upvote

points

by isodev8 hours ago |
comments
upvoteby comboy8 hours ago|
next
[-]
The point is that they don't have to pinky promise. It's as if you said yubikey pinky promises it won't share your private key.

I think it's actually a very good approach. Obviously depends on actual implementation details, but the premise is good.

reply
upvoteby chirau8 hours ago|
parent|
next
[-]
So what was the furore about when that Ring/Amazon superbowl ad happened. They have to promise and they should be able to be held liable if that promise is not kept.
reply
upvoteby isodev7 hours ago|
parent|
prev|
next
[-]
> Obviously depends on actual implementation details

So Apple can ship whatever update they want, doing whatever with no oversight or independent review. No thanks - you folks are forgetting the US a surveillance state.

A device with no physical switch for it's microphone and cameras worries me and it's just not worth whatever minor convenience this adds.

reply
upvoteby merely-unlikely6 hours ago|
parent|
[-]
> you folks are forgetting the US a surveillance state

This is exactly why Apple emphasizes they lack the ability (keys) to decrypt your data stored on iCloud or in transit. US courts will demand it, and this way Apple can say it literally is unable to comply no matter what the court orders. You can certainly choose not to believe them, but at least they are making the legal argument in actual court cases. I don’t see the other big tech companies doing that.

reply
upvoteby grishka8 hours ago|
parent|
prev|
[-]
Except if a device has a microphone and a network interface, it has the technical capability of sharing those recordings. The only realistic way to guarantee this sort of thing is to reverse engineer the entire chain between the two and then never install any software updates.
reply
upvoteby comboy6 hours ago|
parent|
[-]
Secure Enclave is not a new concept.

> The only realistic way to guarantee this sort of thing is to reverse engineer the entire chain between the two and then never install any software updates.

Reverse engineer the hardware and not change it, that's the whole point, it's not in the software, only queries after the keyword are passed forward (if I'm understanding correctly, gee I don't even like apple much, things I choose to spend my time on..)

reply
upvoteby 4fterd4rk8 hours ago|
prev|
[-]
Conspiracy theories are easy. Now go prove that Apple is lying. They have so much to lose it makes no sense for them to lie.
reply
upvoteby ruszki7 hours ago|
parent|
next
[-]
I think the burden of the proof should be on Apple's side first.
reply
upvoteby dd8601fn4 hours ago|
parent|
next
[-]
They have been. Through years of use, independent auditing, industry and government certification processes, and their Apple Security Research program.
reply
upvoteby fckgw7 hours ago|
parent|
prev|
next
[-]
They've published several whitepapers and technical documentation on how the secure enclave works and it's been poked at by security researchers for years.
reply
upvoteby newspaper16 hours ago|
parent|
[-]
If it's not open source (with open hardware), you cannot trust it. Whitepapers are great, but who knows what's actually implemented.
reply
upvoteby selectodude7 hours ago|
parent|
prev|
[-]
Apple can’t prove a negative. You have to prove they’re lying.
reply
upvoteby ruszki6 hours ago|
parent|
next
[-]
You can. They do all the time in math and programming.
reply
upvoteby newspaper17 hours ago|
parent|
prev|
[-]
You don't have to prove anything. You need to asses your risk profile and decide if you want to expose yourself to Apple or not.
reply
upvoteby ethbr17 hours ago|
parent|
prev|
next
[-]
The rub with a locked-in, incompatible platform is that a company must not only not be lying now... but into the future.

Anyone who thinks Apple is going to fight for their users if their revenue slips targets and stock tanks is an idiot.

Money talks.

reply
upvoteby dd8601fn4 hours ago|
parent|
[-]
“100% Guaranteed safe and properly managed forever” has never, and will never exist, for anything connected to the world.

Least of all with home rolled solutions. Contrary to popular belief.

reply
upvoteby runjake7 hours ago|
parent|
prev|
next
[-]
1. Try to obtain an Apple Security Research Device (SRD)[1] or a jailbroken iPhone.

2. Set up TLS MITM between the device and the Internet. Install the cert on the device.

3. On the device, disable certificate pinning for Apple's apps.

4. Use the device normally, observe all the telemetry flowing to Apple.

You might be a little shocked at the amount of... personal and usage details sent to Apple FQDNs.

Remember: Privacy is a feature of the Apple Marketing dept -- not SWE!

  1. https://security.apple.com/research-device/
reply
upvoteby mmmlinux6 hours ago|
parent|
next
[-]
Do you have any more info. Or are you just going to hand wave away all the actual details, suggesting we do the research our self.
reply
upvoteby danudey6 hours ago|
parent|
prev|
[-]
Let's please dispense with the "trust me bro" paranoia takes. Link to something that demonstrates your point or you're just making baseless accusations that discourage people from trusting actual privacy and security research.
reply
upvoteby newspaper16 hours ago|
parent|
[-]
You can call Apple support and they can remotely take control of your entire phone. They have access to everything if they want it.
reply
upvoteby Bud5 hours ago|
parent|
[-]
[dead]
reply