iCloud was storing cleared browsing histories

Re:iCloud was storing cleared browsing histories by neotek on Friday February 10, 2017 @01:33AM (#13613657)

Sounds like a mistake rather than some nefarious data collection strategy.

Apple doesn't rely on advertising revenue like Google or Facebook so in the past they've been much more likely to avoid collecting data whenever it could get in the way of their self-professed privacy narrative.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by kartickv on Friday February 10, 2017 @03:54AM (#13614137)

Storing data on Apple's cloud services is a privacy risk given their inability to keep it secure. We had the celebrity iCloud hack, caused at least in part by Apple not using 2FA for iCloud logins. And now this privacy failure.

Storing your data on a cloud service that isn't competent is a privacy risk.

And a reliability risk, as I found out last year when my albums on iCloud Photos disappeared. Not the photos themselves, just the albums in which I organised them, but organising data can take a lot of time, and any data loss is unacceptable. They weren't in trash.

Apple's "self-professed privacy narrative" is partly right, but partly marketing, and partly disingenous, as if collecting data has no other purpose than advertising: https://dcurt.is/privacy-vs-user-experience To be clear, I'm not taking a black-and-white view; it's partly right, partly wrong.

BTW, The Verge wasn't clear — was the forensics firm getting data from an iDevice or Mac's local storage, or across the Internet from iCloud servers?

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by izacus on Friday February 10, 2017 @04:32AM (#13614270)

Apples approach to security is nicely summarized by the fact, that you're not allowed to use 2FA for iCloud at all on a Mac if you don't own an iPhone.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by simonh on Friday February 10, 2017 @05:15AM (#13614402)

Both two step authentication and two factor authentication can be set up to use text message or phone call verification to an arbitrary phone number.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by izacus on Friday February 10, 2017 @05:29AM (#13614452)

According to this: https://support.apple.com/en-us/HT204915

a "trusted device" is only an Apple device, phone calls are for backup when you lose them. Even after that it's significant inconvenience in comparison to any other vendor using a standardized OTP approach working with any application that implements the standard. It's one of the little ways how Apple makes not owning an iOS device inconvenient for mac users.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by madeofpalk on Friday February 10, 2017 @06:05AM (#13614560)

It's extremely confusing, but Apple has two types of multple-factor authentication solutions in use.

The 'legacy' (my phrasing, only because it was the first implemented) MFA is SMS-based, and thus has not dependency on iPhones.

There's a newer (about a year or two old by this point) solution which has a 'richer user experience' and depends on having other Macs or iPhones to receive the MFA authentication dialogs.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by glhaynes on Friday February 10, 2017 @05:22PM (#13619440)

The newer solution ("Two-factor authentication") also allows non-Apple phones to receive a code on their "trusted phone number". From the support page linked in a nearby comment:

What if I don’t have access to a trusted device or didn't receive a verification code?

If you're signing in and don’t have a trusted device handy that can display verification codes, you can have a code sent to your trusted phone number via text or a phone call instead. Click Didn't Get a Code on the sign in screen and choose to send a code to your trusted phone number. You can also get a code directly from Settings on a trusted device.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by simonh on Friday February 10, 2017 @05:38AM (#13614486)

I believe Apple prefers that people use a trusted device as from their point of view this is more secure as they can verify the entire communications loop so they view this as a fallback option, but you certainly can use non-Apple devices to authenticate. They also don't appear to throw up any roadblocks to doing so.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by mcintyre1994 on Friday February 10, 2017 @07:04AM (#13614791)

Isn't the fallback only SMS/phone? That seems like a roadblock compared to say Google Authenticator.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by AlphaSite on Friday February 10, 2017 @09:32AM (#13615573)

Actually the new 2FA method they introduced somewhat recently does allow this.

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by blauditore on Friday February 10, 2017 @07:02PM (#13620034)

Also, you're forced to use silly old password reset questions (from a predefined list). I just recently had to do this for my dev account (not Apple user otherwise) and was mildly shocked. There were no questions people knowing me couldn't answer with moderate research effort...

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by Anechoic on Friday February 10, 2017 @10:33AM (#13616032)

We had the celebrity iCloud hack, caused at least in part by Apple not using 2FA for iCloud logins.

iCloud has offered 2 step authentication since 2013 [0]. From what I can tell, the celeb hack happened a few weeks before the public release in mid-2014.

[0] https://9to5mac.com/2013/03/21/apple-beefs-up-icloud-apple-i...

[ Parent | on HN ]

Re:iCloud was storing cleared browsing histories by onion2k on Friday February 10, 2017 @06:17AM (#13614600)

Apple's iAd advertising network only closed down a few months ago. They still have searchads for their apps stores and iTunes. Advertising isn't a big part of their business, but they do have good reason to collect data for targeting.

[ Parent | on HN ]