Hacker News Reader

Comment by nicce | Hacker News Reader

> They offer no option to delete your passwords from the Cloud once there?

Does it matter tho. Like in general internet, once something is posted, it will not disappear with certainty. We can never be certain that there is a copy of the encrypted password on some log file when we have no visibility into that sytem. Since it is encrypted, it passes the regulation checks.

That is just a UI bug if passwords keep coming back in the cloud/you still see them. Unless there is a system in place that can transparently verify that indeed, the passwords are deleted, does it matter?

View on HN

Sorry, this is false.

You can absolutely to a high degree protect and store data, including the safe removal.

An organisation like Apple should absolutely be forced to delete the data, especially data collected using deceptive tactics

> You can absolutely to a high degree protect and store data, including the safe removal.

> An organisation like Apple should absolutely be forced to delete the data, especially data collected using deceptive tactics

As long as there are no consequences (regulation checks with fines) of not doing it correctly and/or if there is no observability and enforceability, it is just talk and does not matter in practice. Essentially, until the previous applies, it is just exchanging trust with words.

Why? Why can’t the default state be that I can trust my vendors of software not to gobble up my most private information?

OpenBSD has never sent my passwords to Theo’s basement. I trust them without regulations. But more importantly, there’s a crew of capable hackers dissecting the code.

I would like that default, but otherwise it is a bit silly assumption.

1. You can't demand something that cannot be enforced/monitored

2. You can't enforce/ push monitoring if there is no regulation in place, and systems are not transparent.

3. Enforcement/monitoring does not matter if there is no stick (fines) present

In the case of OpenBSD, you are using open system that you can verify your self. That alone makes them less likely to do something malicious (since they might get caught more likely!) and changes the trust. There is no financial carrot to make Apple products visible, as most of the users don't understand a thing about the technology and marketing might be more efficient than opening technology, which might result in intellectual property theft and lose of market position.

Since everything cannot be transparent in a competitive and commercial world, I think it would be okay to put at least 10 times bigger fines for those who do not have transparent systems and get caught on not following the regulations to get some balance.

That there isn’t an open, mobile hardware platform is a failure of the community, in my opinion.. although some have the right ideas, framework as an example of an open laptop platform.

We desperately need a free hard- & software (*nix) mobile platform, that is not exclusively owned by a for profit mega corporation and somewhat mainstream amongst the hacker community. Even better would be competing systems. I imagine these systems to have a high degree of modularity, incl. battery, and memory upgrades.

This is not an easy undertaking.

I don’t think regulating the megacorps is the answer. In a commercial world, they have the deeper pockets

Your passwords are encrypted with keys stored only in the local on-device TPM.

This is a pretty lame windmill to tilt at.

The only person guaranteeing this is the case and will stay the case is the person keeping your passwords. That seems to me to be a pretty wild thing to have faith in.

Companies aren’t people. Compare the benefits to a multi trillion dollar company to maintain security vs the minimal benefits from using your passwords for anything.

They really want to avoid the risk from anyone inside the company having access to your passwords and then doing anything with them.

Indeed, companies are not people.

Compare the consequences for a large company vs an individual.

For the individual, if caught, a debilitating fine and, depending upon damages, jail time. Probable end of career, if related.

In short, life changing.

For the company, possible fine almost certainly less than the revenue made. Small chance of larger civil suits, with legal costs and possible judgments. Depending upon visibility, perhaps some additional PR spend. Even if the sum total cost is greater than the associated revenue, those costs can be used to offset tax liability.

In short, low risk of existential threat, or even actual financial loss -- just reduced profits.

The company will also consider the benefits of cooperating with Spook Agency Inc.

Maybe a plunge protection stock-price guarantee.

Or NOT.

A person is likely not to be caught making their downside a fraction to their personal well-being and finances. 1/3 of the people on early would easily see more upside than downside from getting access to your banking info.

Apple on the other hand would see your bank balance as a rounding error to a rounding error, but could easily lose a billion dollar from bad publicity that’s what’s balancing vs any financial upsides. Further, doing it once doesn’t move the needle it needs massive scale and thus massive risks to be worth anything to them.

I think you misunderstood my comment.

It is essentially about the trust. You either trust that they don't misuse the cloud-uploaded passwords or not. If you cannot trust that, you cannot trust the whole ecosystem as the same entity controls it and can misuse it in any imaginable way.

So essentially, the issue of deletion is just about the visibility in the UI, if we trust their claim about the end-to-end encryption.

Reply on news.ycombinator.com