Zero click vulnerability in Apple’s macOS Mail

Re:Zero click vulnerability in Apple’s macOS Mail by smoldesu on Thursday April 01, 2021 @09:40PM (#26668333)

iCloud has always been suspicious: Apple cancelled end-to-end encryption on iCloud after a certain three-letter agency filed a complaint, saying that it would disrupt investigations and have a considerable impact on the law enforcement capabilities of our country. Not to mention, Apple's behavior has been decreasingly auspicious in places like Russia and China, where they've started preinstalling state-sponsored apps and relocating servers to government-controlled provinces, respectively.

[ Parent | on HN ]

Re:Zero click vulnerability in Apple’s macOS Mail by jhugo on Thursday April 01, 2021 @10:33PM (#26668545)

> Apple's behavior has been decreasingly auspicious in places like Russia and China, where they've started preinstalling state-sponsored apps and relocating servers to government-controlled provinces, respectively.

This is a legal requirement to operate the service in China. Apple’s choice is between offering iCloud in China or not offering it at all in China, not between offering it with local servers or with out-of-country servers.

[ Parent | on HN ]

Re:Zero click vulnerability in Apple’s macOS Mail by smoldesu on Thursday April 01, 2021 @11:02PM (#26668693)

It is indeed a legal requirement, and both Google and Microsoft have chosen not to provide services in those areas for this exact reason. Apple is the only major tech company that still operates in China, and has become pretty politically passive in the region. I only bring this up because Apple claims that "privacy is a human right", which I suppose is pretty conditional to what kind of human you are.

[ Parent | on HN ]

Re:Zero click vulnerability in Apple’s macOS Mail by jhugo on Friday April 02, 2021 @02:54AM (#26669502)

> Apple is the only major tech company that still operates in China

This is not even remotely true, even if you define "major tech company" to mean "major US tech company".

Both AWS and Azure have actual cloud regions in China (delivered with a local JV partner just like Apple's cloud services are).

Even Google operates there in various ways - they have four offices there, they manufacture hardware there, and they sell tons of ads to Chinese companies via their local subsidiaries (for display outside of China obviously).

[ Parent | on HN ]

Re:Zero click vulnerability in Apple’s macOS Mail by fauigerzigerk on Friday April 02, 2021 @02:41AM (#26669460)

Apple isn‘t simply running iCloud locally as the law may require. They have transferred the operations of their entire iCloud service to a government owned company, including all keys.

What Apple does in China is more than complying with local laws. They appear to be exceptionally proactive in staying in the regime‘s good graces.

[ Parent | on HN ]

Re:Zero click vulnerability in Apple’s macOS Mail by jhugo on Friday April 02, 2021 @02:50AM (#26669488)

Running cloud services in China requires establishing a JV with a local partner. Look at AWS China as another example of this, but there are many.

Can you provide a reference for Apple's JV partners being government owned? Any company in China of course has to do as the Party tells them to, so I guess the difference is largely academic, but I haven't seen it mentioned before that Apple's China partners are government-owned.

[ Parent | on HN ]

Re:Zero click vulnerability in Apple’s macOS Mail by fauigerzigerk on Friday April 02, 2021 @03:03AM (#26669535)

This is what was reported at the time:

https://techcrunch.com/2018/07/17/apples-icloud-user-data-in...

There are conflicting reports and vague language around how exactly the keys are handled.

[ Parent | on HN ]

Re:Zero click vulnerability in Apple’s macOS Mail by jhugo on Friday April 02, 2021 @03:04AM (#26669544)

Thanks for the link, very interesting.

[ Parent | on HN ]