So…. I’d assume the same applies to Apple?
back
2 comments
Of course, it's privacy "redefined".
Not really. Apple has recently implemented comprehensive encryption measures. They themselves cannot access your data, so there is nothing for them to disclose. It's hard to understand why anyone would choose anything other than Apple these days tbh.
Key management is a black box controlled by them. Encryption itself is pointless if they can be compelled to give up the key.
You probably don't need to compel them. PRISM have shown it's easy to setup a program where they are forced to just share everything through a back door to the gov and not tell anyone.
It's it's closed source, assume the worse.
They are willing to give you the only key, provided you release them from obligation to help you get your own information back if you lose your key.
For most people's threat model, this is not necessary, as even in the case of the San Bernardino terrorist iPhone, Apple doesn't tend to defeat their own security measures on demand. But following that situation and others, Apple added additional measures making it even more difficult for themselves.
See this support article:
"Advanced Data Protection for iCloud is an optional setting that offers our highest level of cloud data security. If you choose to enable Advanced Data Protection, your trusted devices will retain sole access to the encryption keys for the majority of your iCloud data, thereby protecting it using end-to-end encryption. Additional data protected includes iCloud Backup, Photos, Notes and more."
Are you sure? Do you have the skills and equipment necessary to verify that apple's software and hardware work as they claim. A safer bet would be to assume that apple's government spy device is just as good at spying as google's government spy device.
I mean or you could just look at cases where the encryption has been tested in court by law enforcement. Unless they're sending your phone to Israel at great expense they're not getting in if you have anything but the simplest passwords.
It's not like phone and iCloud data hasn't been subpoenaed before.
The government will read it only when it really wants to. The hospital shooter and the trump shooter were not worthwhile revealing that they can access all the data.
That's a square trade.
I'll keep my nefarious behavior on this side of mass murder, and FBI doesn't read my documents.
You misunderstand me. They are reading it. They won't tell people they they're reading it without a good reason. They want people to keep sending data.
If the US government wants your data badly enough they can compel apple to push and update to work around all of these measures. As long as you don't own your device no amount of encryption matters.
> It's hard to understand why anyone would choose anything other than Apple these days tbh.
You could just not put your data into the hands of one of these companies.
You're basically arguing that there's no point to encrypting 100% of phones. You get that this isn't a useful position to take, right?
I think they're arguing that encryption done by someone else on your behalf is not actually in your control. And if the people who do control it are beholden to the government requests, then they are not a safe option either.
I'm not deeply familiar with Apple's encryption systems, but from the other commenters here, it appears that Apple holds the keys and also controls the source code and distribution to the device. It sounds like it might be trivial for them to invalidate their own security.
Apple uses hardware encryption on iPhone and famously told th FBI to pound sand when ordered to break it.
They're also apparently incapable of breaking it in that specific way on newer phones. (force update that allows unlimited PIN unlock attempts, only possible on the 5c and below)
If you had read absolutely nothing other than Apple’s marketing material I can see how you might come to that conclusion.
Here's a 224 PDF marketing material to poke holes in.
https://support.apple.com/en-gb/guide/security/sece3bee0835/...
I don’t know if maybe you missed what I said but the point I was making was that you can’t actually get the full picture of the situation from Apple’s information alone so I don’t know how sending me a link to a PDF that their marketing made is going to help no matter how many pages it is.
I understood. I thought the pdf provides one the road map to start verifying the material.
The internet is full of sources that go deeper than what Apple thinks the general public is interested in.
Here is another PDF describe the security certifications. https://help.apple.com/pdf/sccc/en_GB/security-certification...
One could also start here with another third party review of the cryptographic process.
https://csrc.nist.gov/CSRC/media/projects/cryptographic-modu...
Here is a document with other third party certifications of the validity of the original document.
The full picture is quite complicated but a curious person has access to more than enough data to either make an informed decision or decide to trust no one.