What's disappointing is that Apple has zero accountability for any of these services. Nobody would be so critical of iCloud if it wasn't your only sync option on iPhone, but they force everything to go through them. Apple says 'trust us ;)' and gives the user no way to confirm that they're not decrypting your data as soon as it hits their servers.
The argument is the same as it's ever been. Apple took away too much of the user's control; if the iPhone were a more open platform, nobody would be squabbling over our only sync option.
Edit: Background Sync has apparently been available as an API since iOS 13, but that doesn't change Apple's lack of accountability wrt security practices.
My vpn is a Wireguard server (and some Tailscale, recently tested mullvad, works great as well), my position is updated to my family via Home Assistant, Bitwarden pops up automatically anywhere I need to enter a password. Podverse is great for podcasts.
Sure, it's a walled garden and I have my annoyances but much less so than I was led to believe before I got my first iPhone last year. I find it easy to swap out default components where I don't like them (like iCloud and Apple podcasts) and use them when they are superior (like the calendar and mail app, I was always trying 3rd party apps on Android).
Nextcloud app also exposed itself as file provider in Files.app, so it's possible to use it in place of iCloud Drive for apps that use the appropriate API. (Unfortunately most apps use CloudKit, which sync over iCloud.)
You’re welcome.
Other synchronisation like Joplin and Zotero happens via WebDAV. My iCloud is basically empty yet I have every file I could ever need on both iOS as well as iPadOS. Some apps I don’t care for sync via iCloud, that’s all so far. I’m not bought into the whole ecosystem (i.e. apps) too much though. If all you use are apps that only support iCloud, that’s a problem indeed.
there is also a free fork of davx5 on Play as OpenSync: https://play.google.com/store/apps/details?id=com.deependhul...
agree that it should be bundled in to the system though....
If you don't trust Apple, you should also not trust other cloud back up services. Just turn off iCloud
It's just moving the goalposts. If Apple gave you more control then people would demand that the source code for the chips be open source, or that you could stand over the shoulder of the person assembling your iPhone and make sure they don't plug in a USB drive and install some malware. It's a never-ending battle. You're just going to have to start trusting Apple and other companies, or build your own device from raw materials you mine yourself.
Your startup may be able to weaken or circumvent your controls and no one would know. But is not true of apple.
My Contacts and calendar can sync with any provider that supports whatever porn standards are behind it.
When I save and load files using the iOS file dialog, it shows every storage provider I have installed - Dropbox, OneDrive, iCloud Drive and I assume Box if I had it.
I sync my photos with Google Photos because they are a magnitude faster and more predictable than Apple's own Photos.
My passwords are in 1Password.
Can't really say I sync much else.
Apple couldn't take away what it never gave in the first place. Anyone using an IOS device should have a basic understanding that Apple highly integrates their devices, OSes and services.
Apple didn't took away anything. It wasn't there in the first place and never promised.
"moving the goalposts"?
Since when has closed source unverifiable crypto been a good idea? Since when has it been a good idea to trust a provider that fully controls the encryption algorithm to also be the only possible store for your supposedly encrypted data?
This is no better than Facebook claiming that Whatsapp is now "E2EE" encrypted. It's a useless PR tactic. If you mistrust Facebook, why would you suddenly trust their unverifiable claim that the data is now E2EE? You could have an argument if at least 3rd party clients were allowed, so that you could detect when they silently change the protocol. But not even that.
There's absolutely no _technical_ thing they could do to gain any trust. The goalpost has never been there.
> It's a useless PR tactic.
Maybe because a single whistleblower would bring down the mother of all class action lawsuits?
Hardcore anti-corporate types like to imagine that these companies are evil geniuses, where all 100,000 employees are operating in perfect alignment, with no mistakes or disagreements, and all secrets are kept perfectly.
It just doesn't work like that. Threat model it for a second: how many more phones is Apple going to sell with this? Maybe a 1% increase, to wildly overestimate it? And what would be the financial harm from a single engineer popping on HN and saying "it's all BS, phones send the keys to the cloud, I worked on the system to store them."?
> There's absolutely no _technical_ thing they could do to gain any trust.
Well, that's true. But there's also no non-technical thing they could do. It is literally impossible to prove perfect technical compliance on an ongoing basis using any combination of technical and non-technical means.
That goes for open source too. Evil compilers, etc, can turn perfectly solid source into malicious binaries. The compiler's source can even be perfectly secure.
At some point you have to think about probabilities and motivations, and move away from this "anything not 100% perfect, which BTW is not possible, is 100% useless" world view.
Sure, like that is going to happen. I mean, "Facebook can read your supposedly-encrypted Whatsapp messages" will raise how many eyebrows exactly?
> But there's also no non-technical thing they could do
No, that's untrue. For starters, release the source. Allow me to run my own backup software on their servers. Allow me to transparently run my own encryption before I upload stuff to their servers. And a very long etc.
> anything not 100% perfect, which BTW is not possible, is 100% useless
This is 100% useless not because it is not 100% perfect (it very well could be), but because it is 100% useless by conception. What threat model does this protect against exactly? The scenario where Apple servers get compromised? I'm quite sure this risk does not even enter the mind of the target audience here, and if it did, the hacker could very well push the silent update anyway. The scenario where Apple itself has access to the data? This does absolutely nothing to prevent it. The scenario where someone can social engineer an Apple employee to give your iCloud key to someone else? It was already not possible.
Two big threats: 1) insider attacks like the Saudi Twitter infiltration[0], and 2) Overreach by legitimate government process like subpoena[1].
> release the source
Useless. How do you know it's the exact source running on-device?
> Allow me to run my own backup software on their servers
Useless. How do you know your own backup software isn't compromised via a secret deal with Apple?
> Allow me to transparently run my own encryption before I upload stuff to their servers.
Useless. How do you know the OS isn't grabbing the raw files? How do you know your own encryption isn't compromised? How do you know that Xcode isn't inserting backdoors in the encryption you compiled from source?
> And a very long etc.
All useless. Tell me your perfect solution and I promise I can show it's useless (by your standards).
[0] https://en.wikipedia.org/wiki/Saudi_infiltration_of_Twitter
[1] https://ijunkie.com/your-icloud-data-phenomenal-law-enforcem...
This does not prevent any of these threats, it does not even necessarily make them more difficult whatsoever. "Insiders" will still have access to the source code doing the encryption and communications, and it is just not possible to protect against government overreach that can literally force you to do anything and keep quiet about it, even in otherwise relative sane countries. Search for NSA letter.
I actually don't expect any corporation to be above the government, fwiw, but this is off-topic.
> Useless. How do you know it's the exact source running on-device?
Because you built it yourself?
> Useless. How do you know your own backup software isn't compromised via a secret deal with Apple?
Because it's YOUR OWN backup software?
> Useless. How do you know the OS isn't grabbing the raw files? How do you know your own encryption isn't compromised? How do you know that Xcode isn't inserting backdoors in the encryption you compiled from source?
Because I have the source of the OS and I built it myself? Because I have literally used the same compiler I use for other platforms and not Facebook's? Because I can then actually monitor the actual communications between the device and the mothership? etc. etc.
The point of this entire thing was to show that _there is_ non-technical policies they can do to actually increase the trust level (or at least have a discussion about it -- as you are), but there is very few technical stuff they can do to increase it, and that's because it would miss the entire point. It's not about "trusting trust perfection" or whatever you think you are trying to argue here. You are trying to protect stuff from Alice by trusting Alice without even being capable of verifying it. It just can't academically work. You need to either be able to verify it or at the very minimum separate both roles.
There you go again :)
You literally just said something that used to take a subpoena from any law enforcement now takes an NSA letter. And that an insider attack that used to mean retrieving a backup file now means inserting back doors in source code that go undetected.
And somehow those aren't even more difficult?
> Because I have literally used the same compiler I use for other platforms
https://www.awelm.com/posts/evil-compiler/
It is literally provable that Apple will never be able to satisfy you. For any mitigation they introduce, you can (rightfully) create a hole in that mitigation.
What you're missing is that the same flaws and attacks appear in all of your "it would be better if" solutions. Once you're invoking NSA letters and malicious source code, all bets are off... including for open source.
> It just can't academically work.
Yes, we agree on that. But it also doesn't work if you're protecting stuff from Alice by trusting Bob, who might be secretly an agent of Alice.
I didn't say that. You said "overreaching government".
> It is literally provable that Apple will never be able to satisfy you
Nothing _technical_, that is, which has exactly been my point.
> Once you're invoking NSA letters and malicious source code, all bets are off... including for open source.
That's not true at all. There's an entire world of difference where "oh the software is just hidden from my eyes, communicating constantly and opaquely with the mothership, changeable at any moment by the same mothership, and all of it running in the same hardware also made by the same mothership" versus "I have these separate components that are only communicating through these channels in these clearly specified ways". The first only allows useless technobabble fake solutions, the second system actually allows discussion about trust and is usually the very minimum expectation of any cryptosystem.
> But it also doesn't work if you're protecting stuff from Alice by trusting Bob, who might be secretly an agent of Alice.
I don't see that as necessarily true either. But anyway, I can now choose between multiple providers for encryption, which _finally_ goes towards measurably increasing trust. Remember, despite the accusations, I have never claimed it had to be 100% trusting trust perfect, I am just claiming this one proposal is 100% useless. If you didn't trust Apple backups before and you would now, I'd question your judgement.
Something like hacking into a journalist's phone would require a lot of cooperation between infrastructure, software, and security to actually perform a targeted attack.
Despite Apple's harsh warnings about leaking secrets, people at Apple have already been spilling the beans about Apple's upcoming Ad platform for over a year, and that's just for something as morally grey as ads that they're going to spin as "privacy preserving" anyways. For something that actually goes against <everything> Apple has ever stood for, like targeting a journalist's phone to read their communications or extract data and secret keys from their advanced protection-protected iCloud Backups, at least one of the hundred involved would find a comfy bunker to live in with a phone line leading straight to News Corp or NYT.
Really having a hard time understanding the detailed security implications of your scenario beyond this vague notion you're presenting that a theoretical hacker can use theoretical tools to silently pwn any Apple device collected to the internet at any time.
A malicious actor who can access _already encrypted_ data storage where you cannot even associate files with a given account ID _without_ having already put a backdoor in the corresponding code may be able to actually put such backdoor in the software that is distributed to iPhones? Yes, I believe that.
As for your actual argument, there are always tradeoffs when we implement "good" but not "perfect" encryption solutions. Here, your trust is indeed in Apple to not perform an evil maid attack, but for many of us, we trust that Apple doing this to a regular person (or journalist, or government official) would be absolutely devastating to their entire brand. Even if most people wouldn't care if Apple cooperated with the CIA to perform a coup in $x country via sending out targeted malware to the leader's phone, they still stand to lose hundreds of billions of, if not a trillion, dollars over the following decade in lost iOS product sales, due to them purposefully hacking their own product to steal user data.
Yes!
> It's not like these changes solve the problem.
Perhaps because it is impossible to 100% solve the problem?
A lot of people, me included, are just tired of the endless litany of "50% secure is not secure! 75% secure is not secure! 90% secure is not secure! 99% secure is not secure! 99.9% secure is not secure! 99.999% secure is not secure!"
There is no 100%. Hearing the same level of outrage over a 0.001% gap that we heard over a 50% gap is just fatiguing.
Especially in this audience, everyone knows there is no such thing as verifiable perfect security. Asymptotic progress towards that is interesting; decrying the latest improvement as no better than no security at all just feels... IDK, lazy.
I find Matthew Green's take more useful than just about anything in this thread - someone who's very critical of Apple but able to articulate why this is overall net good:
https://twitter.com/matthew_d_green/status/16005676040154972...
But why does Apple want to be the only administrator on your device?
Note: "Apple Kills Its Plan To Scan Your Photos for CSAM"
> what good is that encryption, if Apple obviously can do almost anything with your device?
> They can still simply push a software update that sends the victim's keys to the mothership and/or simply decrypts everything
> This all just seems like pandering while they continue to accept billions from Google in exchange for their user's privacy.
> Couldn’t they simply use an encryption algorithm that has two private keys and they control one?
Apple could say they are going to cease operations tomorrow, close down the company, and people would comment "Yeah but they could always create a new company". I guess for those people nothing is ever enough.
This is a huge step forward (specifically iCloud E2EE) that I'm super excited about and people are busy coming up with threat models that 99% of us have zero use for and pretending as if this doesn't matter. It's disappointing.