Apple claim that iCloud can store passwords “only locally” seems to be false | Hacker News Reader

Apple claim that iCloud can store passwords “only locally” seems to be false

arstechnica.com

44 pointscoloneltcb22 comments

Apple does not claim that passwords are only stored locally. Apple claims that your keychain data is only stored locally. This article does nothing to prove that Apple's claim is false.

Apple is saying that your keychain isn't stored by Apple, but only the information required to sync all approved clients.

"During this step, both the iPad and the Mac had to be connected to the Internet simultaneously."

I suspect this step sets up encryption keys between the 2 devices so that Apple's servers can be used to transfer and temporarily buffer encrypted sync messages without being able to recover the plaintext data.

Since these keys aren't known by the user (or Apple) there's no way to recover your keychain (and no point in storing the data permanently... if the devices are lost so are the keys)

I wish they would explain it in more detail for those of us who care, but I don't think this proves they're lying.

The four digit pin isn't to be confused with the passphrase that is used to encrypt/decrypt the keychain data. The pin is just an extra measure on top of your iCloud password to release your keychain data, along with SMS confirmation. A longer password or no password won't stop a government agency from being able to obtain the encrypted keychain data.

I just confirmed that the encryption key is different from the PIN by going into keychain and viewing a password in the iCloud chain. It is indeed my much longer pass phrase that decrypts the data.

What does "stored" mean? Does it mean "temporarily buffered?" If so, most networking technologies meet that criteria, and iCloud might too if it merely buffers in RAM. Does it mean "unreadable in cleartext" by Apple? Possibly, but this test doesn't answer that question.

The currently only comment in the OP seems most likely. All devices get each other's public key, and encrypt messages to each other using it. The keychain itself passes encrypted.

I wonder if the wording is wonky, but the meaning is technically correct: Not the data itself, but rather key management. The first two methods, 4-digit or complex password, will store a password-encoded key on iCloud. The second "don't create a security code" will not store a password-encoded key on iCloud. The key will instead be transferred via LAN, thus why it needs approval from another local device that has it.

This is just a hypothesis, I wonder if it's true?

I don't think the transfer occurs explicitly via LAN as other commenters point out, seems more likely Apple acts as a tunnel between the device requesting the keychain and the device authorising (sending) it.

I have a strong bias against Apple and this is my number one complaint dishonesty to customers. who cares hardly anyone. I love the no viruses and no malware with power PC chip was faster than Intel x86 chips.

It's called marketing.

To address your claims, until very recently, there were very few pieces of malware that directly targeted the Mac platform, unfortunately Java and Flash are gaping holes in this regard. Apple have been slow to fix issue where both are involved. Any others relied totally on social engineering. Regarding viruses, there are still no known viruses in the wild that target OSX. There have been a few developed in "labs" as proof of concept.

As to Intel vs PowerPC; It depends on the metric. In raw clock speed, Intel won. Raw clock speed isn't everything though. In floating point operations per second (FLOPS), RISC architecture (PowerPC, and for that matter the ARM processor that powers your Android device) is theoretically more efficient than that of CISC. It can, in some instances, be considered to be faster.

I'm sure Apple do "lie" to customers, but they haven't lied about the things you suggest they have lied about. Besides, is it any different to gaming benchmark test to pretend your device is faster than it is in daily use or paying people to say bad things about your competitors online?

When has Apple ever been dishonest to customers?

http://www.apple.com/pr/library/2010/07/02Letter-from-Apple-...

> "We have discovered the cause of this dramatic drop in bars, and it is both simple and surprising."

> "Upon investigation, we were stunned to find that the formula we use to calculate how many bars of signal strength to display is totally wrong. Our formula, in many instances, mistakenly displays 2 more bars than it should for a given signal strength. For example, we sometimes display 4 bars when we should be displaying as few as 2 bars."

People were actually meant to believe that Apple had a software bug for how they calculate signal strength all the way up to the 4th iPhone and instead not scratching AT&T's back making their network look better than it was.

You know, this Apple with the futuristic wireless testing facility: http://www.engadget.com/2010/07/16/inside-apples-black-lab-w...

So your proof that Apple is dishonest is a letter from Apple being candidly honest about their mistakes?

..only because you asked, but every large multi-national company is essentially the same.

https://en.wikipedia.org/wiki/Apple_Inc._litigation

None of those cases are about false advertising or dishonesty.

Apple lied so badly in the UK they were forced to put an apology message on their homepage with specific wording dictated by a court.

So uh, yeah.

Well, no. They accused Samsung of lying and a judge found in Samsung's favour. Interestingly enough, the very same judge is now "consulting" for Samsung.

You read too much AppleInsider. The truth is nothing like that:

  Sir Robin Jacob said Apple had published "false and misleading" material, and
  suggested the firm had shown a "lack of integrity" by saying staff would need
  two weeks to make "minor changes" to the company website.

  This month the court of appeal ruled against Apple after Samsung complained
  about a notice Apple posted online acknowledging defeat in a design dispute
  at the high court. Samsung said Apple had added an account of court proceedings
  in Germany and the US which was "inaccurate and misleading".

http://www.theguardian.com/technology/2012/nov/09/judge-appl...

How snide of you. Do you feel clever now? Jacob was the only judge to find this way and, as pointed out, is now in the employ of Samsung. I'd argue that this particular version of the "truth", clearly the one you are choosing over the several that disagree, is highly questionable. Linking a newspaper doesn't make this ruling anymore valid either.

There's no versions of the truth. Clearly you didn't even bother to read the article:

  Three judges – Jacob, Lord Justice Longmore and Lord
  Justice Kitchin – agreed that the statement did not
  comply with a court order and said Apple should post
  another statement. On Friday they gave their written
  reasons.

Stop being such a ridiculous fanboy.

You are quite right. I didn't. It doesn't change the fact that only one jurisdiction found in Samsung's favour. One. The lead judge now works for Samsung. That doesn't make you suspicious of his judgment? Longmore and Kitchin were ruling on whether or not Apple were complying with their colleagues order, nothing else. Here you are clutching at a single straw, calling me a ridiculous fanboy and suggesting that I am the one with a bias. I tell you what, when you want to discuss this like an adult we'll continue, until then grow the fuck up.

I should make a whole wiki :)

1) Mac Color coming in 6 - 12 months (Caused me to not have a new computer for 3 years)

2) NO viruses and NO malware (No OS can ever say that) http://mac-antivirus-software-review.toptenreviews.com/histo...

3) Power PC fastest CPU in the WORLD (Than Intel CPU 6-7 times faster "who knew")

4) Antenna Gate "Your holding it wrong"

5) iMessage is unreadable by Apple (Proven wrong when reverse engineered)

6) The iPhone and iPod Touch screens (Wow how many times did we see people with destroyed screens over the years)

These are just off the top of my head BUT there is so much more. I just would NEVER trust them

They still have to use some sort of buffering/transferring the key in order to sync; as long as they dont' store the keys permanently on iCloud, it's fine.

Reply on news.ycombinator.com