Hacker News Reader

Comment by GeekyBear | Hacker News Reader

The U.S. also attempted to force Apple to add a back door just a decade ago.

> Tim Cook, the C.E.O. of Apple, which has been ordered to help the F.B.I. get into the cell phone of the San Bernardino shooters, wrote in an angry open letter this week that "the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create." The second part of that formulation has rightly received a great deal of attention: Should a back door be built into devices that are used for encrypted communications?

https://www.newyorker.com/news/amy-davidson/a-dangerous-all-...

View on HN

The US succeeded, according to American lawmakers: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

  Apple has since confirmed in a statement provided to Ars that the US federal government "prohibited" the company "from sharing any information," but now that Wyden has outed the feds, Apple has updated its transparency reporting and will "detail these kinds of requests" in a separate section on push notifications in its next report.

Apple's hidden at least one warrantless backdoor in their systems for the purpose of federal surveillance. I have no reason to believe the exploitation stops there.

Apple and Google had no choice but to comply with the National Security Letters demanding access to user's push notification data.

They also can't refuse to comply with warrants demanding any such unencrypted data that is stored on their servers.

That's not the same thing as adding a back door to allow access to encrypted user data that is stored on the user's device.

It's also different than storing encrypted user data on your server, when you have purposefully designed a system where you don't have access to the user's encryption key.

Encrypted user data backup is the feature that Apple disabled access to in the UK rather than comply with the order to insert a back door in the OS.

You'd better hope you're right. Nobody is auditing Apple who can hold them accountable. The lack of transparency is how we ended up on this slippery slope in the first place.

Good security models typically don't hinge on being lucky.

Nobody is auditing Google to prove that they aren't selling user data to third party data brokers.

Should we disbelieve them when they say they don't do so?

To clarify: When you get an NSL, not only is it impossible to refuse and stay in business, it is also impossible to talk about it. That's the scary bit.

Certainly. At least with a normal warrant you can publicly speak out and notify the user(s) involved.

I would also point out that it was Senator Wyden who initially informed the public of how much the government was already spying on their unencrypted communications.

His record on civil liberties is excellent.

You need to think about what they don’t say with these matters.

He said Apple does not have and won’t create a backdoor. That was well crafted and means exactly what he said, any implicit meaning is an artifact of your brain.

I might postulate that while Rhubarb LTD absolutely doesn't hold and will never create a backdoor, Celery Inc does. Ignore the fact that Celery is staffed by some of Rhubarb's senior engineers working part time. Ignore the fact Celery are contracted to do security assessments so have access to all the source code, radio firmware and schematics...

I absolutely don't actually know anything about Apple, but I've seen some of the ways even small companies legally split themselves up to avoid tax or various forms of liability. Multiple phone numbers to the same phone, multiple domains and email providers to the same laptop. Multiple denials that you've ever heard of the other company let alone happen to share the same office space...

There's a massive difference between a truthful statement and an honest one; anyone that works with code should understand that.

Reply on news.ycombinator.com