Apple says it will remove services such as FaceTime and iMessage from the UK rather than weaken security if new proposals are made law and acted upon.

Flying Squid@lemmy.world to Technology@lemmy.world – 1823 points –
Apple slams UK surveillance-bill proposals
bbc.com
347

This is the correct response. Either everyone has protection or no one has. Not that I'd trust apple anyway but by pulling the service your average person is likely to make some noise because they can feel the effect.

I'm not even an Apple user but somehow I still feel like Apple is one of the very last companies where privacy and the security of your data is more worth than a dime.

Nope, Apple sells your data just as much as Google does: https://www.insiderintelligence.com/content/apple-ad-revenues-skyrocket-amid-its-privacy-changes https://www.vox.com/recode/2022/12/22/23513061/apple-iphone-app-store-ads-privacy-antitrust#luMMel

While people noticed their new policies against 3rd party apps, that masked the fact that those policies carved out an exception for first party apps, meaning they collect (anonymous) data on you through Health, Journal, Music, etc. just like every other company. "Trusting them more" is simply a result of you and everyone else getting hit with their privacy ads recently.

Edit: "just like every other company" meant Google and Microsoft, i.e. the other big equivalent tech companies, my fault for not being specific.

While I’m all for calling out companies for abusing your privacy, your own links show that they don’t collect as much data as google. They could (and should) be better though.

Nope apple is literally worse than hitler, spez, and elon musk confirmed. Tim apple fucked my wife in front of me.

You lucky sonofabitch. You got to witness the ol Apple Pie with your own two eyes.

Wow, your wife must be really hot if a gay guy saw her and said ‘would’.

Anonymous data is actually pretty different to the data everyone else collects, which literally has your name and picture

Apple’s data is useful for trends but it can’t be used to study who I am.

This comment needs to be further up rather than the idiotic takes that don’t understand the difference between anonymized data collection (Apple) vs identifiable data collection (Meta/Google/most other tech).

Well, then there's also the people that don't realize that there are all sorts of programs out there that will try to take that "anonymized" data and then tie it right back to a persons profile.

For example, you can anonymize GPS location data, but just because you strip away identifying information doesn't mean that you're truly anonymous. It can still be obvious where you live and where you work. And once you figure out where they live (again based on anonymous data) you can tie that information right back into their profile and continue to track them as if nothing has changed. https://www.popularmechanics.com/technology/security/a15927450/identify-individual-users-with-stravas-heatmap/

That won’t work on Apples data - they group all the data into cohorts, so the anonymising isn’t reversible.

Can you explain a bit more about Apple grouping their data into cohorts? I haven't heard much about this before. For example, how would grouping data into cohorts work with GPS data?

Not all anonymization techniques are created equal? I’m pretty sure this is fairly obvious at this point to anybody remotely familiar with how data collection works when it comes to privacy and device metrics.

So, how is this relevant to this conversation besides adding more FUD and misinformation?

You sound like you know a lot more than everyone else on this subject so I thank you for your responses as a means to educate others.

Just a word of advice, be sure to treat others with respect rather than assuming the worst of their intentions or calling them idiots because they don't know as much as you.

My response is still relevant to the conversation as we are talking about "anonymized data". The link in my comment above proves that just because you are told your data has been "anonymized" does not truly mean that it's impossible to re-attribute it back to an individual.

So if you trust that Apple has great techniques for data anonymization, that's awesome, feel free to expand on that and explain why. Just don't go around telling others that simply having any sort of anonymization technique makes it so you don't have to worry.

Thanks for the “advice”. Now, let me expand on my position.

The reason why I’m slightly annoyed but everyone’s take here is:

  1. The demeanor that folks here have in passing on ill informed opinion as fact and then speculating details.
  2. Not looking at the actual privacy policy of a company and the history of how said company has been involved in data collection, privacy, implementation of features in that realm and their handling of customer data.
  3. Bringing up random points just to win an argument instead of conceding that they do not what they are talking about.

Here’s a few links to put things in perspective as to what and how Apple anonymizes data and how seriously it takes privacy:

https://www.apple.com/privacy/docs/Differential_Privacy_Overview.pdf

https://www.apple.com/privacy/labels/

https://www.apple.com/privacy/control/

Read through those, look at Apple’s implementation of TouchID, FaceID and their stance on E2E encryption and tell me again why Apple isn’t serious about privacy, masking and anonymizing data, implementing differential privacy and informing users of what they collect and how users can opt-out of it.

Edit- Further evidence and reading:

https://www.techradar.com/news/fbi-says-apples-new-encryption-launch-is-deeply-concerning

https://www.digitaltrends.com/mobile/apple-data-collection/

https://www.apple.com/privacy/docs/A_Day_in_the_Life_of_Your_Data.pdf

I've been reading through the links you posted as well as looking through other sources. I agree Apple is definitely taking more care with how they anonymize data compared to companies such as Netflix or Strava.

In Netflix's case they released a bunch of "anonymized data" but in just over 2 weeks some researchers were able to de-anonymize some of the data back to particular users: https://www.cs.utexas.edu/~shmat/netflix-faq.html

I've already linked Strava's mistake with their anonymization of data in my above comment.

and tell me again why Apple isn’t serious about privacy,

I think you must have me confused with someone else, up to this point in our discussion I never said that. I do believe that Apple is serious about privacy, but that doesn't mean they are immune to mistakes. I'm sure Netflix and Strava thought the same thing.

My whole point is that you can't trust that it's impossible to de-anonymize data simply because some organization removes all of what they believe to be identifying data.

GPS data is a fairly obvious one which is why I brought it up. Just because you remove all identifying info about a GPS trace doesn't stop someone (or some program) from re-attributing that data based on the start/stop locations of those tracks.

I appreciate that Apple is taking steps and using "local differential privacy" to try to mitigate stuff like this as much as possible. However, even they admit in that document that you linked that this only makes it difficult to determine rather than making it impossible:
"Local differential privacy guarantees that it is difficult to determine whether a certain user contributed to the computation of an aggregate by adding slightly biased noise to the data that is shared with Apple." https://www.apple.com/privacy/docs/Differential_Privacy_Overview.pdf


Now for some counter evidence and reading:

Here's a brief article about how Anonymized data isn't as anonymous as you think: https://techcrunch.com/2019/07/24/researchers-spotlight-the-lie-of-anonymous-data/

And if you just want to skip to it, here's the link to the study about how anonymized data can be reversed: https://www.nature.com/articles/s41467-019-10933-3/

informing users of what they collect and how users can opt-out of it.

It would be great if users could just opt-out, however Apple is currently being sued for continuing to collect analytics even on users that have opted out (or at least it appears that way, we'll have to let the lawsuit play out to see how this goes).
https://youtu.be/8JxvH80Rrcw
https://www.engadget.com/apple-phone-usage-data-not-anonymous-researchers-185334975.html
https://gizmodo.com/apple-iphone-privacy-settings-third-lawsuit-1850000531

That DigitalTrends article you linked was okay, but it was written in 2018 before Mysks's tests.

As for your TechRadar link to Apple's use of E2EE, that's great, I'm glad they are using E2EE, but that's not really relevant to our discussion about anonymizing data and risks running afoul of the #3 point you made for why you are frustrated with the majority of users in this post.

I understand it can be frustrating when people bring up random points like that, I'm assuming your comment for #3 was directed at other users on this post rather than myself. But feel free to call me out if I go too far off on a tangent.

I have tried to stick to my main point which is: just because data has been "anonymized" doesn't mean it's impossible to de-anonymize that data.

It's been a while since I've looked up information on this subject, so thank you for contributing to this discussion.

:-) Thanks for the detailed response. Let me take a look and get back to you.

My whole point is that you can’t trust that it’s impossible to de-anonymize data simply because some organization removes all of what they believe to be identifying data.

GPS data is a fairly obvious one which is why I brought it up. Just because you remove all identifying info about a GPS trace doesn’t stop someone (or some program) from re-attributing that data based on the start/stop locations of those tracks.

Looking at all the links you’ve posted… so there’s been cases and studies stating that data can re-identified, but do we have insight into what exact data sets they were looking it at? I tried looking at the Nature study but it doesn’t say how they got the data and what exact vectors they were looking at outside of mention of 15 some parameters such as zip code, address etc. Data pipelines and implementation of metrics vary vastly, per implementation, I’m curious to see where the data set came from, what the use case was for collection, the company behind it, the engineering chops it has etc.

If from a data collection standpoint you’re collecting “zip code” and “address”, you’ve already failed to adhere to good privacy practices, which is what I’m arguing in Apple’s case. You could easily salt and hash a str to obfuscate it, why is it not being done? Data handling isn’t any different than a typical technical problem. There’s risks and benefits associated to an implementation, the question is how well you do it and what are you doing to ensure privacy. The devil is in the detail. Collecting “zip code” and “address” isn’t good practice, so no wonder data become re-identifiable.

https://youtu.be/8JxvH80Rrcw https://www.engadget.com/apple-phone-usage-data-not-anonymous-researchers-185334975.html https://gizmodo.com/apple-iphone-privacy-settings-third-lawsuit-1850000531

More FUD. Why aren’t they testing iOS 16? Ok, sure, it’s sending device analytics back… but it could just be a bug? The YT video is showing typical metrics, this isn’t any different to literally any metrics call an embedded device makes. A good comparison would be an Android phone’s metrics call and comparison to it side by side. I’m sorry, I refuse to take seriously a video that says “App Store is watching you” and tries my skews my opinion prior to showing my the data. The data should speak for itself. I see the DSID bit in the Gizmodo article, but that’s a long shot, without any explanation of how to the data is identifiable specifically.

Lastly,

As for your TechRadar link to Apple’s use of E2EE, that’s great, I’m glad they are using E2EE, but that’s not really relevant to our discussion about anonymizing data and risks running afoul of the #3 point you made for why you are frustrated with the majority of users in this post.

Privacy is fundamental to designing a data pipeline that doesn’t collect “zip code” in plain str if you want to data to be anonymized at any level. So it is absolutely relevant. :-)

Edit: To clarify, if it wasn’t clear, relying on just data anonymization and collecting everything under the sun isn’t a good way to design a data pipeline that allows for metrics collection. The goal should always be collecting as little as possible, then using masking, anonymization and other techniques to obfuscate it all. No solution is perfect, but that doesn’t there aren’t shitty ways of implementing things leading to the fiascos you see on the web.

Metadata is anonymous yet people still get fingerprinted by it.

As much as Google? Likely not. Does their carefully curated pro-privacy image actually match their practices? Also likely not.

“Just as much as Google.” LMAO. We have an expert here.

I feel like wuth the amount of stuff done on device and not in the cloud with iPhones and other Apple products, saying that Apple sells just as much as Google is at the very least disingenuous…

Why? They gather data locally on your device rather than on a cloud service. Why do you feel the locality where they gather your data makes the comment disingenuous?

If your device locally analyzes your behavior and files, then Apple itself is not actually collecting and analyzing your data. The "locality" is a fundamental difference in who is doing what. If your private information never leaves your phone, your privacy is still fully maintained.

There is a massive leap between collecting data and selling your data.

I am against both but in the digital age actually knowing who has your data is such a relief. My old email got sold to third party’s a bit to many times and to this day 80% of the incoming messages are blatant generic America targeted phishing.

Health is on-device, and is E2EE. To my knowledge, that's always been the case. They do allow optional data linking services, but those need to be setup by the end-user. Apple should have no knowledge of this data, by default. Notes can be E2EE (with ADP), and with Journal (a new iOS feature) being E2EE. Music is a paid for service, with no ads, and is one of the more privacy respecting options. Data is needed for Music to help serve the user, and suggest artists/songs... it's literally one of the platforms benefits, over self-hosting.

None of the major players literally sell your true name and address. All mask the data, and then do stuff with it like create trends to know which ads to display to "users that search for tiktok on the app store/play store"

Apple does not sell user data. By all means, look at their Privacy Policy (it's easy to read), and show me where this is mentioned. They do collect it, and use it for their own marketing platform, but they don't sell/trade it. In fact they DO anonymise the data they collect. Take a look: https://www.apple.com/privacy/docs/Differential_Privacy_Overview.pdf This is just one document, found after a quick search. They also disclose other details on their security, and other privacy (or lack thereof) aspects.

Now show me where other ad agencies, not just one or two, that goes to the same lengths, while also giving decent documentation. I'm not saying Apple is perfect (far from it).

They do collect it, and use it for their own marketing platform

Right

but they don’t sell/trade it

Then what are they collecting it for? To line their servers? It's being used to train services, and those services that have ads have those ads targeted using the data collected in the first sentence I quoted.

In fact they DO anonymise the data they collect

So does google. Again, to the broader thread audience replying to my original comment, what is the difference?

You're right. Not sure why you're downvoted.

Google would be stupid to sell your data. Instead they keep it private, and when people go to Google, they tell them to push ads to certain groups or take surveys from certain groups, and Google does so. They do not hand those advertisers your data, otherwise those advertisers would never come back. They have the data.

I recently learned that one method for companies to get around data selling laws is to give the data away for free in order to attract certain types of advertisers, then, they sell ad slots for people with specific demographics or interests.

They don't sell the data because that is harder to do with laws restricting it, so they just use it as advertiser bait in ways that bypass the law.

Further reading: https://www.eff.org/deeplinks/2020/03/google-says-it-doesnt-sell-your-data-heres-how-company-shares-monetizes-and

The difference is that there are actually companies out there that will sell you the raw data they collected. E.g. your name and address if they have, your browsing history obtained through shady extension and so on.

So there is a difference between selling the data and hoarding it to show targeted ads.

And while both may not be cool, to me anyone with some money being able to buy my data is clearly worse. So it's helpful distinguishing there. It's not all "selling your data". You are also doing your argument a disservice by lumping it all into the same bucket.

@zettajon @hardypart there is nothing stating that Apple is using your data, selling your data, or even getting your data. While it did create a situation where ad dollars are going to App Store it’s still not targeted other than by search. Your own posted link says nothing about what you claimed. There are plenty of issues to bring up about Apple without the need of fabricating one.

Did you read the article you posted? Apple serve you ads, they don’t sell your data. And they allow you to opt out of tracking. It’s all right there in your article.

I know this is off topic, but Apple isn't innocent.

It's almost worse to think your privacy is protected when it's not, than to know it's not. At least I know Google is sending my Google Assistant sound clips to be analyzed. Sucks when you learn the person you thought you could trust is fucking behind your back.

They're just jumping on theme. It's what they do. Appeal to trend.

Any company that obfuscates all their security practices, refuses to give statistics on security risks and counter measures, and boils their product security down to "Trust us, bro.", doesn't actually give a fuck about your security. They're just the last company who is still able to keeps everything secret so they can make shit up as they go along. Apple's security is a joke and they're just as bad as any other manufacturer on the market, the only difference is they have successfully kept their shit secret for all these years and spent decades convincing people they actually give a fuck about security.

I still remember a few years ago having a conversation with a coworker about her iphone and she bragged about Apple never being hacked and this was right after I had just got done reading an article about a large scale hack on their network. Of course Apple never said a damned thing about it, so I forwarded her the article. IIRC she mumbled something about how the article was probably not accurate. Apple fanatics do some crazy mental gymnastics to justify them spending thousands on a phone thats probably worth about $300 at best(their hardware is on average 1-2 generations behind other devices on the market).

Did you know that most celebrity phone hacks are thru apple accounts?

obfuscates all their security practices

https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf

https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web

https://developer.apple.com/documentation/cloudkit/encrypting_user_data

I had just got done reading an article about a large scale hack on their network

Source? Or should I just "trust you bro"

Did you know that most celebrity phone hacks are thru apple accounts?

Did you know that most celebrities own iPhones by a far margin? These aren't the encryption was broken hacks when someone is getting into an iCloud account, these are social engineering hacks. That's what happens when your publicist, your agent, and others have access to your digital accounts so they can get you a new phone quick while you are on the road, grab the photos you took on your phone from your iCloud account to share, etc. More holes in security.

about $300 at best(their hardware is on average 1-2 generations behind other devices on the market)

Flagship android phones, barring a few exceptions, are not sold without pre-installed apps that subsidize the cost of the phone.

Do you have an example of a device priced at $300 with competitive hardware to the base iPhone 14, without bloatware subsidizing the cost of the device? I'd accept that generally iPhones are ~$100-200 above the price of devices with competitive hardware, but a current gen iPhone having $300 hardware? The specs are very similar to other devices in similar price ranges

I've owned both Pixels and iPhones before. While each has its pros and cons, I've found that the app sandboxing, default settings, and ability to opt out of telemetry was always better on iPhone. And until google has free, easy-to-use E2E encryption for Android devices and the related cloud services, customer data on Google's servers is more at risk to be stolen/sold for profit/used without explicit user consent.

Do you have an example of a device priced at $300 with competitive hardware to the base iPhone 14, without bloatware subsidizing the cost of the device? I’d accept that generally iPhones are ~$100-200 above the price of devices with competitive hardware, but a current gen iPhone having $300 hardware? The specs are very similar to other devices in similar price ranges

Not to mention that iPhones are literally best in the world in terms of the SOC. No other phone in the world matches them. Saying "their hardware is on average 1-2 generations behind other devices on the market" shows how wrong that person is.

Yeah tbh I started to write a comparison of phones like the fairphone and the purism librem 5, and even the pixel 7, but they are laughable in comparison to just the base iPhone 14 hardware wise. Sure, one is $150 less, but the Librem is like 1300 dollars by comparison to the iPhone 14’s $800, and they are performing at maybe 1/3 of the A15 Bionic SOC. The pixel 7 doesn’t fair much better by price comparison, and again, it’s making google money by selling user telemetry more actively.

I encourage competition, I don’t think apple should own the market forever. And they haven’t. They almost failed before the first iPod and iPhone. But they’ve come back in terms of their ability to produce powerful silicon. The M series of processors solidifies it.

Competition is good, and when a company is pushing the market and also pushing a real security agenda? It’s a good thing, let the competitors catch up with security, and then work to beat apple at the SOC game.

Apple has been dethroned at silicon before, once PowerPC died, it can (and probably will) happen again.

That’s a good thing.

Let competitors build better E2E encryption and on-device security. The competition of better security is good for everyone.

I would love to see apple be de-throned, but I think until there is a shift on a combined focus of hardware/software/security as a product (and having users pay the premium for that) it won’t happen for awhile

I'm sure stock pixel is bad, but grapheneos (if configured correctly) beats everything.

I won’t disagree with that, it certainly seems to be the most secure OS available for modern smartphones.

My points were purely refuting the commenter I responded to’s weird obsession with “Apple = Bad and Insecure.” We should encourage competition and support efforts to increase security anywhere they occur. Brand tribalism doesn’t help anyone.

Do you have an example of a device priced at $300 with competitive hardware to the base iPhone 14, without bloatware subsidizing the cost of the device?

Ulefone Armor 21 😉

Perhaps is even better.

How long will that device get major updates? How about security updates? If I break the screen, how long does it take to get another one? What if liquid penetrates the device? Can I take it to a service center? If the service center doesn’t have the parts, will they give me a loaner device while mine is being repaired off-site? Can the off-site repair be done in under a week? How long is the warranty? Can I pay to extend it? What if I lose the device? Is there insurance for that?

That’s if we pretend for a moment that the MediaTek G99 isn’t a quarter of the speed of the A15.

Apple processors outperform flagship android phones on benchmarks every generation. Where are you getting your information?

Sadly it’s tribalism. It’s “apple = bad” so anything mentioned about apple isn’t looked at logically but rather with an “us vs them” mentality. It’s common across the spectrum of thinking critically nowadays, but I felt I had to refute all points because it’s dumb and doesn’t help anyone.

More security is good. Hating on apple because they are convinced that it’s an overpriced conspiracy is stupid. Every tech company deserves some hate, Apple included, but making that your identity instead of thinking critical does nothing to advance the work being done.

I think this is correct response not just in case of morality, but in case of technology. How can you guaranty privacy of a call if the recipient is from UK?

iMessage isn’t a big loss in the UK. FaceTime would be.

WhatsApp pulling out of the UK would have the biggest impact. Almost everyone uses it here.

Can confirm, it had swipe to reply for a while now, it’s coming to iMessage in next iOS… The only thing that annoys me about WhatsApp is the high picture compression resulting in low quality images.

If you need to send uncompressed images send it as a "document" rather than an image. You won't get the preview but it'll be the same file as on your phone.

WhatsApp also uses E2EE, wouldn’t also be targeted under this same legislation?

Meta pulling WhatsApp out of the UK would affect way more people.

There’s legitimate criticism to be made for Apple, but this is something I really appreciate about them.

Walled garden aside, I think they do care about privacy and security.

It's their brand. And I'm glad it is. It's something Samsung can't copy (I presume because of the Google backbone) or attack.

(Written on a Samsung phone btw.)

Edit. I should probably add why it's good even when I'm not in their ecosystem. It raises the bar for competition and shows that privacy adds value.

I don’t know if they actually care, but I think they figured privacy was a great niche to jump in when they started losing more and more market share to android

It's a brilliant move for Apple because Google can't play that game.

Google is fundamentally an advertising company. They materially benefit from user data in providing a more valuable service to advertisers. If Google takes a strong stance on privacy, it could disadvantage the primary business.

Yup. They have had issues (think CSAM scandal), but they’re slowly earning back my trust. I’m still a bit wary, but for big tech they have a pretty good track record.

They have had issues (think CSAM scandal)

People like you that think that was a "scandal" are half the problem though.

What they were doing with the on-device CSAM scanning as part of the upload to iCloud only was actually good for your privacy. It enabled them to comply with any current and future CSAM laws while protecting your privacy by doing the scanning on your device. It meant that they could then add E2E encryption to iCloud (and then iMessage as well) while still complying with CSAM laws. The alternative - and what everyone else does including google, microsoft, imgur, dropbox, etc - is doing the CSAM scanning in the cloud after you've uploaded it completely insecurely, requiring the data to be stored unencrypted and visible to those companies (and the government).

Doing it on device should have been applauded, but it was attacked by people that didn't understand how it's actually better for them. There was so much misinformation thrown around - that it would scan all of your photos and files as soon as they were created and then instantly report to the police if you took a photo of your infant in the bath, for example, or that it would be used by governments to identify people who have memes saved that they don't like, which is absurd because that's not how the CSAM databases work.

Apples proposed CSAM scanning was literally the best for privacy in the entire industry, and people created such an outrage over it that they basically went "oh well, we'll just do what everyone else is doing which is far more insecure and worse for privacy" and everyone congratulated themselves lol

You make a good point. I guess the outrage was more about scanning at all, though I suppose that’s not on Apple.

The incumbent government is circling the drain and are, it seems, determined to leave a trail of destruction and burned bridges for their successors to repair.

That is how conservative parties work, yes.

In the UK, even conservatives hate the conservatives. It's quite impressive, really.

Then they can point how useless the government is and get back in power

No offence but isn't a very similar policy about banning end-to-end encryption also in talk in the EU

Absolutely don't agree with it, will be the beginning of the end for privacy but this is more of a European wide (and even world wide) push for a close to e2e encryption

GDPR is basically encrypt your shit and you'll be fine. If they are seriously considering banning encryption the IT sector might as well shut up shop and run for the hills.

It's so bad the UK politicians actually use non MDM unmanaged devices so they can install whichever app they see fit. Tiktok you name it.

We won a physical war via encryption and we'll lose a digital one without it.

I do seem to recall that some countries petitioned a weakening of e2ee. Some other countries through were firmly against it, so it seems it has lead to nowhere. For sure something to be aware of.

There are a lot of things to hate about Apple, but this I can get behind. Get people using 3rd party messaging apps too! Preferably ones with e2e encryption.

Plenty of people in the UK/Europe use third party apps already, iMessage is certainly less of a big deal than it is in the US.

Don't forget canada. So many people here use imessage or whatsapp

For sure. I live in Asia, and the Green vs Blue bubble thing that probably only exists in the US is just so mind boggling to me.

I live in germany and I don't know a single person that uses SMS or iMessage. Almost everyone here uses WhatsApp.

WhatsApp isn't much better. It's owned by Meta afterall!

God damn bullshit always "for children and terrorists"

I hate how people turn a blind eye to these things nowadays. They're willing to give away their personal lives at the expense of the shittiest excuses out there. Privacy should be a necessity, ffs.

Why don't they just actually give their actual reason: to spy on UK citizens.

To use children and criminals as a scapegoat for this attrocity is disgusting.

"protect the public from criminals, child sex abusers and terrorists"

Aren't two of those just subsets of the first one?

What a curious pair of emotionally manipulative examples to choose, when it adds absolutely no extra meaning to the Home Office's statement.

i would assume they mean 'criminals, especially...', but classic tHiNk oF tHe ChiLdReN argument

Signal and WhatsApp have also said they'd likely leave the UK market if this bill is passed as it currently is.

Signal should still work there if people want to use it, and they don't block it with a Great British Firewall.

It's not so much a matter of whether the service would work or not but whether the corporate directors would be exposed to criminal liability for continuing to provide such services without OFCOM being able to "understand" the encrypted messages: see 99(4) of the Bill

https://bills.parliament.uk/bills/3137

I once had a conversation under NDA (which has expired since) with an engineer at Apple who was working on iCloud infrastructure, and he was telling me that his team was a bit shocked to read that Dropbox was releasing apps for photos at the time “because they’ve noticed that most of the files users are uploading to Dropbox are photos”. He was like: how do they know that exactly? His team had no idea and couldn’t possibly find out if the encrypted files they were storing were photos, sounds, videos, texts, whatever. That’s what encryption is for, only the client side (the devices) is supposed to know what’s up.

Not having that information meant a direct loss of business insights and value for Apple, since Dropbox had it and leveraged it. But it turns out Apple doesn’t joke around about security/privacy.

What?

https://support.apple.com/en-us/HT202303

Under Standard Data Protection photos, general drive storage and device back up are not end-to-end encrypted. Meaning that Apple has full access to reading and analyzing them.

Under Advanced Data Protection which is an opt-in feature available since iOS 16.2, you can have those files end-to-end encrypted.

End-to-end encryption makes the user responsible for keeping an encryption key safe, irreversibly losing their data if they lose the key. It's not practical for the general population. I would guess its use is in low single digit percent of apple customers.

And this feature came out in December 2022. A bit over half a year ago. Unless your friend's NDA was super short, I presume the conversation took place before it was released. Either your friend was bullshitting you under an NDA or he's an idiot.

Advanced Data Protection has a social recovery option that does not require end users maintaining a security key. It’s far more accessible to average users than one might think, though perhaps still a bit intimidating.

Really? That’s interesting what’s a “social recovery” option?

You can select up to five contacts that also have an iPhone to help you get back into your account if you get locked out (ex. losing your phone and getting a new one)

Could be the engineer didn't have permission to see file details. They could still be readable by higher-ups, but not to the general engineer. This is how it should work, if e2ee is not used. If Dropbox allowed everyone who worked on their server to read files... that's a huge invasion of privacy.

Makes no sense though. As if the engineer is the one deciding which apps are built. He's just saying things he thinks he sees.

Oh that’s interesting!

Yeah, that conversation is much, much older, pretty close to the very start of iCloud file storage. I’m guessing either things changed since and they used to be end-to-end encrypted, or more likely, what the friend was complaining about is his iCloud infrastructure team didn’t have access to the keys stored by another team, and reverse. So basically, Apple could technically decrypt those files, but they don’t by policy, enforced by org-chart-driven security.

Now excuse me while I go change a setting in my iCloud account… 😳

Really proves that Apple users believe Apple is perfect and they are protected, even when there's official documentation stating otherwise. It's baffling how many Apple users think they are fully anonymous and protected and not tracked. Apple is brainwashing you well.

I’m an apple user. I don’t think these things. I have a plethora of apple devices. I also have a few chromebooks, a high-end desktop I built for gaming and developing.

We as people really need to stop generalizing and insulting {X group of people who are not me}. I mean, you don’t like apple. That’s totally fine! Use whatever pleases you. That doesn’t bother me at all. But stop calling me brainwashed for enjoying an ecosystem that makes my life and day-to-day easier and more enjoyable.

People like to think of themselves as superior to the other group. But we are all individuals with our own preferences and life experiences. I had a google g1. I’ve had multiple android phones. Admittedly, they were all during android’s Wild West days where I barely got any major os updates and half of them failed within a year.

What I’m saying (and I know this is a reply to you, but this has been frustrating me with a LOT of things, not just “Apple users”) is that we should try to put things in perspective before insulting an entire group of people that we don’t even know. That’s my two cents.

I don't know anything about this, but the files may be encrypted blobs, but if they are mapped to the original filenames (as is the case with Dropbox) with suffix like jpg, etc, they could assume the type without decoding the file. Not saying there's no difference between Dropbox and Apple, but I'm not sure people expected filenames to be encrypted back in the day (if even now).

Yeah, to be clear, what the friend was saying that day is that they don’t even have access to file names. For them it’s 100% mangled data.

I would definitely consider file names to be personal information, that I would expect to be encrypted. If I store a file named “Letter to IRS for 2020 violation.doc”, then suddenly you know something about me that I probably don’t want you to know.

Don't you know anything, Brits? Apple only strips security features for the Chinese government, you fools!

Haha yeah too right. UK government isn't authoritarian enough for apple to listen to

I mean, they didn't cave to Russia either. Apple just has principles until there's enough cash on the table. Then they claim to "always abide by local laws" wherever they operate.

Yeah you are right there, just being too smart mouthed I guess

Nah you were appropriately smart mouthed. The problem was my clumsy post intro.

it has more to do with where their factories are located. Hard to negotiate with the people who control the very land and people you utilize to build your hardware

Not saying that justifies it, just think we should be accurate with our outrage

They could have factories in China and not sell phones there. There are also other places to build factories. They just might have to trim back their 42% profit margin. It's still a willingness to abandon principles for a price, isn't it?

I think it's more that they know they don't have any negotiating power in China. China doesn't care if they have iMessage, but the UK and the british people do.

Yeah I agree that the CCP have more leverage due to the factories, aa well as the larger user base.

Just like to point out apple aren't some altruistic organisation, they are a corporation out to make money, and that the CCP suck.

Also, I profoundly disagree with the legislation this thread was originally about.

Oh, they are authoritarian enough. They just aren't powerful enough.

Want to know what it looks like to go power crazy with no power, then go look at the Tories.

It's this publicly known, or just assumed because China blocks everything they can't read?

I assume that Apple gives the Chinese government access somehow, but I've never read details.

Apple proactively aids in censorship and stores all customer data, including encryption keys, on servers controlled by the Chinese government. They've also excluded security features from China and crippled existing features to aid government repression.

Thanks for the links. Unfortunately, that NYT article does not make a single mention of iMessage or end-to-end encryption.

Last I checked, iMessage still works in China. I find it implausible that China would allow this without access. If there's a mechanism for that, I'd like to know what it is and how far it extends. The fact that Apple doesn't admit that there's a difference in iMessage's security in China makes me wonder whether it is compromised globally.

I don't think there's any evidence of a global compromise but I think you're right that China wouldn't allow access if it didn't ultimately control it.

I couldn't find anything specific about iMessage but the keys are backed up to iCloud -- and we know that's compromised. I can't imagine them leaving users the option to just not back up to iCloud to avoid surveillance, but I haven't seen any specifics. Best to assume that under no circumstances do you ever have privacy from the gov't in China or even when messaging someone in China.

The one good thing I can say about apple is that they at least push back against this kind of bullshit, even if they only do so for marketing.

The other side is that they'll also push back against good stuff for the consumer since everything they do is completely out of self interest.

Your gonna have to back up that sort of statement. I'm not an apple fanboy, but I take security and privacy seriously, and they seem to really be on the consumers side in that regard. Please inform me how they push back against "good stuff" for the consumer

Oh I don't know, starting or popularising the trend of gluing the phone together, removing the 3.5mm jack, not adopting the standardised method for post-sms communication (rcs vs imessage) to name a few.

They are going to answer with some stupid reasoning like removing the 3.5mm jack.

But truly Apple stance on right-to-repair really is their only non-defendable stance. And this is coming from an Apple fanboy.

3.5mm jack >> Bluetooth

Not objectively

Yes, objectively.

Don’t think you understand what objectively means.

I do, unlike certain someone drinking Apple's kool aid and defending corporate bullshit.

I’m not defending anything, other than basic usage of the English language. I’m not saying Bluetooth is better, objectively or subjectively, than a wired connection. You’re free to prefer one over the other, but any preference is just that, a preference.

This is the way.

Please no redditisms or else I will literally die of cringe o( ❛ᴗ❛ )o

This is more like internet culture tho?

I know I just find it to be such a manufactured corporate tagline that exists to be used in this way and it rubs me the wrong way

I can see what you mean, though I still find it just harmless humor

No fair enough it just rubs me the wrong way haha

2 more...
2 more...

19.7 million UK iPhone users will care about this.

Not in the UK.

Feel free to insert the equally stupidly large number of iPhone users for your particular geographic location.

5 more...
5 more...

Gatekeeping, another redditism. Perhaps you belong there after all?

Damnit I agree with both comments but I think the first part of your comment is the most lemmish

So, do I have to behave the way you like to be here? That's nonsense.

My tenets are:

  1. no one will post on lemmy.world without getting prior approval from me
  2. At a minimum every second comment should end in some sort of praise of me
  3. No posting on Thursdays
  4. You accidentally posted something I didn't like? Tough shit your wife and family are now hostage

Please take care of my wife and kids. And don't feed them after midnight

1 more...
9 more...
9 more...

Those proposals will never be made law and acted upon.

It's infeasible nonsense to pander to the Daily Mail reading curtain-twitchers. They've had 13 years to try and do this. If they wanted to (and indeed if it was in any way possible), they'd have done it already.

It'll be just "Vote for us and we'll make your children safe from nonces and muzzies!" until the end of time.

6 more...

I'll be damned if we'll have to thank the UK for getting RCS normalized.

This has nothing to do with RCS from what I read on the article. It looks like the UK wants to be able to tell companies to disable security features such as End to End Encryption so that they can view the messages.

Isn't WhatsApp super popular in the EU as a whole? Like to the point where EVERYONE uses it? What does the UK have to say about that? It's apparently E2EE, right?

Curious why WhatsApp isn't in trouble.

It is, they've made similar threats if this law goes though.

2 more...
2 more...

That would be better than iMessage or Whatsapp, but even better if we all moved to Simplex, or other secure and private messaging app.

rcs is not e2e encrypted afaik

Not necessarily. Google has implemented E2EE in their implementation, but it only works if both parties are using Google Messages. It's not a standard part of the spec.

I too could manually encrypt data and send it via regular old sms. That would require the other party to know of and make use of extra tools to be able to read and reply. If not, then they might not be able to read the message, or worse, reply in plaintext. That's what google is doing with rcs. Rcs is not encrypted. the google app encrypts the data and sends it "unencrypted" over rcs. From rcs' point of view it looks like "this user is trying to send random junk.... who am I to judge?"

2 more...

Why don't politicians just fuck off?

Nothing they ever do about anything leads to an improvement.

I agreed that they should definitely fuck off, but this will be pushed y the security services. A change of government won’t change the drive for this sort of bollocks.

“Oh but what about the criminals, terrorists and pedos?”

What about all the people that aren’t that who loose their privacy?

The criminals, terrorists and pedos won't by affected. They will just switch to non weakened encryption.

It's always been about mass surveillance.

I mean, I hate politicians too but they did give us organizations like OSHA that protect us at work. Not all politicians are pieces of shit…but certainly MOST are.

“politicians never do anything good” is a myopic viewpoint that is completely understandable in the modern political climate, i think. which is unfortunate, because a political party that learned to harness that energy to actually become known for doing good could probably grow very quickly

They exist. They just get hamstrung by opposition and the general public's lazy attitude of "everyone sucks" vs actually learning about their available choices.

Obvious counter-examples are abundant. I choose the global eradication of smallpox.

That sounds like typical bOtH sIdEs bullshit.

Why can't the UK govt simply rent their spyware from Israel, like everyone else?

They had a different response to China though. Telling.

Is it? Everyone knows how authoritarian China is. Apple cannot show China as being hypocritical, because they are consistently against privacy...Britain on the other hand: talks one way, and then acts another.

I can't believe I'm saying this but...good guy Apple?

Until they buckle and give information to law enforcement again, or that one no fap apocalypse incident with iCloud photos and celebs.

They should just publicly publish all the messages from politicians' accounts.

If they want to see our messages we should be able to see theirs, fair is fair.

The politicians barely even use e2e they use tiktok and all sorts of apps. If they do backdoor e2e it'll be hacked just wait. Matter of time.

What about other tech companies like Microsoft or Google? Do they comply?

Every company. Everything. Including Signal.

Can you elaborate on signal? They have a open source codebase without any back door?!

Yes you're correct. Signal would have to be forced to make a back door for the UK gov under this proposal. This is why they, with several others, are threatening to stop providing services in the UK should this pass.

As a UK citizen, I totally support this. The more that the average voter is disconvenienced because of proposed law changes like this and the (unenforcable) anti-porn laws, the more likely they are to actually pressure their MP or change how they vote.

Apple would have to refactor their tools and potentially introduce security issues for everyone by doing this. If the UK government wants to be fucking dumb, it shouldn’t be something everyone has to pay the price for.

Apple is correct. If they compromise their apps here, then other countries will follow suit and their reputation as a brand will take a massive hit. A big part of Apple's appeal is their security, this is the best financial decision.

Huh, for once I am siding with Apple. Weird feeling.

And they will come up with other ways to steal user's data, so they could sell it or distinguish user behavior to develop new product.

It's a strange world when Disney and Apple are actually doing the right thing.

People are really quick to give these massive companies credit. Don't be fooled, they aren't doing the right thing for humans or to be good, they're doing the "right thing" to keep their cash cow running.

Same with Disney.

What are the UK proposals?

Backdoor into e2e. So they want to put your shit in hackers hands and the govs. Cunts.

Yeah yeah. We all know you're too greedy for that Apple. Cut the talk and actually do it if you give a shit about encryption.

Why would they pull out of the UK if the laws are only proposals at this point? That's silly

Considering the title and the entire article is in the future tense I'm going out on a limb here and stating that Apple has not yet pulled those products from the UK market.

Greedy ? They’re both free products?

If you're talking about FaceTime and iMessage... They might technically not cost any money, but if I wanted to use them I'd first have to pay for an overpriced badly designed phone, which means they're debatably free. They're used to enrich the iPhone- just look at the whole blue/green text bubble thing. 'If you don't also have an iPhone you get treated differently' hardly sounds like something a totally 'free' software would include. It just feeds into their 'exclusivity' bubble.

Aren’t they the ones that made every website have a cookie notification? So stupid

Apple should remove FaceTime and iMessage from North America, so kids stop getting bullied for green texts, despite having a superior phone.

But seriously, why is the kid with a $200 iPhone 5 with a cracked to shit screen laughing at the kid with a $1200 Android phone with features Apple will "invent" 10 years later? All over a green bubble?

Although, it was pretty nice to be able to see which people are lowlife losers on Tinder back in my dating days. They made it very clear how shitty they were when they bashed me for my green bubbles. Saved me a ton of time!

Although, it was pretty nice to be able to see which people are lowlife losers on Tinder back in my dating days. They made it very clear how shitty they were when they bashed me for my green bubbles. Saved me a ton of time!

jesus, who hurt you?