The chances of you being directly spied on are low. The chances of someone being spied on who could influence the world around you is much higher. So a journalist could be spied on right before they break a big story, potentially leading to a cover up. That’s the problem with stuff like this. Even if you have “nothing to hide” you might rely on someone who legitimately does.

Without disagreeing with anything you've said there, even if you /think/ you have nothing to hide now and happen to be correct in practice, it's a terrible assumption to think that you can count on that being true forever.

Imagine you witness a murder in a restaurant, cold blooded and it's dirty cops working for a three letter institution that did it. You want to give evidence like a law abiding, upstanding citizen with nothing to hide. Suddenly you have something to hide despite having done nothing wrong.

"Nothing to hide" means nothing to hide from all current and future humans who control some small aspect spying on you. Even just control access for 30 seconds. It's nuts. Even if you think every single last one of the current guys are honest and completely competent despite the head of them criminally lying, while under oath, in answer to a question with notice in legitimate oversight. Who is going to infiltrate that power in 10 years? Radical anti-fa is impossible? White supremacists impossible? Religious cultists? Organised crime? People flipped to work for hostile foreign nations?

"I have nothing to hide" is is gradeschool silliness to be treated with contempt every time it comes up. It needs to be ridiculed as anyone suggesting it is an idiot or just totally and knowingly dishonest. There are just so many ways it is completely wrong, the only debate is which of the ways it is false and a con is more important than the other.

Fully agree. This idea that "individuals arent spied on in America" is absurdly naive and ignorant of seemingly common knowledge of past events. Furthermore it's kind of implicitly supremacist - "only those foreigners do that sort of thing".

Police regularly bust young Chinese for marijuana possession by reading their chat messages. And we are just as human and no more special than the Chinese.

A friend of mine was taken into an unmarked van and questioned after some tweets he made while at an Occupy Wall Street protest. The motives absolutely exist in the US.

Especially with the still recent insurrection/coupe attempt by a fascist leaning politician on American soil. It's actually pretty scary. Democracy is not as assured as some people seem to think and shouldn't be taken for granted.

You don't even have to get that radical with "nothing to hide".

Next time someone says that ask if they use blinds in their house/apt, if you could setup a webcam in their living room, or if you could just read some texts between them and a significant other. Or ask for their passwords, date of birth, SSN, credit card numbers, pets' names, and parents' names.

Simple things like this are why I talk to people via Signal and why I'll never get a Ring/Nest doorbell, or any other 3rd party owned internet connected camera.

People don't care when they are just a statistical datapoint, like sure they can see "now a million people are having sex", but nobody will act on that since it isn't interesting. Which is why people would be more fine with having a camera in every bedroom than having a camera in their bedroom specifically.

So arguing "what if I spy on YOU?" wont convince anyone. They see that as a completely different thing.

Signal is centralized and is an obvious target for surveillance so I would not even remotely rely on it.

The point of Signal is supposed to be that to the best of our knowledge, even if all its packets are run through FSB and NSA, and even if they captured all Signal employees at once and somehow forced them all to cooperate, your messages should still be safe until they manage to push an app update that compromises the app.

Of course this only helps as long as your device isn't backdoored but that is true for any app.

(I say this as someone who regularly defend Telegram here, because in my opinion I don't have to pick one or another.)

And most devices have backdoored CPUs too (Intel ME)

I wonder what the next Crypto AG (CIA front) will be

> I wonder what the next Crypto AG (CIA front) will be

NSA: VPN and "secure" webmail providers

CIA: They don't need fronts anymore, they have CISCO, Juniper, Netgear, etc.

many argue that silicon valley firms are de facto extension of the US government [1]. a swiss army knife (haha) in their toolkit that allows complete control over the flow of information. i mean seriously, just look at how fast the Crypto AG story was forgotten. only this Dutch article [1] and a handful of others properly dives into the profound impacts that the CIA backdoored Crypto AG devices likely had on world events in the past 50 years. [2]

so yeah if SV firms were not extensions of the US govt. (hardware firms too, not just software), they would have already been broken up years ago.

the senate hearings are just a charade used to stroke the ego's of the 'visionary' SV tech bro CEOs. they also show us how tech illiterate the working class has been made. [2]

[1] https://www.youtube.com/watch?v=6pVfYmttcag, https://www.youtube.com/watch?v=q9oMYL2M_tE

[2] https://www.vpro.nl/argos/lees/onderwerpen/cryptoleaks/2020/...

[3] https://jacobinmag.com/2015/03/socialism-innovation-capitali...

I guess "Intel" is a sufficiently ironic name.

Gee, thanks for contributing to the conversation and providing a useful alternative.

The only semi-popular better option I can think of is Matrix, but getting people on Signal is already hard enough and using Matrix on a mobile device is (last I checked) far from ideal.

Security is a gradient, not an all-or-nothing. Signal is vastly better than almost every other electronic communication method.

Once its compromised there is no gradient anymore and you never know when things are compromised because three letter agencies will anyway not tell you.

Given the risk of xyz agency, there seem to be only a couple options to me:

- side-load a peer reviewed apk so you can check the sigs and make sure all crypto is being done locally (and to make sure that the implementation is solid)

- manage your own keys like you would with traditional pgp emails. Give your public to your friend. Force them to send anything sensitive using it. Maybe change to symmetric keys from asym but rotate occasionally. But you still have to trust the app you use to do this unless you want to do it manually each time.

*These don't necessarily solve the Metadata issue

> side-load a peer reviewed apk

Signal has open sourced clients with reproducible builds (on Android) and their encryption library has been reviewed by multiple 3rd parties to great acclaim.

PGP lacks forward secrecy, meaning if a key does get compromised all of your past correspondence is now also compromised.

This solution works then, right? So given this implementation (and not a play store or ios download), one should be safe from xzy snooping?

Edit: As someone that has heard of forward secrecy but not how it relates to pgp, these were helpful reads:

https://signal.org/blog/advanced-ratcheting/

https://signal.org/blog/asynchronous-security/

So what do you use instead?

It's not about what to use, it's about having expectations of zero privacy when communicating online. Expect everything to be potentially public.

I'm curious about your concerns about a Nest/Ring doorbell. Since it would presumably face a public space, if there was a privacy concern, it would seem easier for a third party to set up their own camera for surveillance. If I was worried about being watched, I would think the best strategy would be to set up vulnerable cameras on my own network, monitor them for access, and hope that someone would try to use them instead of installing their own.

>Next time someone says that ask if they use blinds in their house/apt

I think this is the closest analogy I've heard yet, but not in windows on suburban, tree-lined street. People walk down those streets and the windows are at eye level. Someone could accidentally see into those windows. No, I think if we consider windows in hi-rise buildings in a major city, the analogy is getting much closer. Seeing into one of those windows requires a bare minimum of intent and possibly an inexpensive tool, say binoculars or a telescope. However I would be willing to bet that a large portion of hi-rise dwellers do NOT close their blinds on the theory of "No one is looking in MY window."

Yeah. I've also heard it likened to "Who needs freedom of speech? I have nothing to say"

> "I have nothing to hide" is is gradeschool silliness to be treated with contempt every time it comes up. It needs to be ridiculed as anyone suggesting it is an idiot or just totally and knowingly dishonest.

That might be an aspirational sentiment, but given most competent adults are in the "I have nothing to hide" category, I don't think it's true at all. I don't think these people are idiots, or dishonest, just ignorant. And it's not even their fault.

Now I say most adults are in that category, but I don't have data on that. I'm going by observed behaviour. We don't see a massive push against tracking / spying and even when it's thrown in our faces (eg: Snowden, Manning) we respond with a collective shoulder shrug.

Except in that case you don't know you have to hide and 101 other things you do make you easier to track than this. And odds are you're not turning off your phone all the way every single time you change locations to start so...

I have nothing to hide is different than "I literally need to hide".

Yep "I have nothing to hide" is always completely false.

"I literally need to hide and I'm also aware of that change" might be true or might be false. You might "literally need to hide" and not know it while the so-called "nothing" you had to hide is used against you when you have done nothing morally or legally wrong.

Tangentially related to events you may not consider to be relevant now, but become so in the future is Roko's Basilisk.

Reader beware.

https://www.lesswrong.com/tag/rokos-basilisk

I'd call this a stupid idea, except Roko's suggestion is exactly what the "communists" did in my country when they came to power.

The 'Dirty Cop is Gonna Get You' is the 'gradeschool silliness' here. It's 1000x more likely that the criminals who did the murder want you killed because you're a witness. Witness intimidation is widespread and 'default' in some communities ('snitches get stitches'), and while the 'Dirty Cop' thing does happen in reality, it happens mostly on Netflix, and there's a difference between overzealous prosecutors/cops and 'dirty cops'.

Also consider that tech will exonerate as much as otherwise: for such and such murder, the 'background use' of the tech would be to provide you with an alibi.

Forensics have generally improved Justice I think, not the other way around.

In the end I think Apple's issue should be one of transparency and privacy and we need to push them towards that.

I wish I could live in a world where I can sustain the fantasy that power will not be abused whenever the abuser can get away with it.

The power is asymmetric. The NSA, CIA, FBI, Apple, Google, Police have a lot of power so they need to be very, very transparent in its use and oversight. You do not have that power, privacy is the only thing you can have to protect yourself from abuse.

The other point about about not having to worry about it as an individual is equally wrong. The equivalent argument is that you aren't a doctor so you don't need to worry about a purge of all doctors if one were proposed. Whereas obviously you do need to worry if anyone you care about ever gets sick. So it goes with standing up to corruption. Even if _you_ never stand up to it, your life is greatly adversely affected the harder that is for genuine heroes who make the sacrifice to do it because its the right thing.

"If you have nothing to hide you have been conned."

I suspect you live in a country with a low corruption index.

Just consider the possibility that any large multi-national corporation or national government these days has datacenters that contain untold computational power. A hundred thousand CPU cores to a hundred million, with petabytes of RAM and perhaps exabytes of storage. It is now not only entirely feasible but it is but a flesh wound to surveil everyone, everywhere, all the time. In fact, it's far less suspicious to just constantly suck in as much data as possible all the time, and filter, index, and store it for later. In the event of a mass casualty event, like a Boston marathon bombing, 9/11, or something like what you mentioned, there will be no activation necessary, just a few SQL queries, maybe a mapreduce.

You are nothing. You are navel lint. But all the navel lint gets sucked up into the filter, too.

Welcome to the quiet all-seeing eye. Tremble and kneel to those who will wield it! Don't deviate from social norms. Don't be different. Don't stick out. Just pretend you don't know.

Can you be more specific with where you think the risk is?

As far as I can tell, in this scenario, the journalist has powered off their phone, ignored the message about "findable when power off," and then is somehow tracked through the BT beacon and Find My network.

Were their phone to be on, all the same tracking would work.

Were they to read the message and go change the settings, this tracking would presumably not work.

That assumes you trust that the "always on processor" only does what it says it does, of course. But in that case, any proprietary device is just as bad as any other. (Many supposedly less-proprietary devices could be sneakily subverted, too, no?)

You asked what the real risk is then described several risks.

How many risks here are new in iOS 15 or exclusive to Apple products?

Specifically, I believe the real risk seems to be that you have very few ways to know if your device is doing anything when it's on or off unless the manufacturer tells you.

If you don't believe that everyone, including your government is corrupt, the only solution is through government regulation. Clearly the private companies are otherwise going to do what they will.

In some cases. In other cases the government regulation is what puts people at risk in ways that the companies have no interest in doing.

You could be spied on if governments are allowed to deploy dragnets that spy on everyone. Like how if your phone is on, your broad location is tracked whether you are a suspect or not.

I'm afraid that whether or not the governments are _allowed_ is a moot distinction, since they _do_.

Wow, very well put!

If you're not familiar with it, their platform security team releases a whitepaper about the technical details of their security. Regardless of how you feel about Apple, these documents are incredibly well done and interesting to read. The Find My section may have more information, as will their contract tracing docs (which use a riff of the same technology)

https://covid19.apple.com/contacttracing

I highly recommend anyone interested in security or privacy to read this from start to finish:

https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

Unfortunately that document mentions the AOP just once, only confirming its existence. It doesn't actually describe what it does.

They do yearly updates, the 2022 doc will very likely have more information. Regardless, the 2021 doc has some key foundations of the technology that are worth knowing.

The contract tracing docs _should_ be almost the same technology, and knowing how that works _should_ be a good start. At least, from my eyeing the OP's article as a lay person.

AOP has been a thing since iPhone 6s, so they're not particularly rushed in documenting it.

I can't go too into details, but now that the AOP is doing cryptographical operations and key escrow, the internal bus is likely to show up in future documents. Maybe not the AOP but certainly the mechanisms it uses to interact with the find my network. It may also be a separate find my network whitepaper.

Is the AOP still involved in Find My, even on a 6s/6s Plus?

Edit: I read the TFA, which says 11 and up.

I certainly hope so!

"They do yearly updates, the 2022 doc will very likely have more information."

Sure you document such stuff before releasing it?

> Sure you document such stuff before releasing it?

Uuuhh so, bad news. Basically nobody ever does that. Since agile, everyone seems to just iterate like mad, release, then document after release if you have time.

I'm as guilty of this as everyone else.

>Sure you document such stuff before releasing it?

These are all likely documented internally - the process of cleaning it up is probably something they only care to do once a year. Very little of this affects most developers, and the stuff that does is available in the dev docs.

Apple doesn't even always document stuff after releasing it.

> I’ll be pretty shocked if I’m “spied on” with this style of device.

A few days ago I was trying to figure out what an AirTag is, so I read the Apple website. They claim that ordinary people don't need to worry about being tracked, because users who are travelling with an AirTag that is not theirs will have an alert sent their iPhone.

This raises three questions which were conveniently elided on Apple's website:

1. What prevents people from using AirTags to track Android users?

2. How does the notification balance false positives, true positives, and notification fatigue in the situations where "someone next to me on the bus leaves an AirTag behind." How is it distinguishable from "someone snuck one into my pocket on the bus"?

3. Under what circumstances will Apple be willing to suppress the notification that one is being tracked by an AirTag?

1. Apple announced that they will release an App for Android that detects when an AirTag travels with you. I don't think it has been released yet, so currently, nothing prevents you from tracking Android users.

2. The iPhone can detect the distance to the AirTag quite precisely. I think this type of false positive is going to be rare enough for notification fatigue not being a problem. In your bus example, reporting the false positive would be fine imo. (It would also allow you to return the air tag to the owner).

3. The notifications don't go through Apple's servers, so Apple would need a backdoor in the OS to disable the feature. They might have added something like this, but it might not matter much - if someone plants a tracking device on you, they'll use one without silly privacy features.

>1. What prevents people from using AirTags to track Android users?

AirTags are BLE beacons, that Android phones will simply not pick up and not send their signal to the mothership. A background noise.

You're missing the point.

If an Android user is travelling with an AirTag other people (e.g. a colleague) with iPhones will "send the signal to the motherships" but they won't get the alert as they most likely won't be in proximity of the AirTag long enough to trigger it.

Ah, right, thanks. Missed that

Why are you so worried about expensive AirTags being used to track people? There’s a market full of cheap tracking devices to slip in someone’s pocket and they come with no privacy protection at all.

> I’ll be pretty shocked if I’m “spied on” with this style of device.

Why? There's plenty of devices in the wild constantly looking for wifi connection attempts, BLE Scans. Even cellular provider track locations in real-time by logging what cell towers you're using and associated signal strength.

Just search for a place in google maps, and note the "Popular Times". How do you think they got that data :D

> Even cellular provider track locations in real-time by logging what cell towers you're using and associated signal strength.

They also sell that data, and until about 3 years ago, anyone could access it FOR FREE! :D

https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...

The protocol they use explicitly protects against this attack vector.

Details of the rotating key used so that persistent tracking based off of the BLE beacon isn’t possible: https://www.wired.com/story/apple-find-my-cryptography-bluet...

Um they get that data from being a monopoly and knowing when most people are looking up directions to or information about a location.

Sure, they might do some other stuff to expand the data but there's much more relevant data right in their first-party domain.

No, they definitely read your location on your phone and "place you there". It has nothing to do with active actions made by yourself.

The same way traffic readings are done, not by cars, but by people in cars with phones.

Apart from what my sibling already said, think about it. How would searching for a restaurant correlate with "popular times"? Not much really. Would be all over the place. I search for the restaurant 3 days in advance at 10 in the morning but I'll be there Saturday night at 8, just like many other people. And at 10 in the morning the restaurant was still closed.

> This seems to be implemented as a Bluetooth LE app running on the ultra-low power “always on processor” used for a variety of features, like “wake-up on motion.”

Which, presumably, mere mortal developers have no access to?

Sigh. Again.

> Which, presumably, mere mortal developers have no access to?

I sure hope not, since "mortal developers" include countless bad actors. Apple has an imperfect record, but at least has a vested interest in avoiding abuse.

yea I remember years ago Qualcomm was working on an "always on" BLE chip. Use cases they promoted was a 24/7 tracking for ad placements. With privacy concerns back then I thought that would never get approval yet here we are now.

Just a simple question. Do you believe in freedom of speech? In freedom of the press? If yes, why do you think it would be shocking if you are spied on?

You are being spied on at this moment. So what are you going to do?

We’ve just got a different interpretation of what I wrote. Of course my data and location is tracked all the time - it’s an endless stream. I was referring the thought I’d have if I was to become aware that my Bluetooth signal of my “powered off” iphone was the data source used to spy on me. There are plenty of easier ways to do it… and my phone is usually powered on.