Since when do you need a phone number for iOS? How would that work on an iPad?

You can't get an Apple ID without giving a phone number.

Opening the App Store app transmits your hardware serial number to Apple, like a permanent supercookie, linking it to your email address and phone number and city-level location via client IP.

I absolutely agree, but you COULD say one company holding your data is better than lots of them having it too.

That depends if they all get the same data.

I'd much rather have multiple services, each of them isolated to the data that is relevant to providing their specific service than one service having it all.

Who do you think has been a better steward? One thing to consider is the security lapses of each. What company has the best security record?

I have no knowledge in general of this stuff, but my assumption is that your average company is horrible with security, but huge corporations dump tons of money into security (being a big target with the most users) making it more effective.

Not saying breaches never happen with apple or google of course, it's just less often than your trusty todo list app being pwned and your clear text passwords being dumped online.

You raise a very good point though. You can't judge the security of a company by any metric except their record. It would be interesting to have a registry that logs breaches, how severe they are, and give an overall rating to them.

Phone number is a valid point, but in many other ways Apple actively avoids collecting its customer data. Location data, Messages, Apple Card transactions, health and home, Siri are examples.

Messages' end to end cryptography are actively backdoored for the FBI.

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

If Messages E2E crypto were backdoored, then why would the FBI take an interest in iCloud backups?

I too wish iCloud backups were E2E encrypted, but that is a very different claim from "Apple assumes you desire privacy from everyone but Apple." Apple knows you want privacy from Apple; their privacy policy is quite explicit about what data Apple cannot see.

https://support.apple.com/en-us/HT209110

iCloud Backup backs up the messages, or the message sync key in the case of Messages in iCloud being enabled.

iCloud Backup is not e2e encrypted, which means Apple either gets the full iMessage and SMS history (in the case of Messages in iCloud being disabled), or gets the e2e encryption key to decrypt the synced Messages in iCloud (which they already have, due to running iCloud).

https://support.apple.com/en-us/HT202303

Yes we agree that Apple has the technical capability of decrypting Messages that have been backed up by users who have enabled iCloud Backup, even if those messages were previously E2E encrypted. I think Apple should fix that.

Your link describes in detail what Apple can and cannot read. They seem to want their customers to know. So how did you conclude "Apple assumes you desire privacy from everyone but Apple?"

I belive that most users, after reading 202303 and Apple's public communications around privacy, would incorrectly conclude that Apple cannot read their iMessages.

Your link doesn’t say anything like that. It talks about how Apple was planning to add e2ee encrypted backups of iMessages to iCloud but instead opted not to offer them as e2ee backups.

If you don’t enable backups for iMessages, they stay on your device.

Nowhere does it describe a back door that the FBI has access to.

> If you don’t enable backups for iMessages, they stay on your device.

The backups are enabled by default, on your device, as well as the devices of everyone else you iMessage with.

For iMessage to be end to end secured, you need to turn off iCloud Backup on each and every device you have, and everyone you iMessage with needs to turn off iCloud Backup on each and every device they have. If either you or your conversation partner misses a single device, Apple will get either the message text itself in the backup (if Messages in iCloud is disabled) or the message sync encryption key (if Messages in iCloud is enabled).

In practice, this never happens. Non-e2e iCloud Backup is an iMessage cryptographic backdoor.

Saying that defaults are insecure (which is the case here) is different to the claim there is a backdoor.

A backdoor is a very specific claim that isn't backed up.

Key escrow for the FBI was a cryptographic backdoor during the crypto wars in the 90s, and it is still the same today.

Defaults matter.

Apple had a plan to secure it, and (I understand) a partial implementation. It was killed specifically to aid surveillance capabilities. If that isn't a backdoor, I don't know what is.

There's still people willing to claim USA government law enforcement and security agencies don't have privileged access to US big tech company data.

You're not going to find proof in the EULA.

Your location data is sent to Apple with your IP 24/7 if you have Location Services enabled, as the device sends the visible wifi AP mac addresses to Apple continuously. It's not just passive GPS reception.

Home cannot be set up without an iCloud account, which requires an Apple ID, which you can't get without providing a phone number.