I really don't get accusations like this. Selling customer data would violate nearly everything about what Apple cares about and believes in. It makes no sense, as soon as it came to light it would completely wreck their business as their customers leave in droves, and their employees would also leave in droves as soon as they heard about it.
Not quite. It would violate everything Apple says they care about. But there's actually reason to suspect that Apple might change this policy. Once upon a time Apple said they cared about building computers that Just Worked, that were the most reliable and easiest to use in the industry, that had the most advanced hardware. That is no longer true. Apple's hardware is way behind the state of the art. Their applications are a horrible mess. Their OSs crash regularly. Security failures are common. Of course, they didn't get up one day and announce that they were abandoning their prior commitment to quality bwahahaha, they just did it. Quietly. Gradually. Probably unintentionally. So worrying about where Apple might go in the future is not just paranoia. Apple has jumped the shark before, they could do it again.
You say "blind", I say "evidence-based". Apple has been putting their money where their mouth is. If they stop, I'll re-evaluate.
Ultimately it has to come down to do you trust Apple. The evidence to date is that their behavior is trustworthy (e.g. they fought against unlocking an iPhone device despite being requested by authorities). However, there is nothing we can do to assert that trust into the future.
https://www.google.com/amp/appleinsider.com/articles/14/09/1...
Apple does comply with government data requests, as they're legally required to, for data that they already have. What Apple had an issue with was adding a backdoor to products so that it would collect data that Apple currently didn't have to hand over to the government.
Also, there was no backdoor requested, but that is a separate issue. If Apple could install a backdoor, that would make their initial claim even more of a lie.
Are you sure that's exactly what they said? Like you said, this could be construed as a lie and open them up to legal liability.
> Also, there was no backdoor requested
I'm pretty sure that's what the whole FBI thing was about. Write a version of iOS that we can install on this phone to gain access to it without the password.
I supplied a direct quote.
> I'm pretty sure that's what the whole FBI thing was about. Write a version of iOS that we can install on this phone to gain access to it without the password.
That is incorrect. The FBI asked for Apple to install a build that would let them brute force the pin without wiping the device. The device and build would stay on Apple's premises. Again, this is beside the point that Apple is untrustworthy.
The data you're supposing they might sell to the Chinese in the future is mostly stuff they go out of their way not to collect in the first place.
What makes this attack plausible is that it's relatively easy to mount (for the Chinese government) with a potentially huge payout (by their quality metric). It's hard for me to imagine that they haven't tried, and once you get to that realization, it's only slightly harder to imagine that they haven't succeeded.
Every time they boast about privacy features, they increase the penalty for them doing something egregious with user data.
For most values of “me” as a customer, it’s in Apple’s interest to behave as they advertise. They can stray due to government or other action, but so can any party you trust.
Yes, but the difference is that other parties I trust are subject to external verification and audit. If my bank steals my money, it will soon be discovered, either by me the next time I get my statement and it doesn't match my records, or by the bank auditors the next time they audit the books and discover that they don't balance. By way of contrast, if Apple sneaks a back door into a MacOS update it could easily go unnoticed for years.
Some of us here have access to systems, data, or people with high value information. Some folks are involved in things professionally that an external, unethical party could put a dollar value on accessing things or people whom the victim could access.
Your kids’ teacher might have a spouse whose job directly influences a governor, mayor, Union, Senator, etc. Access to the wrong twitter account or TV producer could influence POTUS.
> Some of us here have access to systems, data, or people with high value information. Some folks are involved in things professionally that an external, unethical party could put a dollar value on accessing things or people whom the victim could access.
I think that your reply directly contradicts the assumption contained in my question. It's pretty obvious that if I would have such access I'd adopt a completely different security priorities.
I also think it's possible that Apple could sneak a back door into the OS in cooperation with the U.S. government while maintaining an overt posture of defending their user's privacy. Yes, this would be risky, but if Apple management put patriotism or national security above commerce (which is not a completely unreasonable thing for them to do) they might decide to take such a risk.
Apple has gone to great lengths to make both devices secure and policies. You are awfully critical, so I really want to understand what is the expected behavior that you'd like to see?
Open source the security libraries? But if you don't trust Apple not to backdoor then what's stopping them from putting the backdoor in the kernel? At some point we must trust something.
That would help a lot.
> But if you don't trust Apple not to backdoor then what's stopping them from putting the backdoor in the kernel?
At the moment, nothing. That's kind of my point.
> At some point we must trust something.
Yes, that's true, but the more I can poke around under the hood (or hire someone to do it for me) the warmer and fuzzier I feel.
In other words: I think that the odds are >0 that there is a systemic weakness in Apple's security, either accidental (like the meltdown and spectre issues almost certainly are) or deliberately introduced by a mole, or by Apple's management in service of some higher cause. I think that the odds are further >0 that this weakness could be discovered by a malicious party, and that will end up leading to major problems, not all of which will necessarily be immediately obvious.
I think the odds are >0 that I will get a straight flush in my next hand at poker. Unfortunately, while true, this is not a valuable observation.
could you possibly phrase this with any more condescension, myopia, or overgeneralization?
Do you actually disagree with the substance of what I said, or are you just criticizing my style? Because if you agree with the substance then I would say that the style is justified.
I’ll try to help you say what you should have said: “Apple doesn’t have great security, their major competitors are far better because [reasons] and instead of Apple products you should be using [competitor].”
Since you're on a technical forum but talking about mass-market products, you should also clarify your audience: “if you’re a technical user, [competitor_1] is the best security you can get, while [comptitor_2] beats them on usability and user experience. If you’re looking for the best of both worlds, [competitor_3] is your best bet.”
Because what you did is walk into a discussion, say “nah you’re all wrong and besides that you’re all idiots” and walked away. Back your shit up, man. If you don’t think Apple is the product to use because of their security practices, recommend an alternative. If an alternative doesn’t exist, then keep your mouth shut because some security is better than no security and saying “shit’s all fucked anyway” isn’t going to help anything.
Apple is better than the competition with regards to security and privacy. But that's a very low bar.
[UPDATE] This comment is getting a lot more attention that I expected it to. I've watched the point count on it go as high as 20 and as low as 0, with several cycles between 0 and 10 and back, so a lot of people are voting on it. So let me say a few additional things.
First, I concede that the way I phrased my position was inartful. I apologize for that.
Second, Apple is probably the best solution on the market in terms of security and privacy. My complaint is not about them per se, it's really about the state of the market. My choices are either to hand my data over to Google or Microsoft, or to hand over my control of what I can and cannot run on my system to Apple. Neither of those is a satisfactory option IMHO.