News for hackers. Stuff that matters.
Re:iOS 12 released by kyrra on Monday September 17, 2018 @02:17PM (#18008454)
Though I believe Apple bowed to China to give them access to Chinese citizen's iCloud data. But you can operate an iPhone without iCloud fairly easily, which is definitely nice. Doing more on-device helps them here.

https://www.theverge.com/2018/7/18/17587304/apple-icloud-chi...

Re:iOS 12 released by abalone on Monday September 17, 2018 @04:31PM (#18009774)
Also several of the iCloud services are E2E encrypted and designed to withstand adversarial clouds. They talked about it at Blackhat.[1]

Doesn't help things like mail or photos, of course, but it is extremely notable in the China context for one big reason: it does E2E encrypt messages. WhatsApp was banned from China when they implemented this. Apple stands out in this way... although they're probably getting away with it because most Chinese don't use Apple Messages.

[1] https://www.youtube.com/watch?v=BLGFriOKz6U

Re:iOS 12 released by teknologist on Tuesday September 18, 2018 @09:49AM (#18015246)
I suspect that there might be undiscovered software differences between iPhones sold in China and those sold in other markets. The Flag of the Republic of China (Taiwan) is not present on iPhones sold in China. It shows up as a box with a question mark in it.
Re:iOS 12 released by abalone on Tuesday September 18, 2018 @01:37PM (#18017393)
If you're implying they secretly disabled iMessage encryption for the China locale: No Friggin Way. That would be discovered and publicized instantly.
Re:iOS 12 released by teknologist on Wednesday September 19, 2018 @07:57AM (#18023520)
Not to venture into conspiracy theory territory but the fact that they have the capability in software to modify the phone's behaviour based on which country the device was sold in is concerning enough to me. The Chinese gov. can put pressure on these large multinationals that rely on China's workforce and those companies can't do a great deal about it other than comply.
Re:iOS 12 released by mtgx on Monday September 17, 2018 @05:12PM (#18010126)
Yeah but even if they use e2e, which btw was found to be flawed at the protocol design level by prof. Matthew Greene and his team, they also automatically back-up the messages to iCloud with no way to disable that without disabling the whole of icloud. It would sure be nice if they changed that.
Re:iOS 12 released by djrogers on Monday September 17, 2018 @08:26PM (#18011347)
This is categorically and demonstrably false. Backing up to iCloud is disabled by default, as is Messages in iCloud. Either can be enabled or disabled as desired with no ill effect on your device or the rest of iCloud usage.
Re:iOS 12 released by sneak on Tuesday September 18, 2018 @04:24AM (#18013470)
iCloud backup is on by default.
Re:iOS 12 released by djrogers on Tuesday September 18, 2018 @10:48AM (#18015784)
No - setting up an iPhone from new doesn’t even require an iCloud account. If you set up iCloud it will enable backups, but even then you can disable them without disabling ‘all of icloud’ as GP claims.
Re:iOS 12 released by sneak on Friday September 21, 2018 @02:02PM (#18041497)
The fact that iCloud is not required to activate does not change the fact that iCloud is on by default and iCloud backup is also on by default.
Re:iOS 12 released by mediocrejoker on Monday September 17, 2018 @05:21PM (#18010196)
Can you elaborate on what you mean by "e2e was found to be flawed"? Is the paper available online?
Re:iOS 12 released by coolspot on Monday September 17, 2018 @05:54PM (#18010468)
Commenter probably meant this research[0].

[0] - https://blog.cryptographyengineering.com/2016/03/21/attack-o...

Re:iOS 12 released by threeseed on Monday September 17, 2018 @05:54PM (#18010470)
There is the option in Settings to disable storing Messages and Backups in iCloud.
Re:iOS 12 released by sneak on Tuesday September 18, 2018 @04:24AM (#18013473)
...which does not affect the storing of Messages in device backups into iCloud.
Re:iOS 12 released by ksec on Monday September 17, 2018 @02:45PM (#18008777)
Which is why I have been crying for an iOS Time Capsule.

I don't want to touch iTunes and do computer backup, that is like a very geeky way do it and most people in China don't even have Laptop or Desktop. If they can make Dual Sim and other features targeting the Chinese market; Apple's second biggest market, why cant they make Time Capsule specifically for China. ( Making it China only will likely piss off the Chinese Government. They could release it worldwide to avoid this.)

Re:iOS 12 released by radicaldreamer on Monday September 17, 2018 @02:55PM (#18008881)
There is an iPhone Time Capsule... it's called iTunes and it has support full, encrypted device backups via home Wifi for years...
Re:iOS 12 released by randomdata on Monday September 17, 2018 @03:02PM (#18008941)
"I don't want to touch iTunes and do computer backup, that is like a very geeky way do it"
Re:iOS 12 released by radicaldreamer on Monday September 17, 2018 @03:10PM (#18008999)
Oops :(
Re:iOS 12 released by plussed_reader on Monday September 17, 2018 @04:49PM (#18009943)
They have iCloud for that.
Re:iOS 12 released by mattnewton on Monday September 17, 2018 @05:00PM (#18010043)
Right, and that’s back-doored by the Chinese government (in China). So neither fits gp’s desired featureset of local & frictionless.
Re:iOS 12 released by teknologist on Tuesday September 18, 2018 @09:51AM (#18015262)
Can't reply to the guy below you but there might be some truth to this. Companies running servers in China must give up the login keys to the government. iCloud in China is not operated by Apple themselves, but a Chinese partner vendor.
Re:iOS 12 released by ksec on Tuesday September 18, 2018 @11:15AM (#18015988)
Exactly. It is not really a backdoor per se. And there isn't any law sitting in between your iCloud Data and government trying to collect it.
Re:iOS 12 released by raydev on Tuesday September 18, 2018 @09:38AM (#18015164)
Evidence of back door?
Re:iOS 12 released by mattnewton on Tuesday September 18, 2018 @02:30PM (#18017863)
https://www.reuters.com/article/us-china-apple-icloud-insigh...

The encryption keys for Chinese users are stored in China, and the government has full access to data and keys on those servers as per Chinese law. Maybe “backdoored” is the wrong word since they can walk in the front door.

Re:iOS 12 released by johnflan on Monday September 17, 2018 @05:00PM (#18010041)
>full, encrypted device backups via home Wifi for years

I never knew that - this might be a much better option than iCloud backup

Re:iOS 12 released by 2muchcoffeeman on Monday September 17, 2018 @06:23PM (#18010640)
My parents barely touch a computer and I haven’t backed up in ages.

I would immediately buy 3 if these.

Re:iOS 12 released by typetypetype on Monday September 17, 2018 @04:00PM (#18009446)
Isn't that iCloud? Or are you looking for an onsite backup?
Re:iOS 12 released by torstenvl on Monday September 17, 2018 @03:24PM (#18009125)
Have ou tried iMazing?
Re:iOS 12 released by kodablah on Monday September 17, 2018 @05:59PM (#18010509)
Without a public statement even saying they disagree with it, which seems to go against their pro-privacy principles and goes against what they've done in other government-based privacy disagreements they've had. I wish they'd make actions against their principles more transparent lest people think it's just lip service they are paying to the masses.
Re:iOS 12 released by Rjevski on Monday September 17, 2018 @02:20PM (#18008487)
Can’t you just select US sad your country when setting up the iCloud account and use a VPN? Or are Chinese devices different at the hardware level and only allow connecting to the Chinese (compromised) iCloud?
Re:iOS 12 released by btian on Monday September 17, 2018 @02:28PM (#18008566)
VPNs in China get blocked all the time.
Re:iOS 12 released by torstenvl on Monday September 17, 2018 @03:25PM (#18009133)
Even private VPNs? I'm not that smart about networking but it seems like it would be difficult to distinguish an SSL/TLS connection to your DigitalOcean server because you're doing normal stuff and one where you're tunneling HTTPS through it.
Re:iOS 12 released by viraptor on Monday September 17, 2018 @03:37PM (#18009236)
It's not hard to distinguish a VPN connection by behaviour pattern really. Some simple features to detect:

Both small packets and maxing out the window size in one stream. Lack of DNS queries from the host. Single connection dominating the bandwidth.

There's a reason for all of those of course, but put them together on a residential connection: almost certainly a VPN user.

And these are all really simple heuristics. In practice, we know you can identify which Netflix video are you watching just by the packet sizes/timing.

Re:iOS 12 released by earenndil on Monday September 17, 2018 @05:22PM (#18010206)
There was a post recently about how someone was able to set up his own vpn which bypassed it. Something about the server padding out its response with garbage data?
Re:iOS 12 released by teknologist on Tuesday September 18, 2018 @09:53AM (#18015286)
You are still piping all of your traffic through one server. This would not look like a regular usage pattern by any means.
Re:iOS 12 released by selectodude on Monday September 17, 2018 @03:32PM (#18009190)
Their deep packet inspection tech is very very good.
Re:iOS 12 released by chatmasta on Monday September 17, 2018 @06:04PM (#18010535)
You need a payment method with a billing address in the country.
Re:iOS 12 released by Rjevski on Thursday September 20, 2018 @10:34AM (#18032703)
I believe there are tricks you can use to bypass that (attempting to download a free app?).
Re:iOS 12 released by 2muchcoffeeman on Monday September 17, 2018 @06:21PM (#18010634)
I have Apple and Android phones.

I have a specific google account for my Android phones specifically because you can’t do anything on an Android without logging in. iPhones still work as phones just without cloud storage.

Re:iOS 12 released by drampelt on Monday September 17, 2018 @07:20PM (#18010986)
Maybe I'm missing something here but what can't you do on Android without logging in (other than Google services of course)? You can download apps to do pretty much anything you want without even touching the Play Store, as far as I'm aware you need an iCloud account to download any apps on an iPhone.
Re:iOS 12 released by SpaceGorilla on Monday September 17, 2018 @09:47PM (#18011728)
Yea, not sure what he's talking about. You can choose not to sign into Google and use the web browser to install either fdroid or Aurora as the app store. Pretty sure you need to sign into iTunes to use the apple app store and cannot install any ipa?'s.
Re:iOS 12 released by snaky on Monday September 17, 2018 @03:23PM (#18009114)
> an iPhone without iCloud

Would it send less telemetry data to Apple?

Re:iOS 12 released by oneplane on Monday September 17, 2018 @03:36PM (#18009224)
No, but not turning on telemetry does.
Re:iOS 12 released by threeseed on Monday September 17, 2018 @05:59PM (#18010503)
You are asked every single OS update whether you want to enable telemetry or not.

And the default is no.