Hacker News Reader

International users that have Advanced Protection enabled would in theory be safe from all of the 3-letter agencies (like safe from those agencies getting the data from Apple...not safe generally).

Realistically we are talking about FISA here, so in theory if the FBI gets a FISA court order to gather "All of the Apple account data" for a non-us person, Apple would either hand over the encrypted data OR just omit that....

Based on the stance Apple is taking here, its reasonable to assume they would do the same in the US (disable the feature if USG asked for a backdoor or attempted to compel them to decrypt)

Would your answer be the same if this encrypted data was stored in China instead of US?

I don't think messages should ever leave the device, if you want to migrate to a different device this could be covered by that user flow directly. Maybe you want to sync media like photos or videos shared on a group chat and I'm fine with that compromise but I see more risks than benefits on backing up messages on the cloud, no matter if it's encrypted or not.

I think the average human will disagree with you. They want to preserve their data and aren't technically competent and organized enough to maintain their own backups with locally hosted hardware. Even the technically literate encourage _offsite_ backups of your data.

Know your threat model and what actions your trying to defend against.

Typical humans need trusted vendors that put in actual effort to make themselves blind to your personal data.

> its reasonable to assume they would do the same in the US (disable the feature if USG asked for a backdoor or attempted to compel them to decrypt)

I think it's more likely that Apple would challenge it in US courts and prevail. Certainly a legal battle worth waging, unlike in the UK.

This has already happened, and Apple did fight it in the US courts.

Eventually the US government withdrew their demand.

https://en.m.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption...

Exactly.

https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...

It's worth pointing out that just because the FBI didn't have the access they wanted, it doesn't mean that other agencies don't, or that the FBI couldn't get the data they wanted by other means (which was exactly what they ended up doing in that specific case). It just means that they wanted Apple to make it easier for them to get the data.

It's good that Apple refused them, but I wouldn't count that as evidence that the data is secure from the US government.

It's also worth noting that the US courts have long held that computer code is speech.

Apple's legal argument that the government's demand that they insert a backdoor into iOS was tantamount to compelled speech (in violation of the first amendment) was going over a little too well in court.

The Feds will often find an excuse to drop cases that would set a precedent they want to avoid.

This is different IMO. When you buy Apple you buy an American product and you know the company is beholden to US law. Snowden has made perfectly clear how much they can be trusted. When you buy it anyway it's an informed choice.

Here a country that has no ties with most of apple's customers is just butting in and claiming access to all of them.

So what's next. Are we also giving access to everyone's data to Russia? Iran?

Agree in principle, though WhatsApp backups are encrypted with a user provided password, so ostensibly inaccessible to Google or whoever you use as backup

What makes you think WhatsApp backups don’t have a secondary way to unlock the encryption key? Wouldn’t it be more logical to assume the encryption key for whatsapp backups can also be unlocked by an alternate “password”

If the US is willing to build an entire data center in Outback Australia to allow warrantless access to US citizen data, why wouldn’t they be forcing WhatsApp backups to be unlockable?

> Totally agree. Having this discussion so US centred just makes us miss the forest for the trees. Apart from data owned by US citizens, my impression is that data stored in the US is fair game for three letter agencies, and I really doubt most companies would spend more than five minutes agreeing with law enforcement if asked for full access to their database on ̶n̶o̶n̶-̶U̶S̶ ̶n̶a̶t̶i̶o̶n̶a̶l̶s̶ anyone.