Hacker News Reader

Comment by Spooky23 | Hacker News Reader

I think it’s likely because nobody understands or believes it.

Techie people on HN adopt a “no true Scotsman” attitude, and assert that anything is not enough. People who know nothing don’t understand enough to understand the nuances, see the obvious abuses of privacy on the web, Facebook, etc and assume it’s bullshit.

View on HN

Nobody understands or believes Apple's stance either. All they'll do is give us whitepapers on how things should work, which we know has been fabricated at least once in the case of Push Notification backdoors: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

This isn't a no-true-scotsman attitude. This is a rational reaction to security theater when nobody can prove that Apple is doing what they claim to be doing.

Could you point to the white paper that would apply to notifications privacy? I can’t seem to find anything claiming notifications are encrypted, often the opposite.

You're putting words in my mouth. I never said they were encrypted. I said that Apple deliberately misled developers about the surveillance functionality by pushing whitepapers that do not accurately describe how these systems work. This prevents developers from protecting their users and creates confusion around how Apple services operate.

Even if it was E2EE - trusting Apple with proprietary crypto is like trusting Microsoft to not backdoor Bitlocker. It requires a specifically-qualified moron who doesn't respond to technical arguments and only understands marketing language.

Your literal words are

> All they'll do is give us whitepapers on how things should work, which we know has been fabricated at least once in the case of Push Notification backdoors

I’m asking for evidence of your own claim. Apple do not claim that everything is encrypted, they specifically call out various aspects as being unencrypted.

Respectfully, I think you’re drawing an incorrect inference.

They don’t exhaustively list all risks and perils, but that risk was known to me personally and documented by Apple at least circa 2020 — I worked with some third party developers to provide options to keep potentially high risk data out of APNS messages. Similar risks exist for Google’s platform. I’m not some genius with access to arcane knowledge, but if you’re doing your job it’s part of your risk assessment.

Judging by your very technical closing comment, this has no weight on your opinion, but I appreciate your taking time away from auditing Veracrypt or LUKS to read this.

Yeah I'm just a lowly indie iOS app developer but I remember way back in iOS 10 when Push Notification Service Extensions were introduced and one of the examples used (indeed, in the current documentation as well) was to be able to have the contents of push notifications be encrypted over apns and decrypted on-device.

Apple's computing model is, in fact, fundamentally incompatible with privacy. They can say they value privacy all they want but as long as the user doesn't control the machine themselves it means almost nothing.

Having recently dug an old iPad out of the electronics bin at the transfer station this is acutely felt. I actually found an android tablet at the same time. I appreciate the desire to thwart theft, but lord! Wipe the android tablet, log in with Google, good to go. iPad can only be ground up and added to the asphalt to help slow down the aging of road surfaces. Again, I get the anti-theft angle, but this is so far beyond that. You are literally leasing the hardware from the manufacturer until such time as they decree you should be done with it. Never mind the thought exercise of what Apple could do if they wanted to if you were found to have CSAM and the state asked them to remove your access. No thank you.

Abuses of privacy? Hardly it is all completely legal.

That is the genius of it the tech industry writes the laws. How much money did Apple donate to Trump?

Thank you for illustrating the point so quickly.

Reply on news.ycombinator.com