No backdoors needed: Apple ditched plans to fully encrypt iCloud backups after heavy pressure from FBI – claim Apple ditched plans to fully encrypt its iCloud backups two years ago after being pressured by the FBI, it is claimed. The decision reportedly came after the iPhone giant notified the Feds that it intended to offer users end-to-end encryption for photos, messages, and other data stored on iCloud. Under this plan, Apple would …
>He complains about encryption? He's giving them the bloody guns!
But they have to carry guns to protect themselves from a tyrannical government and protect themselves against unconstitutional warrant-less searches.
If there weren't unconstitutional warrant-less searches by a tyrannical government it would be stupid to have all those guns.
I am 100% having the phone records of those who do the most damage to the population exposed.
Not terrorists or whatever. The politicians! Even a dedicated mass murderer struggles to kill more than a hundred or two people--a politician declares a military action in some backwards country and thousands of soldiers die, nevermind the non-citizen casualties.
Apple's whole campaign has been centered around how your private information on your private device is encrypted. I think this is probably about the most they can get away with, without attracting serious heat. It's easy for law enforcement to get at iCloud data, and most criminals who aren't masterminding some crazy scheme are probably not looking at every single scrap of data being sent to Apple's services. iOS and the built in apps make the phone pretty useless to use without access to iCloud. With that in mind, that should probably be enough to keep the pretense of total privacy up while keeping the FBI and friends happy they can at least catch the dumb criminals.
It's an interesting privacy question -- no one 200+ years ago could have dreamed of someone owning a device with other-worldly capabilities capable of storing the most sensitive personal data...and carrying that with them 24/7. Police have always had access to phone records and such, but the ability to have a completely encrypted, theoretically unbreakable copy of evidence on your person, and not have to give it up on demand, is new. What's the analog...a notepad written in code backed by a one-time pad that someone else has?
No, the analog is papers in a safe that are rigged to burn when opened without disarming the trap.
Or, given that everything moved slower in Ye Olden Days, the expedient of throwing the papers in the fire when you see the plod coming. Tactical response teams were not a thing in the timeframes mentioned.
It's only in the 20th century that somewhere we decided there was such a thing as the ability to get at all evidence in readable form, and that itself was preying on people's lack of understanding of how technology worked. Just like today, sadly -- how many people thought those backups were safe from Apple's prying eyes, for instance?
Icon for the current status of civil rights and privacy.
iOS and the built in apps make the phone pretty useless to use without access to iCloud.
I disagree. There are non-iCloud ways to sync things like docs, contacts, and photos -- many of which have the added benefit of being cross-platform.
That said -- the popular alternatives (Google, Microsoft, Amazon, DropBox, Box, MediaFire, etc.) don't offer zero-knowledge end-to-end encryption either. Presumably, the Feds have equal access to user files stored on those services.
If you want secure online back up, you either have to add it yourself using an additional later such as Boxcryptor, or use one of the rare services with private key support such as Sync (and hope that the provider didn't fuck up the crypto).
I was surprised to hear on BBC Radio 4 this morning a short interview with Yuval Noah Harari
(never previously heard of him) (home page https://www.ynharari.com/) (I think he's in Davos today)
His opinion seemed to be that we could potentially see a totalitarian data-driven hegemony, based upon a state (or two) knowing everything about everyone, and possibly knowing us more than we know ourselves. He didn't name names or States, other than China, but he implied there was of course at least one other unitedly serious place where bad things could grow.....
As I have been tangentially involved in data-retention, ILETS, and Lawful Interception, and know their names, nice chaps on the whole. Yes Yuval, that gloomy-doomy scenario came to me too.
we could potentially see a totalitarian data-driven hegemony
Could?
Perhaps Bruce Sterling really did have a glimpse of the future.
Perhaps the intention post-Brexit is for the UK to become a Datahaven...
I have long suspected this was why Apple never made the move to allow user designated keys for iCloud backups, but I'm still disappointed to have confirmation.
Fortunately iTunes backups which do offer this are almost as good - they aren't as reliable as iCloud since it isn't "always on" and you have to backup the backup occasionally in case the drive in your computer dies.
What's the analog...a notepad written in code backed by a one-time pad that someone else has?
No, the analog is a notepad written in code that only YOU know, not someone else. If the police have a bad law (like in the UK) or are willing to get out the rubber hose, it would be no different than them being able to force you to give up your phone's password.
Now that is a valid concern, as well as an acceptable reason to not implement total encryption. The Helldesk is hard enough as it is, and the idiots who lock themselves out of their pics would likely be the first to blame Apple for it.
That said, it's obvious that authorities are back to the "think of the children" angle. They must have a rotating wheel with Terrorist, Pedophile, Mass Murderer and Evil Thug, and at the beginning of the month they spin it to know what angle to use on the public. This month we've been getting Pedophile, last month was, I think, Terrorist.
Anything to keep them awash in private data without a warrant.
So you it not the default. Everyone using iTunes for backup and setting a password has the same potential for being locked out. I'd gladly accept this as the price for being able to use the more convenient iCloud for device backup, but until it is encrypted as well as iTunes backups I'll keep using those.
I mean, if being locked out of your backup is a concern, why not have a concern for locking yourself out of your phone. If you forget your password/passcode, you are just as locked out. Whether companies like Cellebrite can possibly unlock it for you using exploits Apple hasn't patched yet is irrelevant to the average user who isn't going to hire some company thousands of dollars to unlock his phone for him.
If/when the Senate decide to subpoena witnesses' texts and emails they might find some interesting leads...(?)
Ho hum!
Let's suppose that you just don't use iCloud backups. You think you are safe from three letters agencies. But If such agencies want your data, they can probably just ask Apple to trigger a single backup from remote, and they will have your data. Can you be sure that your phone will not be remote controlled at all? I don't think so. If you are a criminal, or if you are serious about privacy, do not use a phone. Any phone. Real privacy has been lost forever. Even ordinary cell phones from the nineties could be used to track your location. The only non-tracking remote paging device was the old Motorola pager (at least in Italy) which could be used to track you only in very big macro-areas (north, center, south of Italy).
"The only non-tracking remote paging device was the old Motorola pager (at least in Italy) which could be used to track you only in very big macro-areas (north, center, south of Italy)."
The British BT pagers were, AFAIR, untrackable as they were one way devices, oly being receivers.
There's no evidence that Apple has the ability to force a phone to make an iCloud backup.
You can peddle conspiracy theories all you want, but why not just go all-in on conspiracy theories and claim that Apple can remotely unlock a phone, and all this kerfuffle about the FBI not being able to access these phones is just noise hoping to make criminals complacent?
I'm no criminal mastermind but couldn't you just, I don't know, encrypt your stuff before you actually upload it to the eye clouds?
Shirley there would be no way for plod to access the info.
Maybe I'm missing the point because I'm not a mastermind.
No doubt other commentards will see me right.
Must go back to Uni and get my quals updated.
Encrypting your stuff, either with a downloadable app or with something you wrote and have somehow gotten accepted into the app store without being modified in any way?
If it runs on a phone, it is subject to any shenanigans the manufacturer, with or without pressure from Law Enforcement (or criminal gangs) decides to pull. No exceptions. As Clive Robinson (Prolific and _sane_ commenter on Bruce Schneier's blog) often says: "The encryption endpoint must be outside the communication endpoint". That is, if you are holding on to the idea that a device that has unfettered access to everything you read or write, and a variety of communication capabilities, is _unable_ to just send the cleartext wherever... You're holding it wrong.
Of course, if your carrier has disabled USB/WiFi/Bluetooth access to the phone's data connection, as several have, (or the "secure device" has internet access on its own), you're just doomed.
>Encrypting your stuff, either with a downloadable app or with something you wrote and have somehow gotten accepted into the app store without being modified in any way?
Needs to go beyond this.
Remember it is highly unlikely that it will be able to intercept the iOS system calls etc, so effectively you need to roll your own app's for phone, contacts etc.
And assign trust on a sliding scale on that basis. Least trustworthy is opaque encryption provided by someone else.
Middle ground is something like OpenPGP.
Weakening vendors encryption will be an own goal for the FiveEyes, as it will push more people to self-encrypt.
By the way, part of the fear of secure encryption isn't just not being able to get into a suspects devices. It's not being able to get into a suspects devices unseen. Uncle Sam would much rather have a crafty look at your cloud backups without your knowing than have to serve you with a warrant to get the keys off you. Which might tip someone off (and force them to actually have a reason).
No, neither would I. Even if I DID have a PhD in encryption. Hence the sliding scale, and gauging the risk of unauthorised decryption.
The thing is, if you really do want to keep something secret, then you need to be a bit belt and braces about it. Not only do you perform your own encryption, but you also make sure that what you are encrypting is in itself not immediately obvious. Steganography being one idea. Also the old school spy codes still have their uses ...
The paradigm of "good" encryption will be the words "The snow in Moscow is coldest in January" buried into the background of a cute puppy pic which in turn has been run through OpenPGP at maximum entropy (4096 or higher) and then dumped on AppleCloud. Or indeed wherever.
Extra sneaky points if the plaintext is actually a photograph of something handwritten in Arabic to start with.
OpenPGP is not middle ground. Unless you are a literal tin-foil hatter. (https://www.youtube.com/watch?v=urglg3WimHA) OpenPGP is the sort of project almost custom-made for the open source movement. LOTS of attention from good crypto people & top-notch programmers from many (non-cooperating) jurisdictions.
For OpenPGP, it is the end user which is the weakest link. Always.
I am in fact really glad that governments do not "get" encryption. I would far prefer that they keep calling for impossible solutions than they get someone on their side who really knows the technology and might come up with a practical law that really would damage our ability to keep our data private.
Why would Apple need a special iCloud they don't have access to? There's no clause in the GDPR requiring companies to store data in a way they themselves cannot access.
And unless I'm mistaken, surely there are clauses in the law allowing the authorities access to it with a lawful court order. Surely you don't believe the GDPR means that all your private data is encrypted so that only you can access it??
There's no clause in the GDPR requiring companies to store data in a way they themselves cannot access.
Huh ?
The reverse is also true. There is also no law requiring companies to store data in a way they can access ?
In fact (and this is where there may be danger ahead) the law is silent on whether companies hosting data need to be able to access it in plaintext form or not.
If the Feds were really savvy (the fact I am writing this, not them, suggests they aren't) then they would lobby for congress/EU/whoever to pass a law requiring all companies that host data to ensure they can access it in plaintext for when the feds come knocking. Dump the whole problem onto the industry and let them sort it out.
if you want secure backups that cannot be accessed, backup to iTunes locally.
If you want the convenience of cloud backups, you take the risk that it can be accessed by law enforcement.
At least the options are clear and it is easy to make a choice as to which one you want to use.
This post has been deleted by its author
The real problem for society in general is not about how secure we can make backups and E2E privacy, such that law enforcement cannot access it.
The elephant in the room is why "the people" no longer trust "the authorities".
Yes, I really would personally rather prefer if I had faith my companies' confidential data and research were not being read by a (foreign) competitor.
Having chosen to operate in a particular jurisdiction however, I would be happy if said jurisdiction had access, ONLY if I trusted they operated in a transparent and legal manner, with proper oversight. Leaks IMHO such as Ed Snowden's and others should have been seen as a call to operate differently. Instead, authorities went on the defensive.
I ought to be able to tell if my data was accessed. It ought to be traceable where it went.
Until whenever, there is market space for data-havens, and their associated problems for Privacy, Crime, Business, Law and Revenue.
Real democracy and Political Reform is sorely needed. Government needs to tell the truth, and people need to believe them.
Many in the UK have never read the Gettysburg Address. It is very well worth reading.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
