available?
https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
Can you show me another company that has done this?
FWIW, Apple does not treat US and Chinese users the same. If you have a Chinese mainland iPhone, you use a completely different iCloud that isn't even run by Apple.
The laws are different there and the only way that Apple could meet the requirements of the Chinese government without also weakening their product for the rest of the world was to cede control of iCloud there.
Apple likely conceded early on that China-based iPhones use China-based iCloud, and the Chinese government likely conceded that Apple phones will use the same OS everywhere, with region-based feature blocking being as far as they'll go in customizing the OS. Both have a lot to lose from the other party terminating the relationship.
I'm not aware of a time when Apple pushed a software update (silently or otherwise) to defeat security for a user (or users). Can you provide a reference?
If government were to compromise end to end encryption in the manner described above, it would either be visible when used to prosecute people, or invisible because it would never be used to prosecute people (but presumably for intelligence purposes). Even if it were used for intelligence purposes through the method above, which I don't think is at all established, it would still be a significant improvement over having data in a form that is actively used to prosecute people.
The snowden revelations were precisely about information gathering for intelligence purposes. The vast majority of intel gathering is not for prosecutionary purposes.
What is absolutely good is that they have e2ee now, and the only way they could even hypothetically open a back door would be one that was completely secret, for the government, which definitionally closes off a whole class of government use of the data, for example in domestic prosecutions of citizens.
This may not be perfect (it’s not open source etc) but it’s a vast improvement over non encrypted data that was openly routinely given to the government.
I don't know what people expect. These moves are good things and everyone is whatabouting situations that there is 0 evidence has ever happened or would ever happen. It's unfalsifiable, impractical, and honestly just annoying.
https://www.cnn.com/2022/06/21/europe/grenoble-france-burkin...
Let's not pretend this is the same thing as kidnapping you and taking you to a reeducation camp because of your religion, leaving your kids alone and confused.
No one claimed that they were being “forced” to be part of a religion. What next? Forcing people to eat pork even if it is against their religion to enforce “secularism”?
This was nothing more than discrimination.
In the US, we had to have laws that allowed Black girls to wear their hair the way they wanted and schools were forcing black girls to straighten their hair to fit in.
People who are forced to wear certain clothes by others in their religion are also often forced to have that religion.
Confusing race with religion is even crazier. We should accommodate people who are physically different, but there is no reason to go out of our way to accommodate people with arbitrarily wacky beliefs and even less reason to go out of our way to accommodate oppression by people with arbitrarily wacky beliefs.
Honestly, every religion is “wacky” to an outside observer.
The secularism rule basically says that the government should not make laws to accommodate one religion because then it would have to make laws to accommodate any and all religions, and there is no limit to how wacky a religion can be.
The law was specifically aimed https://apnews.com/article/religion-france-government-and-po...
> The ruling was the first under a controversial law, championed by President Emmanuel Macron, aimed at protecting “republican values” from what his government calls the threat of religious extremism.
The law passed in the country was set up to disallow laws that favored one religion, but ever since the revolution cast aside Christianity for enlightenment ideals, no such laws had been attempted. It is true that this law was made to prevent laws that favor Islam, but it puts it on equal footing with all other religions. Members of The Native American Church cannot get laws passed to give themselves exemptions to use mescaline.
Very recently in history. China is bad now, European nations have been bad in the past… but who knows what the future holds.
Once data is released (keys, databases, plaintext messages, it doesn’t matter) it can’t be made private later.
In any case, selective support for technical proposals based on broader political vibes is not a particularly inspiring stance.
https://www.secureworld.io/industry-news/new-eu-push-for-enc...
On some level the US could also pass a law that says every iPhone user will be summarily executed. That’s how sovereignty works. Is it a realistic concern? Probably not.
Apple's ecosystem is, by default, design and necessity, insecure to Apple. Keys stored on an Apple device are insecure.
One can easily make a similar argument for Android/Google, however, a security conscious user could still take control over their device and install a more secure OS.
“ Is it technically possible to do what the government has ordered? Yes, it is certainly possible to create an entirely new operating system to undermine our security features as the government wants. But it’s something we believe is too dangerous to do. The only way to guarantee that such a powerful tool isn’t abused and doesn’t fall into the wrong hands is to never create it.”
Apple: "So it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8."
Also, "create an entirely new operating system" is an intentionally misleading exaggeration on Apple's part, meant to fool customers but not governments. It makes it sound like the amount of work they would have to do is larger than changing one constant about how many retries are allowed and another constant controlling rate liming, build and sign and flash it to the phone, and delete it after.
I think the FAQ and letter both make clear that Apple could comply with the FBI request and their objection was over whether they should be forced to.
If iOS 8 required a user key for updating the system, this would be technically infeasible. It's not technically infeasible as iOS 8 was implemented, so Apple stopped claiming it is, but only after the FBI embarrassed them about that claim.
> their objection was over whether they should be forced to.
Apple's objection had nothing about being forced to do it. They were forced to provide data from devices before iOS 8 and even provided a document about how to ask them to do it. Apple instead made specious claims about how hard it was and how it would affect other customers' privacy.
You have evidence that Apple has been pushing silent updates to individual users ?
For myself I’m quite happy with this as it is a huge improvement over what we had. My only irk is that they called themselves a champion of security and privacy before this..
The only true secure option is to build the source yourself, sign it with your own keys, and run it. Assuming you can read all the code and make sure its safe, and read all the code on your compiler to make sure that is safe. And you'll still need to trust the Google-signed bootloader code, which totally hasn't had suspicious custom builds released previously (ArcaneOS?)
You can't see how it works, you can't change how it works, and you have to trust that it does as advertised. You must do all this in the knowledge that over the years plenty of proprietary software vendors have outright lied to their customers about exactly this kind of thing, e.g. [0][1].
I'm not aware of Apple ever doing so though, for what that's worth.
The concern typically isn't backdoors, it's bugs. I've had plenty of terrible experiences with Enigmail.
But Android already collects a lot data from the device before encrypting.
Even MacOS is infected with this privacy invading nonsense that I can't opt out of. It has an Apple News app that I can't uninstall, and whenever anybody sends an Apple News link, even in a private tab, it opens the Apple News app, a handler that I can't disable, sending the article I want to read together with my Apple ID to Apple.
https://www.extremetech.com/mobile/340887-apple-sued-for-all....
FTFY.
Please stop spinning that as if Apple were siphoning every single of one's moves everywhere, irrespective of any telemetry setting one has set.
Both the linked piece and the reporter's Twitter thread seem to have taken great care to bury behind clickbait headlines and scary words the fact that this applies only to App Store, Books, Apple TV, and iTunes Store apps, which are all "store" apps (presumably that's where commercial stuff typically happens) that used to outright be webviews (not entirely sure they are 100% native as of today). I don't think anyone would be appalled if a React-based web app would send vast amounts of requests based on user interaction.
So yeah, they should probably not collect as much data as that and probably should have a toggle to nerf such data collection within the store apps (which is not the same as OS/actual app/service telemetry), but the way things keep getting spinned is beyond ridiculous and does not help in improving anything.