Hacker News new | ask | show | jobs
by smoldesu 1096 days ago
Note - privacy not guaranteed if Apple is subpoenaed for information: https://www.apple.com/legal/transparency/us.html

In this case, Apple may be compelled to turn over device, account or financial data. So don't do anything bad* and lose your privacy privileges!

*Definition of 'bad' subject to local law and interpretation.
2 comments
kaba0 1096 days ago
While Apple surely has plenty metadata on users, many of your data is actually e2e encrypted.
link
trympet 1096 days ago
I am willing to bet my left nut that they don't encrypt common metadata and telemetry at rest.
link
kaba0 1096 days ago
Why wouldn’t they? They can analyze it as much as they want even if it’s encrypted (by them), while not doing so would just open them up to to the legal ramifications of data leaks.

So, I would reserve my nuts for better bets.

link
trympet 1095 days ago
> not doing so would just open them up to to the legal ramifications of data leaks.

They can already protect themselves by using pseudonymous IDs, and by not storing SSN and full names on the same system/network as your browsing history.

I'm struggling to come up with a general example where an adversary would be prevented from accessing the data if they had already compromized the network, so to me, it's just obfuscation with extra steps. Maybe if an adversary, by some miracle, had a non-root shell in database server, but somehow did not have read-permission on the crypto store ???

Physical theft of drives is a valid argument, but even that is a weak one. The data center facilities are very secure.

link
kaba0 1095 days ago
Leaks can happen in many ways, like simply by SQL injections, some page displaying data without server side validation/with bugs, etc.
link
trympet 1094 days ago
You are correct. Maybe I'm missing the point, but everything you mentioned is still applicable even when the data is encrypted.
link
smoldesu 1096 days ago
End-to-end encryption doesn't secure anything if you don't control the keys. I'd believe they encrypt the data at rest, but I wouldn't ever dupe myself into believing that makes it safe. So... we're back around to square one. Apple will steamroll over your privacy (along with 10s of thousands of other freedom-loving Americans) without a second thought.

It could be worse, though. If you're a Chinese iCloud user, your data just gets uploaded right into state-owned servers: https://support.apple.com/en-us/HT208351

link
solarkraft 1096 days ago
That's for the data they have, which they generally minimize reasonably well.
link