Apple has even threatened to withdraw their own systems from the UK rather than comply with this.
https://9to5mac.com/2023/07/20/apple-imessage-facetime-remov...
Apple used to be able to access iMessages through iCloud backups. They changed their system worldwide, now they can’t. So presumably GCBD also lost access to iMessages in iCloud backups.
Even if you turn it (e2ee iCloud Backup) on, it's ineffective, as both parties to a conversation must have turned it on for the conversation to be private.
Your beliefs are inaccurate.
I don't see any option to enable e2ee iCloud Backup on iOS 16.6, does this mean your information is outdated and it's all e2ee now?
It’s off by default.
I wonder. Is this an attempt to market? Make it optional, but tout "we do this!', as if it is?
It's not a bad marketing position.
You the have the same level of privacy (if not higher) than with ADP. But with the same drawback, if your recipient does backup to iCloud without ADP then messages can be intercept by apple at rest on your recipient iCloud backup.
Incidentally ADP mainly target users that didn't trusted iCloud backup for the lack of e2e encryption at rest.
The optional iCloud feature called "Advanced Data Protection" is currently an opt-in. It comes with a significant drawback for typical pop and mom users --> If you lost you password and recovery key it's game over you loose everything. So I guess it's sensible to keep this as an opt-in until users are better educated about this drawback.
What will be quite significant is wether or not this feature will be available for chinese users.
It make sense from a technical POV to block ADP feature in poorly democratic countries that might request it like China and maybe tomorrow the UK.
PS : Once a significant % of users activated ADP it could be a good UX improvement to display a warning to mixed ADP status conversation that the conversation is not fully e2e encrypted. However this might be premature right now otherwise early adopters of ADP would be flooded by such warning.
If iCloud is enabled, then by default it gets unencrypted copies of these messages from the device unless “advanced data protection” is also enabled which ensures iMessage is encrypted but means losing your password also loses access to these backups. However, disabling iCloud sidesteps this issue and honestly if you want that kind of privacy then disabling iCloud is probably a good idea.
So lots of confusion in this thread, my advice for Apple would be make it very very clear to users that your data is safe. I mean they are threatening to back out of UK, so it’s against their core principles and also probably very technically expensive to undo they end to end encrypted system.
Also possible ADP is off as an option in China.
Of course this wouldn’t work for the UK system unless the UK demanded the iCloud keys same way as China has.
There was a rumor about separate HSMs for device personalization in China, and this would be verifiable by determining whether the Chinese HSMs could verify cryptograms produced by derived keys from a US device, against Apple's personalizaiton endpoints in china. I don't know the protocol off hand, but there is a short list of ways to do it. If Apple uses different root secrets in China from the rest of the world, what further evidence would you need?
Congress knows this would only kneecap one of their largest companies (with no fallback option at present). There is no iPhone without China.
Apple can and does already provide surveillance of this type domestically to FBI/DHS/et al. Approximately all iMessages are readable by Apple and extension by the USG in real-time, with or without a warrant.
There's wiggle room in what you wrote: "Apple doesn't allow China to intercept communications, China just does it on their own" for example is a way to parse that sentence.
Apple can say they don’t allow it, because their local partner company is the one actually doing it. And the local partner would say they don’t allow it, because Chinese law (and the Party) requires them to keep all national security assistance secret.
There's also no evidence to support the claim of this architecture, either.
Famous, sure.
Rich? Perhaps… but I suspect that annoying a superpower will mean that, like Snowden, one would be somewhat restricted in ability to make use of any such wealth or fame.
Apple makes 10x more selling in the Chinese market than they do in the United Kingdom, even with all of the roadblocks and handicaps China erects. Further Apple realizes that as the UK is a Western, democratic nation it is easy to essentially bargain about policies. Apple's current threats are essentially negotiating. There would be no negotiating with China about stuff like this.
It's really hard to be a credible "privacy/security" choice when your morals are plainly for sale...
Make no mistake - Apple traded their moral high-ground for a few bucks.
https://www.theregister.com/2023/07/27/prices_of_gallium_and...
Apple made a choice folks... and it was to sell out to an oppressive regime. There is no other way to see this.
Apple made a choice. It's really simple.
They could have not been a large scale electronics manufacturer, but then they don't operate in China by making an entirely different kind of choice to be an entirely different kind of company. I don't think any electronics manufacturer (or meta-manufacturer/designer/whatever/globalization is weird) within an order of magnitude of Apple's scale can practically operate without benefit of China's manufacturing base.
It feels like you have to bend the intuitive notion of "deciding" to operate in China even means for this to make sense and you just want to pin something on Apple here because they're a giant corporation, and all giant corporations are morally gray at best. The global economy has "decided" that China has the manufacturing base for this kind of business.
This doesn't seem productive in the way that appeals to personal responsibility fall flat in dealing with societal issues, like, we shouldn't have public drug treatment programs because people shouldn't do drugs. People do drugs, and there are costs to not having public treatment programs, so if you want to pretend it's just a matter of personal responsibility, you are indeed pretending, because it is also a societal problem not negated by framing it as personal responsibility.
Here, we assign "personal responsibility" to Apple for operating in China, when we have the "societal issue" of large scale electronics manufacturing centralizing there so that they have the industrial base for it. The world, on the whole, has allowed China to link into the world economy in this manner regardless of their humans rights record and other issues.
So, while there's nothing to love about Apple here, I feel like it's really missing the forest for the trees to frame this as an "Apple" issue in any sense whatsoever, but should be framed as a China-human-rights, globalization, and world economy issue, and we don't do ourselves any favors with appeals to "corporate personal responsibility"
And iPhones ceasing to be sold in the UK would probably be all it takes for public backlash to neuter the law. I imagine that's not on the table in China.
It's very difficult to square these two sentences together.
On one hand, if they break their privacy and security for the UK government, it's bad for business because they'll continue to sell iDevices and services?
On the other hand, if they break their privacy and security for the CCP, it's good for business because they'll continue to sell iDevices and services?
You're tacitly admitting my assertion - Apple's morals are for sale.
If the US threatened Apple, we can expect they'll sell out there too, no?
Yes.
China is much further from the Western world than the UK. Capitulation there isn’t a step onto the slippery slope. Doing the same thing in the UK would lead very quickly to EU and US demands to do the same.
By exiting such a small market, Apple defends the much larger markets against creeping surveillance.
Remember how fierce the backlash was to their CSAM scanning proposal? They walked that back. Some people might think it was for moral reasons, but I’m pretty sure they realized it would harm their bottom line.
The way things work in China is not the same as the UK. They either play by CCP rules or they don’t play at all. Apple’s calculus here seems to be that not playing in the UK market is worth it, whereas missing out on the Chinese market is not worth it.
Apple made a choice to operate there - and would have still been the world's most valued company regardless.
So, Apple's choice was to sell-out their privacy and security credentials to make more money - counting on their other large markets (ie. the US) not paying close enough attention to see the blatant hypocrisy.
"Security and privacy are great - unless we can make more money selling off your security and privacy to oppressive government regimes!"
Somehow that just doesn't have a catchy marketing ring to it...
So now there's precedent that Apple will violate everything they stand for if a large enough market demands it. What happens when the US government decides to place Apple in the crosshairs for not "helping catch terrorists" or something? Will Apple sell out too? Why not?
Without China, there is no iPhone, and there is no Apple. Apple, presently, needs to operate in China. They have them by the balls.
Compliance with CCP demands is non-optional.
This may change in the future. Today it is 100% true.
That seems incredibly dubious.
Who forced Apple to manufacturer iPhones in China?
Nobody.
It will take about five years optimistically to build that capability.
It's the effect of the monetary system squeezing the masses hard which forces everyone to buy the cheapest things and it created a kind of technological shrinkflationary race to the bottom.
In my mind, and definitely informed by my attraction to medieval Catholic philosophy, the problem isn’t really debt but rather usury.
I actually think that if it's one's own money, they should be allowed to loan it at any interest rate since they're taking the risk upon themselves. If they can find a willing borrower at such high rates, then good for them. If the borrower agrees to a bad deal, then it's the borrower's own fault.
What I most strongly oppose is the idea of public institutions loaning citizens' money through the issuance of new currency (which dilutes the value of previously issued money). It's especially harmful when the interest rate is low.
For example, if the interest rate is 0%, then it's unjust for a government institution to dilute citizen's currency and shift the risk of borrower default onto currency-holding citizens (savers) without offering any upside to those savers; in that case, the central banks turn regular citizens (savers) into suckers by loaning out their money for free for the benefit of reckless borrowers who borrow it for free.
Manufacturing consumer goods in the west was never unaffordable, just that insane corporates profits weren't possible while keeping manufacturing in the west, as they were in China.
A lot of consumer electronics were made in the west before the mass exodus to China. Nokia phones was made in Finland and Germany, Siemens phones were made in Germany, Ericsson phones were made in Sweden, etc.
It was all possible and they also didn't cost an rm and a leg, but companies saw the allure of ultracheap labor and loose environmental regulations in China to jack up their profits.
Check out the global battery supply chain
That's not dubious, that's obvious.
> Nobody
Ironically correct: the absence of alternatives — nobody else could do it — is what forced them in the first place.
The recent pressure from the US government to "bring it home" is because the US government finally started to realise that was both true and bad (doesn't matter if Huawei was really spying, Washington believed they were); similarly for equivalent EU pressure.
We have examples of this from previous attempts to weaken encryption. The FBI’s San Bernardino case being the most memorable one for me.
Apple could simultaneously backdoor their devices while also keep them secure from anyone but the government with a warrant. These things are not mutually exclusive.
The China precedent is troubling - to say the least.
When it happens, a company acting purely on someone’s moral code (usually a dictator CEO, though) sounds fine and reassuring. But on the contrary, this is unstable as you never know when that person will be sidelined, forced out, or realign their principles. At this point the company you trust can very well become an enemy. Just look at Twitter or Reddit.
On the long term, you need the company’s financial interests to be aligned with your (various) interests. This is the only thing that remains stable. Well, as long as nobody comes and make it private; then anything goes. It sucks, but that’s capitalism for you.
For the moment, Apple is mostly safe because basic privacy is their brand, and dropping it would be costly. This gives them leverage against some governments, but not so much against others. You can also count yourself lucky not to be born in China, but then there’s nothing Apple can do about that.
Don't know what universe or timeline you're from, but on this earth today, the internet definitely has borders.
That's why we have those EU cookie banners and GDPR consent forms, and why some of my favorite piracy websites are blocked by all ISPs in my country, or why I can't watch Top Gear on BBC's website because I'm not from the UK, or why Facebook had to remove some politically spicy content worldwide because the courts where I live forced them to, etc, etc.
Sure, there's VPNs, but the days of the lawless and borderless internet are a thing of the past. Mainstream web companies have to conform to local laws in each country or they'll get fined or blocked.
This argument tends to break down at The Great Firewall of China, however, due to its thoroughness.
If I create an E2E messaging app, I don't need to listen to the UK at all. The UK can't tell me what to do any more than China can. China can block my app if they want, but it's on them, not me, to block it. Same goes for the UK. They can set up a firewall too if they want. But I don't need to change my app if I don't set foot in the UK.
Telegram is half banned in Russia.
Of course this doesn't apply to the bad guys: they're already breaking the law, using E2E is a no-brainer for them.
The UK government can't ban math out of existence (even if it looks like they're trying very hard, judging from the quality of their education system) so there will always be encryption.
It's the same with guns: congratulations you've outlawed guns and now only criminals can use them.
So true: gun use and ownership in the UK rises and is mostly criminals. It's still less of a problem per capita than promiscuous gun ownership in the USA by all measures I understand.
This has nothing to do with the "war on encryption by the state" topic
In the UK, companies which protest this law are threatening to leave the market. That would mean blocking UK users on their properties, not helping them find ways to break the law.
Or, when you say "no boarders," do you mean that the internet is not zoned for residential use? Sorry if I misunderstood.
Surely china would fall under that statement from OP's perspective.
I disagree with this part. The EU is on that same path. The EU Great Firewall idea has been kicked around for years and it has even shown up in some policy suggestion documents.
I would describe the EU as wavering. Perhaps they'll do it, but it's far from certain.
It would be nice if the UK government used the ridiculous powers they gave themselves to hold Boris Johnson to account though.
But you could make the argument that it was largely due to Britain.
Of course most governments in the UK, like everywhere else (whether right or left wing) are, more or less secretly, authoritarian so they will be favourable to a great firewall when the right time comes.
The EU has been talking about it for some time and I'm sure they'll stick it together with some 600 pages policy nobody will bother reading at some point. https://diginomica.com/eu-policy-doc-recommends-building-eur...
They can't remove all our freedoms at once or people may lift their heads from their smartphones and protest.
We're being slowly boiled alive.
If the UK really cared about unelected government, why don't they get rid of their House of Lords? This would have been much less painful than Brexit. It looks a lot like this unelected government complaint is just an excuse and not something that they actually care about.
Fair point, but we haven't had a democratically elected Prime Minister for quite a while now, let alone the House of Lords!
The issue is whether the leaders of the commons should be able to appoint people to the upper chamber for life, whether the church should have a seat at the table etc. Or whether the upper chamber should be directly elected. It’s a matter of governance and constitution more than embedded privilege.
So as much as “Guillotine the nobs” would be a popular cry, most of them aren’t nobs in the first place.
French Revolution - 1789.
English Revolution - 1649.
So the English cut off their Monarch's head before the French did. But we them invited the Monarch's back after not liking the republic of the "Lord Protector".
Admittedly the English state, not the later British state, but anyway...
So instead, here's the simple truth.
The UK, in a surge of authoritarianism, cut its own balls off by leaving the EU (and the Civil rights it confers). It did this to appease fringe nutjobs and to make a pile of money for hedgies. Then it howled in pain and blamed the EU, even though the EU was against the chopping of the plums from the get-go.
The conditions for this bollockectomy were created by a barely-elected government, after the fall of which we have had, mainly, unelected government.
This entire manoeuvre was done under a screed of fractal dishonesty, in which scuttling little fibs decorate a structure of brassy falsehoods all stacked higgledy-piggledy on a giant whopper. Unwilling to accept the blame, the responsible parties continue to lie to this day.
In a parallel move completely unrelated to the above, the unelected UK government is ramping up surveillance. The EU has not done this, but the liars blame it anyway.
Serious question as a UK citizen who doesn’t live there anymore. Post-Brexit, leaving is surprisingly difficult despite the refrain of the morons who say “if you don’t like it go somewhere else”, blind or ignorant to the fact they removed that option.
https://www.theguardian.com/uk/2003/feb/15/politics.politica...
https://www.amnesty.org.uk/press-releases/uk-government-plan...
Perhaps you meant another democratic country where the idiot clowns hadn't taken over the circus ...
That's a sad reflection of the tech industry. Too much "we can't make money from them" and too little spitefulness of the sovereignty of foreign governments.
Why would the latter stop them? They have no problem with these.
>Any measures without broad international cooperation
Don't worry, other governments are just as shitty and want the same BS.
Kings respected it... when it was convenient.
And so the democracy they begat also only respects it... when it is convenient.
But freedom of speech when another permits it is no freedom at all, because the right's value increases precisely with its ability to stand up to other, more powerful interests' disagreement with speech.
Can you elaborate?
“It is hard to imagine a more stupid or more dangerous way of making decisions than by putting those decisions in the hands of people who pay no price for being wrong.” Thomas Sowell
I'm glad I was able to experience the true internet while it lasted. Truly a wonder of this world.
... which is why they continue to come for encryption.
Who would you rather be in the public eye, evil or stupid?
some background here.
the opposition in the UK is accusing the government of dragging their feet over this law, and are pushing them to adopt it sooner. they are also criticising the government for watering it down.
various NGOs are also attacking the government for watering it down and not moving as fast as possible.
basically the whole political spectrum is not only for this law, but wants it strengthened even further. there are also calls from the public for the government to go even further.
this is why there is no real backlash against this law. everyone no only wants it, but wants it to go a lot further than what the government has proposed.
They really are not. The current crop of UK politicians of all stripes are thick as they come - intellectual lightweights who can bullshit their way through a media appearance thanks only to an abject lack of shame. No one can look at people like Mark François, Liz Truss or Dianne Abbott (just to take three) and think “ah, there’s someone playing dumb for the camera”!
Unfortunately, the current crop of journalists are largely ineffective if not broadly enabling if this kind of behaviour, and politics is not a field anyone not already independently wealthy can afford to be in (a junior developer in the Bay Area can easily make more than the Prime Minister) so it does not seem likely to self-correct.
If it came to it, Whatsapp could be blocked at the network level. All the gov need to do is impose regulations that forbid ISPs and other infrastructure hosts to carry the traffic.
> such regional restrictions are easily bypassed and WhatsApp is popular enough to make people try it. So that would then normalise the practices such as side loading / jail breaking and avoiding regional restrictions.
If people would be doing this (using a VPN, for instance), they would know how to bypass those restrictions.
Breaking encryption is not good for anyone and won't solve absolutely any problems, except the "problem" of right to privacy.
Now you need to block VPNs, and the cat-and-mouse game gets in full action!
Also, at this point you've basically implemented the roots of a British version of The Great Firewall.
Yeah but it's never worried them much in the past. As a Brit I occasionally come across the effects of them requiring ISPs to block piracy sites. Something comes up saying "this site is blocked" so you click like one or two buttons to switch to a different connection or turn a VPN on (VeePN is good and free). I imagine their encryption ban will be similarly tricky to avoid. I think it's more about looking noble to the electors than actually achieving anything.
No borders (from their POV), puts internet businesses above the law... which it sort of does. The global village happened, but global authority did not. There are no clean resolutions to some of these tensions.
By the way, does a sideloaded WhatsApp on Android still update from the Play store? And what will iPhone owners do?
This is a security/law enforcement issue.
Any measures without broad international cooperation will push vast number of people towards darker corners of the internet, which will not just end up completely undermining what they are trying to achieve, it will make the problems worse.
Meta alone have the power to make this law a miserable failure. People will want to use WhatsApp, the government themselves use it extensively. If meta refuses there is very little they can do. Facebook can continue to operate without a single person on the ground in UK. It might harm their business in some ways but it's definitely doable. The government might be able to force/convince Apple and Google to take it out their app stores in the UK but such regional restrictions are easily bypassed and WhatsApp is popular enough to make people try it. So that would then normalise the practices such as side loading / jail breaking and avoiding regional restrictions. Cyber criminals would be rubbing their hands at the opportunities this creates and I am sure the peodos and terrorists this is meant to be stopping will jump at the chance to get in on the act.