Hacker News Reader

No, the same point can't be made against Apple.

Apple encrypt WiFi passwords and never store them in plain text – not on their servers and not on the device. The encryption requires your login password to decrypt which Apple also don't store in plain text on their servers (although it is accessible on the device if you don't use a PIN or password, it is not backed up to iCloud).

The reason why this allegation is levelled against Google: they don't encrypt backups and they don't encrypt WiFi passwords on the device.

A little more specifically about iOS WiFi passwords: the Keychain (which is where WiFi passwords are backed up on iOS and the Mac) is AES encrypted and requires your login password (or your Apple ID password) to decrypt. Unless Apple is also stealing plain text versions of your login passwords (there's no indication that they are) then it is not possible for Apple to read your WiFi password. Yes, theoretically, they could steal your Apple ID password too but there's no indication that they do (and they've talked about the exact security on Apple IDs following the developer.apple.com breach recently).

If you lose your Apple ID password and reset it, are all your WiFi passwords gone?

That depends on the meaning of "reset". If you create a new password for the same user ID, then no -- the stored WiFi passwords are retained. If you create a new user ID and password, then yes.

OK so in the case of a "normal" lost password then how is it that it's safe on Apple's servers? That is, if it's not encrypted with a key derived from your password, then Apple can still decrypt.

> OK so in the case of a "normal" lost password then how is it that it's safe on Apple's servers?

In a word, it isn't. The new password is no more nor less safe than the old one. Or are you asking about the data, not the password? Pretty much the same answer.

OK, so Apple is in the same boat as Google. If you can reset your password and still access your data, then it wasn't encrypted in any meaningful way.

Actually, your passwords are gone if Apple resets your Apple ID.

If Apple resets your Apple ID password and you restart your device (remember: the Apple ID is kept decrypted in RAM while the device is running), you lose the entire keychain and must re-enter all passwords.

Although both are American companies operating under the same rules, there is a fundamental difference between Apple and Google's business models.

Apple makes its money from selling you new hardware every year or two - they need to make you lust after slick, shiny things every keynote.

Google makes its money from knowing about you, mining that data and converting that into advertising clicks - they need to collect as much information about you as possible.

Which means that the same pieces of data have different value to the two companies.

(Of course, Facebook follows a similar model to Google)

> "The reason people don't seem to be ganging up on Facebook, Apple, etc. in a similar way is because they never really earned that faith. Take Facebook: from the very start their founder was known to consider their users "dumb fucks" for entrusting him with their privacy."

Not really. We only learned of FB's attitude to privacy when they started changing defaults and were being sued by the Winklevoss bros. Otherwise, we may never have known what he thought of his early users.

Apple never claimed "Don't be evil" as a motto and they do appear to care more about security. There is encryption in some of their products (even though they can likely still gain access - a point that is made in the article). Arguably, they've done more than Google to demonstrate that they care about my data.

> This very same point could be made against Apple, for instance, but there hasn't been a single comment to that effect in any discussion of this article.

See a couple of months ago (the context is iMessages but the level of implicit trust is the same): https://news.ycombinator.com/item?id=5943778

Acknowledged. I still argue that Google's getting more than its fair share of abuse, though.

Fair share? Abuse? It is a criticism made against a corporation. It deserves scrutiny and a critical eye whenever it fails, regardless of what it's competitors do.

I hate to say it because I abhor the word, but this reeks of fanboyism.