[microtonal]

As opposed to iOS, which does iCloud backups that are not E2E encrypted by default, so that law enforcement can request your chats (except Signal because they opt out), browser history, etc.?

You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't.

This is not to defend Microsoft, more to say that all these companies were part of PRISM.

[gruez]

>You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't.

That just sounds like a fundamental issue with security in general, not specific to Apple/Microsoft.

[microtonal]

My point is that these defaults that look secure to a non-expert, but do not hold up to scrutiny, are probably intentional.

I have found that even many tech people have incorrect beliefs about these things, like assuming that iCloud Backups are E2E encrypted by default or that disabling Allow Apps to Request to Track disables trackers inside apps.

[vorticalbox]

Not in the UK sadly, ADP is disabled.

[seanieb]

> This is not to defend Microsoft

But you are defending MS, conflating a bunch of things, mainly full disk encryption and cloud backups.

There's a big difference between Apples cloud backup which has documented behavior and a backdoor. I'm also fairly confidant in Apple's full disk encryption, they've gone to court to defend it. There also a lot more data points we can use to judge Apple vs Microsoft on privacy and security, and MS comes out looking bad.

[microtonal]

I think my message wooshed. I was not comparing disk encryption and iCloud backups. My point is that insecure defaults are Apple and other's alternative to backdoors. They give plausible deniability ("how is someone able to recover their data if they lost their credentials and we used E2E?"), while at the same time satisfying law enforcement, because the vast majority of people is not aware of them.

Another example is WhatsApp on Android, by default when backups are enabled, they are stored unencrypted in Google Drive. A good counter-example is Signal, which opts out of backups on iOS and Android and the only option is to do E2E backups to their own servers.

I'm also fairly confidant in Apple's full disk encryption, they've gone to court to defend it.

FWIW, in the last leaked report, iPhone was not an issue AFU for Cellebrite (macOS is most likely even easier due to looser security):

https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju...

[Silhouette]

Signal won't let us download our own data and back it up using our own secure systems. Whatever its other merits it gets 0% for backup policy.

Though I suppose then I have to give a negative % to all the systems that have insecure online backups. This whole area is a train wreck really.

[curiousObject]

> ‘Signal won't let us download our own data and back it up using our own secure systems.

Signal is slowly, very slowly, moving toward providing real backups and cross-device transfers

I understand why you’d believe Signal still can’t deliver that, because they had been ignoring the user demands for years.

But there is real progress now

https://support.signal.org/hc/en-us/articles/9708267671322-S...

[Silhouette]

It's not a matter of belief. Signal does not provide a way for me to download my own messages off my own devices and safely store them using my own secure backup facility.

Obviously Signal don't owe me anything. I'm not paying for the product and I appreciate what it does offer and makes available for free. But it would be much better if it also supported local backups under the user's control.