Hacker News Reader

Comment by tokyobreakfast | Hacker News Reader

What is your proof they don't have a duplicate key that also unlocks it? A firm handshake from Tim?

You should watch the whole BlackHat talk (from 2016!) from Apple's Head of Security Engineering and Architecture, but especially this part:

https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s

Lot of trust in the words that cannot be verified.

If they say they don't, and they do, then that's fraud, and they could be held liable for any damages that result. And, if word got out that they were defrauding customers, that would result in serious reputational damage to Apple (who uses their security practices as an industry differentiator) and possibly a significant customer shift away from them. They don't want that.

Absent the source code, it's incredibly difficult to disprove when the only proof you have is good vibes.

There are many things you can't prove or disprove in this world. That's where trust and reputation comes in - to fill the uncertainty gap.

You mean, trust and reputation of Apple? They're not exactly high:

https://news.ycombinator.com/item?id=46252114

https://news.ycombinator.com/item?id=45520407

https://news.ycombinator.com/item?id=42014588

https://news.ycombinator.com/item?id=26644216

At the end of the day, it's all about how you weigh the evidence. If those examples are sufficient to tip the scales for you, that's your choice. However, Apple's overall trustworthiness--particular when it comes to protecting people's sensitive data--remains high for in the market. Even the examples you posted aren't especially pertinent to that (except for iCloud Keychain, where the complaint isn't whether Apple is securely storing it, but the fact that it got transmitted to them in the first place, and there exists some unresolved ambiguity about whether it is appropriately deleted on demand).

None of these really match the scenario we're discussing here. Some are typical big company stuff, some are technical edge cases, but none are "Apple lies about a fundamental security practice consistently and with malice"

Cognitive Dissonance. You already made up your mind, no evidence will change it. Any evidence you get is cast aside for one reason or another.

> "Apple lies about a fundamental security practice consistently and with malice"

Uploading passwords to the cloud should count. Also this: https://sneak.berlin/20231005/apple-operating-system-surveil...

That link you provided is a "conspiracy theory," even by the author's own admission. That article is also outdated; OCSP is as dead as a doornail (no doubt in part because it could be used for surveillance) and they fixed the cleartext transmission of hardware identifiers.

Are you expecting perfection here? Or are you just being argumentative?

> That link you provided is a "conspiracy theory," even by the author's own admission.

"Conspiracy theory" is not the same as a crazy, crackhead theory. See: Endward Snowden.

Full quote from the article:

> Mind you, this is definitionally a conspiracy theory; please don’t let the connotations of that phrase bias you, but please feel free to read this (and everything else on the internet) as critically as you wish.

> and they fixed the cleartext transmission of hardware identifiers

Have you got any links for that?

> Are you expecting perfection here? Or are you just being argumentative?

I expect basic things people should expect from a company promoting themselves as respecting privacy. And I don't expect them to be much worse than GNU/Linux in that respect (but they definitely are).

> Have you got any links for that?

It was noted at the bottom of the article as a follow up.

> I expect basic things people should expect from a company promoting themselves as respecting privacy. And I don't expect them to be much worse than GNU/Linux in that respect (but they definitely are).

The problem with the word “basic” is that it’s entirely subjective. What you consider “basic,” others consider advanced. Plus the floor has shifted over the years as threat actors have become more knowledgeable, threats more sophisticated, and technologies advanced.

Finally, the comparison to Linux doesn’t make a lot of sense. Apple provides a solution of integrated hardware, OS, and services. Linux has a much smaller scope; it’s just a kernel. If you don’t operate services, then by definition, you don’t have any transmitted data to protect. Nevertheless, if you consider the software packages that distros package alongside that kernel, I would encourage you to peruse the CVE databases to see just how many security notices have been filed against them and which remain open. It’s not all sunshine and roses over in Linux land, and never has been.

The government would never prosecute a company for fraud where that fraud consists of cooperating with the government after promising to a suspected criminal that they wouldn't.

That's not the scenario I was thinking of. There are other possibilities here, like providing a decryption key (even if by accident) to a criminal who's stolen a business's laptop, or if a business had made contractual promises to their customers, based on Apple's promises to them. The actions would be private (civil) ones, not criminal fraud prosecution.

Besides, Apple's lawyers aren't stupid enough to forget to carve out a law-enforcement demand exception.

Apple has the number 1 marketing team in the world. They got away with PRISM and terrible security.

They are immune to reputation damage. Teens and moms don't care.

Terrible security... compared to what? Some ideal state that exists in your head, or a real-world benchmark? Do you expect them to ignore lawful orders from governments as well?

Cooperating with law enforcement cannot be a fraud. Fraud is lying to get illegal gains. I think, it's legally ok to lie if the goal is to catch a criminal and help the government.

For example, in 20th century, an European manufacturer of encryption machines (Crypto AG [1]) made a backdoor at request of governments and never got punished - instead it got generous payments.

[1] https://en.wikipedia.org/wiki/Crypto_AG

Reply on news.ycombinator.com