This is true, but it's also potentially worthwhile to consider that Apple has positioned themselves as a hardware company (i.e. the majority of their money is based on selling units of hardware), whereas their main competitor here (Google) is an ad company (i.e. the majority of their money comes from selling their users' data). Apple has chosen to highlight their commitment to privacy partially because they feel it helps their market position, whereas for Google, it would hurt it.
Certainly it doesn't mean that Apple is infallible, just that I think it makes it easier to accept that Apple is more likely to protect privacy more than Google.
I'm pretty biased towards Apple, so obviously this may not work for everyone; if you need source code to feel secure, then by all means, go for it. For people who are looking for less work but some of the benefits, I think that Apple is a decent way to go.
But this is all just marketing, whereas the reality is that Apple could also be hoovering up location data and you may never know.
You may have good reasons to trust Apple more than Google, which is great. Others may reverse that position of trust (perhaps they had their iCloud account hacked into and photographs leaked on the internet).
It isn't just marketing. This is how the alignment of incentives works. A company's incentives are aligned with the people who pay them. Apple's are aligned with those that buy phones. Google and Facebook's are aligned with those that buy ads.
Apple's true incentive is to provide value for their shareholders.
If they can improve the value provided to shareholders by hoovering up information while also maintaining consumer confidence and sales then why would they not?
I think that Apple's incentives are better aligned with my desires for privacy, but it's only an assumption.
Because this sort of thing inevitably leaks? Apple has a formula that demonstrably works, a formula that everyone can directly observe making them an utterly stupid amount of money. It would be the height of stupidity to risk their unparalleled monetary successes to pursue a few dirty little crumbs.
Saiya-jin, your comments all appear to be flagged and dead. You may want to contact a mod about this.
Don't attach these emotions where they are not appropriate. Apple is a for-profit company. If they will be pressed hard by US government behind closed doors, they will bulge and you won't know about it, why should you (maybe in 10 years as part of some leak). If they will decide to change their strategy, they will. They have 0 moral issues hiding gazillions of cash offshore from IRS. Just like any other company out there.
Simple fact is, most people don't care about security. I work in IT, and I have numerous friends with iPhones, but exactly 0 of them cares about extra potential security when choosing phones, most have no clue about these issues. Regular people choose Apple because of Apple and how things look and feel, and how they are perceived among others as a status indicator.
Apple has engineered their products to be unbreakable by Apple. That says a lot about their desire to cooperate!
Apple's billions held internationally aren't hidden, everyone knows where it is. And it was never money destined to be "on-shore" in the first place – it's profits from retail sales which occurred in Europe and elsewhere. Their offices in Ireland have the Apple logo on them and they're one of Ireland's largest taxpayers. Everything they do is on the public record. That money wasn't expatriated from the USA, the IRS isn't owed any of it.
According to their privacy policy[0], they comply with requests by the government for user data and inform the user unless gagged.
> In the second half of 2016, Apple received between 5,750 and 5,999 National Security Orders.
If their products are unbreakable, how can they provide this data to the government?
[0]: https://www.apple.com/privacy/government-information-request...
it's going to be less than 1%
... and where are they going to go?
I’d be pissed for an hour but at the end of the day my phone, laptop, watch, TV and car all syncing my music and crap with no effort is too appealing to scoff at.
Hell if I found out they had a meat locker of dead kittens hidden in the basement of 1 Infinite Loop Id probably stay loyal.
What makes you so confident? How do you know Apple thinks of itself as a hardware company whose incentives are aligned with those that buy phones? Their marketing certainly has made a lot of people think that, but, well that's just marketing.
Apple hasn't exactly always stuck with one identity. In 2007 one could have easily said that Apple is "a computer company" and not "a phone company" like Nokia.
Ultimately though, Google and Apple are incentivize to collect data for a lot more reasons than just selling ads. A lot of software functionality on phones benefits from rich user data. Apple may well be collecting data to drive better software experiences, and how much of that data they'll keep in-house vs sharing with third-parties is anybody's guess.
Even if you only consider advertising and hardware in simple terms, Apple is very directly incentivize to advertise new iPhones to current iPhone users. They want you to crave new models as soon as they come out, and to think your current model is kind of lame and old. Why wouldn't they be tempted to leverage user data to do that?
Finally, the vast majority of iPhone users probably aren't so sensitive to data security (the market of people who are is pretty small). So I doubt Apple cares that much about their perception among security-conscious people.
That sounds great but it can not be further from the truth. So are you saying that Comcast and the telcos of the world incentives are aligned with their users?
You buy a game, do you think that it means that the game producer has your best interest at hearth? Apple is filthy rich not because they have users as top priority, but because the extract as much as they can from them. They have a very clear lock-in policy where they try to avoid their users moving to other platforms if they wish so (iMessage anyone). Is that really in their users interest?
> Apple's are aligned with those that buy phones.
For all we know, that's what they want you to believe. The fact that you are so certain this is how they are incentivized could just mean that they did a fantastic job at marketing and making their users believe this image of themselves they've worked on.
Apple has a very strict internal culture of protecting user privacy.
At the end of the day, they still have a way to break their own encryption; they just don't want to set a legal precedent or create tools to allow a third-party to have unfettered access.
Everything they say in public releases is just, "face". It's better than the Facebook or AT&T models of charging for access as a subscription service, but nonetheless I do not believe them when they claim their hardware is opaque to themselves.
Here is a link to their privacy policy: https://www.apple.com/privacy/government-information-request...
It states that they comply with requests by the government for user data, and informs the user unless gagged.
They received over 5000 NSL's in 6 months last year, which seems kind of dumb if they're not handing over data.
I, for one, do not believe that their "secure enclave" is truly secure, that they have no backdoor.
Or, maybe more relevant, how do I get to know that?
The question the GP was almost certainly asking was "how can the public confirm that security of their data is high on the agenda of Apple (and by extension any company), what systems are in place". Without third-party review of open systems and practices I can't see it being possible.
Aside from Apple’s strong stance and history of protecting the privacy of users, we also have security researchers MITM’ing the traffic sent from iOS devices to Apple, and every jailbreak gives an opportunity to look deeper; if they were acting badly, someone would find that out soon enough.
If some surveillance happy government bans some VPN software then Apple is going to enforce that ban much more thoroughly than Google or Microsoft ever could.
If you paid someone (even multiple people/companies) to do professional audit over OpenSSL, it would be prevented.
Now, with closed software you are lost and the only thing you have is a TRUST the SW developer. Because inspecting blbs is much more difficult. And I don't trust them.
Every time I see a comment about an open source phone I am curious if the poster of the comment is actually going to fine comb the code base.
Edit: I was beat to the punch.
Apple has demonstrated time and time again their commitment to privacy and to protecting user data.
Apple does not see user data as something to be hoarded. They see user data as a liability and work very hard to collect as little as possible in order to provide the services they do.
The idea that Apple is going to discard all of this and add privacy intrusion into iOS, doing a completely 180° on their business model and discarding all of their corporate principles, is extremely unlikely.
That alone is a very strong reason to hoard data if you're Apple.
Really the big outlier here is Siri, I'm sure they could make Siri better if they were willing to hoard data, but Apple has demonstrated that they value user privacy much higher than the incremental improvement they'd make with Siri, and violating user privacy would likely hurt their business a lot more than making Siri a bit better would help.
IMO both Google and Apple aren't saints. Apple had a fairly similar headline in 2011[1]. Now watch people here on HN explain why that was completely different. It's a guarantee.
We really should be focusing coming up with ideas on what we can do. My friend for example (and this isn't a perfect solution) but he bought 2 phones, one of these for calling:
https://images-na.ssl-images-amazon.com/images/I/41AwGb3pKCL...
(extremely thin in real life)
And then he caries a smartphone for encrypted chat apps etc. He removed a bunch of hardware chips from the smartphone so even if you put a simcard it it doesn't connect anywhere. Also the microphone was removed and some other things. It works great. At first he had it with the simcard still in, but he wanted more privacy. Personally, I would have kept a 4g only simcard or something, it's kind of a trade-off because now he can only chat on wifi.
It's far from perfect, but at least he's trying something.
[1]https://www.theguardian.com/technology/2011/apr/20/iphone-tr...
Ok, since you’ve so eloquently asked - a local copy of your location history that colllected when location services are turned on is completely different from remotely collecting location data even when you’ve explicitly disabled location services.
Any attempt to say these are the same thing has gone beyond naive to willfully ignorant at best.
Google's entire business is carefully balanced on user trust. Anyone who posits some naive "they're an ad company" nonsense is just muddying the waters. Google is a user-trust company in a variety of spheres, and without that trust they would be annihilated.
Apple does not see user data as something to be hoarded
I've gotten downvoted elsewhere and will gladly eat it up to warn against this utterly ludicrous kool-aid fueled naivety. Apple says whatever nonsense gets a cheer at their latest product reveal. But if you don't think they're desperately vacuuming up data for their machine learning to stay ahead of the game, you should rethink your positions.
I remember virtually identical claims about Microsoft a decade ago, as an aside. Hell, in conversations about Google versus Microsoft, no less. Then Microsoft, you know, started viciously hoovering up user data like there's no tomorrow.
I'm a (mostly) happy [0] Apple customer. The lack of evidence that they are gathering all my bits makes me comfortable to use their products. I strongly feel we'd hear leaks about how they are saying one thing and doing another if they were. Employees of Apple aren't that loyal.
Yet here we are with Google and their "it's better to ask for forgiveness than permission" attitude.
[0] iOS 11 is bad. Just bad.
https://www.apple.com/newsroom/2011/04/27Apple-Q-A-on-Locati...
It is impossible that a unique device submits data about cell and wifi locations in an "anonymous" way aside from putting another party in between (a party that you'd have to trust), and that caveat is outrageously nonsensical to anyone with a hint of technical capability. But we trust that Apple is then mangling it up. Or do they?
And even if a cell phone does keep the same IP address for a long time, I'm confident that Apple is completely ignoring the IP address for each submission and taking only the encrypted location data. Apple has gone to great lengths to preserve privacy in so many other cases, it's outrageously nonsensical to accuse Apple of trying to match IP addresses with location data to identify individual devices (and besides, even if they did do that, all they'd know is the rough location history of some device, but nothing at all about what that device is or who owns it).
My guess is that they don't given that they have a setting in location services called "Wi-Fi networking". But this should definitely be investigated...
Apple is also much better at privacy now. Maybe they'll also change course and then we might as well stop using smartphones, cause we're being treated like sheep.
The non-Siri Apple machine learning is happening on device. This is something that Google would consider doing for 5s, before all in the meeting would start laughing and they'd go for uploading everything.
Remind me again, which company pulled out of China, Apple or Google?
"In 2014, in response to a series of terrorist attacks, China made all Google services almost unusable by tightening its Internet censorship, often called the "Great Firewall of China"
That would only happen if Google didn't comply with Chinese govt. unlike the other company we are talking about.
Apple, on the other hand, is a consumer brand that is wildly popular worldwide. People save up for these devices, they sell out within minutes and people go to extreme lengths to line up in store for them. There would be much more anger for banning them than Google.
I literally just now created, and then deleted, an Apple Id. It's trivial. Why do you think it isn't?
Being fully compliant with GDPR is a mountain of work even if you thought you were doing all the right things before.
In practice, small companies/ start-ups might not be audited / reported / pursued very much but: a) you'll never know and b) at least all the big tech and e-commerce companies are smack on in the sights of several data protection and competition(!) authorities already. We're all scrambling to be compliant in time.
Source: first hand account from running the GDPR compliance project in e-commerce company.
The same goes for banking apps and all official store membership and coupon apps, just to mention a few categories of apps you will have to do without.
Is called cash :) It's accepted everywhere.
>official store membership and coupon apps
Should all be burned anyway. Plastic cards and bits of paper worked fine for decades, you don't suddenly need to run arbitrary code on my pocket supercomputer.
>banking apps
Safer to use the website. My bank authenticates you by having you enter your PIN into a card reader - although they have created a mobile app, the security is strictly inferior as phones do not come with card readers (and the passcode is different from your PIN, making you more likely to write it down).
The basic pattern is, it's either important enough to be worth being a stickler over, or trivial enough to ditch entirely. Personally, I find "not being on F-Droid" as a very strong signal that I should not want to use an app in the first place. It steers me away from malicious code and proprietary lockin. And I never, ever see an ad on my phone!
A lot of people refuse to carry any significant amount of cash. It is a risk factor, especially when at events and shows or just during busy shopping hours, due to pickpockets. An app with verified identity (using the national 2FA login system in my country) is significantly more secure.
>Should all be burned anyway. Plastic cards and bits of paper worked fine for decades, you don't suddenly need to run arbitrary code on my pocket supercomputer.
It's a bunch of silly plastic cards that I then I have to carry around in my wallet or remember to bring from home when going shopping, as opposed to having the app on my phone, which I carry around with me anyway. The app automatically calculates bonuses and rebate collection marks.
>Safer to use the website. My bank authenticates you by having you enter your PIN into a card reader - although they have created a mobile app, the security is strictly inferior as phones do not come with card readers (and the passcode is different from your PIN, making you more likely to write it down).
My mobile banking app is perfectly secure, it uses the Danish national 2FA login system, used for all public services.
You're willing to sacrifice your privacy for this little convenience?
Surprisingly, it’s not!
A non-Swedish friend studying in Sweden recently told me of a situation (I forget the exact details) where she could not pay with cash. They only accepted payment via Swish[^1] (mobile payment system).
At the time she was with a Swedish friend which was the one to pay for both of them, with my friend paying her friend in cash.
[^1]: https://www.theguardian.com/business/2016/jun/04/sweden-cash...
I went to a festival earlier this year and the door tickets were card-only.
Reverse engineering and analysis techniques gives us enough ways to look into that so called "black box" and see what's going on.
So if Apple one day ships iOS with privacy intrusion built in, they will be caught.
I prefer to trust the motives, i.e. Apple doing reasonable things and staying away from funny business because they want to sell me iPhones.
You have to be pro-active about removing them, it's an opt-in choice.
Don't trust: the company fucking privacy because of economic incentives.
Quite simple.
- "People willing to trade their freedom for temporary security deserve neither and will lose both".
- Apple is screwing over developers AS A BUSINESS MODEL (de-value your complements) - and you want me, a developer, to support them?
Android freedom is purely theoretical for most people, including my family and friends. iOS security and privacy support is real and practical.
P.S: Apple is not screwing developers, they're keeping them under control. Time and time again developers have proven they don't care about security or privacy and they need to be forced to obey the will of the customers through APIs which can't be easily misused.
Their entire business model is predicated on the idea that hardware is important/ worthy, and that software should be $0.99 with free updates forever. It's basically the opposite of Microsoft - what MS did to the OEMs, Apple does to the indie devs.
Also: not sure about your family, but I can choose stuff like "what keyboard to use". For me, that's a kind of freedom too.
The stuff that's really good costs money also on iOS. The Abby OCR is 64 EUR, OmniFocus is about 44 EUR, Korg Gadget cost 45 EUR (now 20, maybe a special offer).
What keyboard to use is a freedom, but not really an important one. It's a convenience.
I recently bought an iPad for my parents and that allows them to have a device which is very unlikely to get infected by spyware or malware and I can count on their private information remaining private. That gives them the freedom to use it as they like and see fot, without having to worry. And without me having to keep up with whatever tracking fuckery Google thought up.
It's also my right to question your view that "security is freedom, freedom is insecurity and danger" (ok, I'm mean/ probably misrepresenting the second part. But not the first one - and that alone should give you a bit of pause)
I considered using Android devices, and had to concede that I have neither the time nor the skill to remove all the spyware added by very motivated and skilled Google engineers. It's a losing battle. So I decided to compromise on my freedom to control "my" device.
This decision is not for everybody. But using plain Android should not be for anybody, people deserve better than a peeping tom like Google.
And google does it with Google Play Services. All we have to go on is the historical record of the manufacturer, and apple’s is vastly better.
Obviously a high-quality open-source smartphone would be preferable, but I’m not aware of such a thing (Although I’m hopeful that purism’s phone will be good).
That’s not a great argument when you’re talking about the single most lucrative consumer product in the history of the world. At that point, the risk to your existing product by making an abrupt 180 like that is far too great.
If only HW and chip manufacturers released Linux sources (or ideally had support in the mainline Linux branch) soon with proper drivers (ideally open)...
Manyfacurers keep releasing lots of closed junk smartphones every year :/ but as long as people will continue buying it, nothing will change.
And this would be swiftly called out by someone soon after release, putting a very ugly stain on Apple's reputation. There is absolutely no advantage they would gain from this which could outweigh the PR nightmare.
Another sensible way (if you are prepared to 'phone' a bit more frugal) is a Sony Xperia X with Sailfish. (But check together first.)
Isn't it likely to be more lucrative now? I imagine that the number of people choosing iOS over Android purely for security/privacy reasons is fairly low. I think the incentive exists for them now and they've ignored it.
A more sensible way of dealing wirh the issue would be to use an open source Android version like AOSP or LineageOS, not run proprietary gapps, and replace its functionality with F-Droid, MicroG and Yalp-store. Your location will stay out of Apple's/Google's hands and you can still enjoy all convenience of a smartphone. Keeping your freedom in your own hands.