Apple holds the master key when it comes to iCloud security, privacy

Status
Not open for further replies.
While your iCloud data is relatively safe from hackers, Apple has a master key to everything on its servers. This makes iCloud less than ideal for enterprise users and those wary of law enforcement, but security experts do have recommendations to help improve user privacy.

<a href='http://meincmagazine.com/apple/news/2012/04/apple-holds-the-master-key-when-it-comes-to-icloud-security-privacy.ars'>Read the whole story</a>
 

TheWerewolf

Ars Scholae Palatinae
1,457
Another reason I don't like 'cloud services' that I can't configure or structure.

I understand why Apple does this - from a legal liability perspective it makes sense - but people have to understand that these legal requirements are going to be the norm. If you use someone else's service, and as noted by others, a service that intentionally makes it hard to control your own data, you'll have to live with what you get.

Put up your own servers though (and this can be as simple as getting a cheap box, a domain name and sticking it on your home internet) and now you can control what's going on. It's still a cloud, but it's YOUR cloud...
 
Upvote
0 (0 / 0)

Sphynx

Ars Tribunus Militum
2,060
Stubabe":pmyxi1c4 said:
What the hell is the point of syncing data for backup and distribution if you keep the decryption keys on one machine? Same for the PKI suggestion in the article: no private key = no access so you now need to sync that to your other "devices" and where do you back that up anyway?
The only thing that works well is password based encryption on the client, but people are v. bad at generating secure passwords so we need lots of key hardening (e.g. with PBKDF2) which is slow on the gutless CPUs you find in smartphones. Of course, you can use a memory hard KDF instead but the only one I have seen for public release is scrypt, but personally I felt they took too many liberties with the Salsa20 core to trust it...

Admittedly that is somewhat of an Achilles heel. I.e. it's why Spideroak & Wuala mobile apps currently (as far as I know) only allow to view your data. Although I think Wuala was working on improving this situation. Personally it's a non-issue for me as I only use these systems when i'm working on a PC with the native client installed. Although with Wuala, it can set up a pseudo-drive that you can use via drag and drop in windows explorer if you want.
 
Upvote
0 (0 / 0)
"In a symmetric encryption system, there's always a back door. There's always the chance, however remote, that some rogue employee could use the master key to decrypt and access your data."

..I work for a financial services company. we are obligated to keep the "keys to the house" around because we are federally regulated.. If for example DHS asked us to do something, we have to be able to do it (investigate money laundering for terrorists, etc).. one of the services we offer is a "digital vault" where we keep your tax returns, legal documents, etc.

certain passwords (root level) and keys are written down, and locked in a double custody vault that uses biometrics for access.. this level of security is also mandated by the fed. so no single person can see anything.. it' takes at least 2. never mind just getting physical access to the vault itself. wouldn't be surprised if apple kept the keys secured in a similar manner.
 
Upvote
0 (0 / 0)

grahamwilliams

Ars Scholae Palatinae
974
jbrodkin":17qp8hbc said:
grahamwilliams":17qp8hbc said:
Is this article Anti-Apple? I don't think so, it's informative, nothing more.

quite informative!

Indeed, I didn't mean to suggest that the article wasn't valuable, merely that it wasn't written (in my opinion) to be inflammatory. Apologies for the awkward phrasing.
 
Upvote
0 (0 / 0)
monkeyrun":vs0of8qm said:
gmerrick":vs0of8qm said:
With Apple, it looks like your data is private if they feel like it, or if the feds don't come knocking and ask to look at it. Apple should not hold master decryption keys, and users should be able to ensure that they data they send to and store in any cloud is encrypted with a system that does not allow prying.
how do you create en encryption system where no one holds the decryption key. :D

It's not that no-one needs the key. It's that apple simply does not need to have a master key. I should be able to secure my data using standard SSL keys and a password, and not have to worry that Apple is gonna start going thu my stuff.
 
Upvote
0 (0 / 0)

AaronInGP

Ars Tribunus Militum
1,694
Aunty Technica":o3xo9shq said:
Apple is locking us all into its walled garden, while keeping a key for itself and the feds.

George Orwell's predictions have come true.

Wow, I hadn't realized that you were forced to use Apple products; or that even if you choose to, you are forced to use iCloud.

Learn something new here every day!


PS: OK, seriously, and as an aside, does anyone know of a resource on the net, or a book, that explains encryption starting from scratch? I'm basically looking for an "Encryption for Dummies" type of thing, if that makes sense. Thanks in advance.
 
Upvote
0 (0 / 0)
The article seems to be implying that if you want to use a web browser based interface you have to let the server see the data in the clear.

How difficult would it be to have a client side control in the browser that takes a user entered pass phrase, generate the appropriate length key, encrypt the data with the symmetric key algorithm of your choice and then submit the data? And does the reverse when you want access.

Failing that you could get the UI layer of the server side to do it and then discard the key - at least then the only way to get at the data is to to get the key off the user, or to brute force the pass phrase.

There is a solution. The question is whether there is a desire for one. This and the MegaUpload case is proof enough for me that I won't store sensitive data on US servers. If I did, I would make damn sure it was encrypted before it left my machine.
 
Upvote
0 (0 / 0)

lazycs

Smack-Fu Master, in training
59
Suggesting that using public key encryption (never called 'PKI encryption' -- please look up acronyms before using them) is better than symmetric key encryption for storage in a data center leads me to believe that Gulri isn't qualified to make statements regarding security. The assertion that public key encryption (PKE) is better than symmetric key encryption (SKE) is a fallacy of security. Each has its use.

In both cases (at least the way Gulri described it), the data center operator has the key needed to decrypt the data, regardless of whether that is the private key or the shared symmetric key. The difference is that with a symmetric key, the person encrypting the data can *also* decrypt the data. Perhaps Gulri thought this is a security flaw, although it's obvious that the person/device encrypting the data has access to the unencrypted data anyway.

Furthermore, the data is encrypted twice before it's stored in just about any reasonable implementation. It's encrypted the first time as it travels over the Internet. Most implementations use TLS (the successor to SSL), which takes advantage of PKI to verify the identify of the server and generate encryption keys, but actually uses a symmetric cipher for data transfer.

Once the data is decrypted on the server, it is then encrypted again using a new method such as symmetric key encryption and stored on disk. If we were using PKE, this would mean that the server saving your backups wouldn't be allowed to read the backups already stored on disk. If you thought the server saving the backups were more likely than the one reading them to get hacked, then PKE would have a slight advantage. Keep in mind that this would also prevent that server from storing partial backups or 'deltas' since it wouldn't know what is already stored.

It also doesn't matter at all for 'the privacy and security of each individual user' if the server uses PKE or SKE to store the data on disk since a different key pair or key is going to be used for each user anyway.

So when is PKE useful? When you want someone to be able to send you something securely without having to exchange keys ahead of time. Let's say I want anyone to be able to send me documents that only I can open. I can post my public key in a location that people trust, and they can use it to encrypt documents to send to me, even if I never communicated with them before. With symmetric key encryption, I would have to arrange a way to exchange a new shared key with every sender. There are, of course, many other use cases, but they almost all involve being able to communicate securely with people you've never communicated with before.

Finally, I have no idea what S/MIME has to do with the security of cloud services. S/MIME is a great technology that relies on PKE to send emails securely from one person to another, even if you don't trust any of the mail servers. It also makes sure that even if those emails are stored on a server somewhere, only the intended recipient can decrypt it. This technology applies to any email platform though, and really has no more to do with iCloud any more than it has to do with Hotmail, Exchange, or any other email platform.
 
Upvote
1 (1 / 0)

lazycs

Smack-Fu Master, in training
59
a_v_s":15plkskv said:
Ostracus":15plkskv said:
Is there any encryption that works with deltas?

The encryption itself wouldn't allow that. If you can inspect two encrypted files, and be able to determine that one of them has a delta with the other, then the encryption was really shoddy... Ideally one should not be able to differentiate an encrypted file from random garbage.

Actually, given certain constraints, this *is* possible. Take a look at homomorphic encryption functions.

a_v_s":15plkskv said:
However, you could devise a system where you didn't use the online storage locker to store "files", but to store blocks, then you simply update the online storage with updated encrypted blocks, and the system manages what blocks belong to what file and such. Something like having a block table as one of the files to organize which blocks belong with which file. Then you could design a system to sync updates with encrypted blocks...

And yes, I filed a patent on this many moons ago :p

This sounds essentially like a standard block cipher without the chaining to me. This is much less secure than a standard block cipher and could give away information about the contents.
 
Upvote
0 (0 / 0)

PeterWimsey

Ars Tribunus Militum
1,803
Aunty Technica":29s5qaec said:
Apple is locking us all into its walled garden, while keeping a key for itself and the feds.

George Orwell's predictions have come true.

I was going to say that this would have been a better point if you had actually read Orwell. But, no, because this has nothing to do with Orwell at all.
 
Upvote
0 (0 / 0)

Abhi Beckert

Ars Tribunus Angusticlavius
8,981
Of course they have the encryption key. I want them to have the encryption key.

If they can't decrypt it, and I forget my password, then my data is GONE!

Any service with a "forgot password" feature needs to be able to decrypt your data, and if they can decrypt it then a court order can force them to do so.

If you want your data to be safe, you need to encrypt it yourself before uploading. And make sure you have multiple backups of your decryption key.

There is a market for services which aren't capable of decrypting your data (eg: LastPass), but they are not suitable for use by general consumers and even they usually have the option of storing the key on their server.
 
Upvote
0 (0 / 0)
Aunty Technica":3gfz94nh said:
Apple is locking us all into its walled garden, while keeping a key for itself and the feds.

George Orwell's predictions have come true.

I think I have to re-read my copy of 1984 because I forgot the part where it talked about the limitations of symmetric encryption in commercially hosted cloud services.

Oh, right, "George Orwell's predictions" is just synonymous for "things I don't like." Carry on then.
 
Upvote
0 (0 / 0)

SvnLyrBrto

Ars Scholae Palatinae
617
eJacqui":22fudzan said:
Francis Kuntz":22fudzan said:
Quite funny to see more and more article against Apple this days on Ars while Google is making a lot more crap about privacy and security than Apple...

I'm not sure what you're getting at here. You don't like it that we investigate questions that people have about the services they're using?

Apple, and only Apple, is being singled out and attacked over an issue that afflicts the vast majority of consumer-level cloud services.

Offhand, I can't think of any that do NOT have this problem, actually. And it's an issue with many enterprise-grade cloud providers as well. In fact, many cloud providers are significantly worse. They don't store your data encrypted at all. Data transfer is encrypted. But stored data is in plaintext.

So yeah. I'd say there are signs of an anti-Apple bias on at least the part of the author.
 
Upvote
0 (0 / 0)
jdw":1u8ekrn4 said:
eJacqui":1u8ekrn4 said:
I'm not sure what you're getting at here.

If you post things complementary to Apple, you will be castigated for giving Apple a pass where others don't get one.

If you post things critical of Apple, you will be castigated for hassling Apple when others are worse.

Welcome aboard the Kobayahsi Maru. It's your move.

Oh God yes. Thanks for the laugh. :)
 
Upvote
0 (0 / 0)
variable455":qgb37yox said:
"In a symmetric encryption system, there's always a back door. There's always the chance, however remote, that some rogue employee could use the master key to decrypt and access your data."

..I work for a financial services company. we are obligated to keep the "keys to the house" around because we are federally regulated.. If for example DHS asked us to do something, we have to be able to do it (investigate money laundering for terrorists, etc).. one of the services we offer is a "digital vault" where we keep your tax returns, legal documents, etc.

certain passwords (root level) and keys are written down, and locked in a double custody vault that uses biometrics for access.. this level of security is also mandated by the fed. so no single person can see anything.. it' takes at least 2. never mind just getting physical access to the vault itself. wouldn't be surprised if apple kept the keys secured in a similar manner.

Don't you think Apple knew them all? Apple didn't want other ways but their ways, the ways that open up a back door for the feds to snoop on the public. All options are off the table. Remember the latest MAC ID leaks on iPhone and iPhone 3 had some sort of security problem on data issues last year? The more I read about Apple's security the more it make me think Apple is up to something with the feds.

Welcome aboard the Kobayahsi Maru. It's your move.

There ain't no other move. A good journalist who have one agenda, it is to report the truth, regardless.
 
Upvote
0 (0 / 0)

ramuman

Wise, Aged Ars Veteran
189
I use iCloud and Amazon. Are the rules with cloud based services any different than they have been for e-mail and Facebook for years? Don't put anything out that you wouldn't want to end up on the front page of the newspaper (if those even exist anymore).

I think of both services as a convenient place to store low-priority information (which the vast majority of my data is). I'm not going to upload scans of my passport and credit card and then throw a hissy fit when iCloud gets hacked - I'll just wait for my bank to get hacked instead :).
 
Upvote
1 (1 / 0)

passivesmoking

Ars Tribunus Angusticlavius
8,594
Why is this news? I've always operated under the assumption that all clouds worked like that, that all cloud companies had the ability to access any data you stored with them regardless of encryption used. It's also one more reason why I don't intend to use cloud services if it's at all avoidable.

Back in the days of the mainframe, it used to be "Never trust a computer you can't kick". Perhaps now it should be "Never trust a storage device you can't thermite".
 
Upvote
0 (0 / 0)

uq1

Seniorius Lurkius
1
wizard69":auc2j0dm said:
here is the reality folks, if Apple didn't provide the capability to inspect data on their servers your friendly federal government would demand it anyways. Apple really has little choice here.

As to all the stupid worry warts concerned about this, why in hell would you put important data on somebody else's server anyways?

The solution is a service like http://www.wuala.com in which only the user has the decryption key. Wuala has the further advantage that the company and it's servers are located in Europe, where government agencies still have to GET WARRANTS to access private data, even if it's not encrypted.
 
Upvote
0 (0 / 0)

Riemann Zeta

Ars Scholae Palatinae
812
In this respect, Apple is no different than any other company offering an internet-related service--every single one of them, if based in the US, allows any of the three-letter fed agencies access to all data at all times, even without a warrant. The only way you can be sure that a symmetric-key encryption protocol provides genuine encryption without backdoors is to perform the encryption yourself with open-sourced algorithms and 256-bit keys.
 
Upvote
0 (0 / 0)

wytworm

Smack-Fu Master, in training
76
naphini":2y4dzas1 said:
Chozolore":2y4dzas1 said:
Wtf are you guys storing? And when do you propose to have a run in with the law?
In answer to both your questions:
Apple further says that it will review content reportedly in violation of copyright under DMCA statutes.

Photos, financial info, email, docs to share with family...doesn't really matter right? Private does not = illegal as you seem to imply. I for one, do not concede the right to privacy as a default as others seem to.

I propose to have a run in with the law every time they break the law.
 
Upvote
0 (0 / 0)

wytworm

Smack-Fu Master, in training
76
stanthegoomba":16ucex3d said:
Aunty Technica":16ucex3d said:
Apple is locking us all into its walled garden, while keeping a key for itself and the feds.

George Orwell's predictions have come true.

I think I have to re-read my copy of 1984 because I forgot the part where it talked about the limitations of symmetric encryption in commercially hosted cloud services.

Oh, right, "George Orwell's predictions" is just synonymous for "things I don't like." Carry on then.

'Nineteen Eighty-Four (first published in 1949) by George Orwell is a dystopian novel about Oceania, a society ruled by the oligarchical dictatorship of the Party. Life in the Oceanian province of Airstrip One is a world of perpetual war, pervasive government surveillance, and incessant public mind control, accomplished with a political system euphemistically named English Socialism (Ingsoc), which is administered by a privileged Inner Party elite.'

Yeah...don't see too much similar here...except for the part where we live in a dystopia.

...and the part about govt surveillance (this is the tie-in with cloud security (in case you missed it))...
 
Upvote
0 (0 / 0)

wytworm

Smack-Fu Master, in training
76
Neppe.Sant":1ffsv9ry said:
SpiderOak ( https://spideroak.com/ ) and Wuala ( http://www.wuala.com/ ) are both zero knowledge cloud storage providers.
I've used both, but personally I prefer Wuala's model.
They are both IOS compatible.

I like the idea, but both seem to be 'black-box' apps. How to ensure they are secure in that model?
 
Upvote
0 (0 / 0)
AaronInGP":3h57j099 said:
Aunty Technica":3h57j099 said:
Apple is locking us all into its walled garden, while keeping a key for itself and the feds.

George Orwell's predictions have come true.

Wow, I hadn't realized that you were forced to use Apple products; or that even if you choose to, you are forced to use iCloud.

Learn something new here every day!


PS: OK, seriously, and as an aside, does anyone know of a resource on the net, or a book, that explains encryption starting from scratch? I'm basically looking for an "Encryption for Dummies" type of thing, if that makes sense. Thanks in advance.

Not a book, but this might be what you want:
http://www.moserware.com/2009/09/stick- ... anced.html
 
Upvote
0 (0 / 0)
lazycs":rdfspe92 said:
Suggesting that using public key encryption (never called 'PKI encryption' -- please look up acronyms before using them)

Yeah I looked at this askew too. Looking into the article, the person being quoted is using the term correctly. PKI (public key infrastructure) is the digital certificate management that allows PKE to be trusted, whether it's a CA or some other centralized server. You can have PKE without PKI, but without PKI, PKE across the internet is impossible to verify as legit.

Paraphrasing by the article's author as "asymmetric PKI encryption" is just wrong. All PKIs are asymmetric, it's the whole point.
 
Upvote
0 (0 / 0)

X-AxSys

Ars Scholae Palatinae
1,131
Francis Kuntz":2u2aej0m said:
Quite funny to see more and more article against Apple this days on Ars while Google is making a lot more crap about privacy and security than Apple...

Francis, its all about the numbers and only a little about perception... Google: >90% of the world cares and maybe affected by. Apple <5% of the world cares and is affected by.
Public Perception:- Google: Friendly, Does no harm (they said so themselves, so it must be true), makes my home page work. Makes tons of money. Apple: Evil, Uncaring, Highly secretive (so must be bad and all-evil), Zealot-like and surrounded by insecure technology bigots who can't see past their own ipad screens that there are viable technology alternatives out there. Makes tons of money.
 
Upvote
0 (0 / 0)
I think the perception that this article is "anti-Apple" is an easy one to make. If you read it very carefully (and read the author's comments as well), it seems clear that wasn't the intention, but it still comes across that way to me.

The thing that makes this obvious are the (several) comments on the article about how some other service is "better" or that this kind of behaviour (keeping the key), is somehow "typical bad behaviour" from Apple. It's clear that these commenters are biased, but it's also clear that many people are reading the article and interpreting it as a big scary bad-news piece about Apple and Apple alone.

It would have been better to clearly lay out (more than the single offhanded mention anyway), that Apple's policy is at worst *identical* to the other companies, and in some ways actually better. There is no mention of the fact that Google's EULA actually says they will give the secret police access to your files whenever they are asked to, whereas Apple's kind of says they will only give access whenever they have to by law. That alone is a big difference and a big plus for iCloud.

Furthermore, it's really disingenuous of Ars in general to present this idea (that Apple can read your data), as some kind of unusual situation. Several times in the article we get scary quotes about how this data-reading might be possible, followed by some more boring, detailed info that implies that this is necessary and unavoidable anyway. Why gin up the fear with the quotes if there isn't really anything to be afraid of? Why make out even obliquely that this situation is somehow unusual or particular to Apple's service alone when it isn't?
 
Upvote
1 (1 / 0)

X-AxSys

Ars Scholae Palatinae
1,131
...PS: OK, seriously, and as an aside, does anyone know of a resource on the net, or a book, that explains encryption starting from scratch? I'm basically looking for an "Encryption for Dummies" type of thing, if that makes sense. Thanks in advance.

Also worth a look Steve Gibson of Gibson Research also Has/had a really good primer series on encryption. I think there were several Podcasts from Steve that were good simple Primers on on the subject.
 
Upvote
0 (0 / 0)
X-AxSys":qydowfd7 said:
...PS: OK, seriously, and as an aside, does anyone know of a resource on the net, or a book, that explains encryption starting from scratch? I'm basically looking for an "Encryption for Dummies" type of thing, if that makes sense. Thanks in advance.

Also worth a look Steve Gibson of Gibson Research also Has/had a really good primer series on encryption. I think there were several Podcasts from Steve that were good simple Primers on on the subject.

I'd recommend against Steve Gibson. He has a bad reputation for uhm.. simplifying things to the point of inaccuracy, to say it nicely. If the comic I linked above doesn't suffice, I'd actually recommend reading CISSP study guide material on cryptography. That's about as dumbed down as I've seen it without becoming irrelevant. (See, CISSP is good for SOMETHING :p)
 
Upvote
0 (0 / 0)

bettercitizens

Ars Scholae Palatinae
779
gmerrick":21023c49 said:
With Apple, it looks like your data is private if they feel like it, or if the feds don't come knocking and ask to look at it. Apple should not hold master decryption keys, and users should be able to ensure that they data they send to and store in any cloud is encrypted with a system that does not allow prying.

Not only the "feds" iCloud will be worldwide soon enough. What about Chinese dissidents? I guess that dissidents in general should not use these types of services.
 
Upvote
0 (0 / 0)

bettercitizens

Ars Scholae Palatinae
779
jnemesh":mhiep4nm said:
Dear Mr. Foresman,
As you are probably aware, it is never acceptable to use "Trust" and "Apple" in the same sentence.

It is "never" acceptable to give any credibility to people who use the terms never and/or all as used above because there usually are some cases that provide exception to the "never" and "all" usage.
 
Upvote
0 (0 / 0)

pm24601

Seniorius Lurkius
18
Those paranoid about their data being accessed by authorities

What a bunch of c*p! Doesn't Chris Foresman read Ars Technica?

Paranoid: Unreasonably or obsessively anxious, suspicious, or mistrustful

A person is not being paranoid when there IS a REASONABLE reason to be suspicious!

Chris should do these searches on ARSTECHNICA's own website:

National Security Letters :
https://www.google.com/search?q=Nationa ... chnica.com

warrantless :
https://www.google.com/search?q=warrant ... chnica.com

EFF version:
https://www.google.com/search?q=warrent ... %3Aeff.org

YOU are not being paranoid if someone really is out to get you. With these broad sweeps of data, it doesn't require a suspicious mind to be concerned.

Maybe reading http://jonathanturley.org/ would help as well. But Chris should start with the dictionary and use the word "paranoid" correctly.
 
Upvote
0 (0 / 0)
foresmac108":2js2emt0 said:
a_v_s":2js2emt0 said:
Nothing to see here... When I was doing research a while back for my company, I found that almost all of the online storage providers *do not* encrypt data on their hard drives. They only secure the transport. I found that the reasoning for this was to be able to index the content, to allow the user to be able to search/sift/etc through their online content... If all the data as encrypted, none of this would have been possible, because it would have been a black box. When I talked to the providers they assured me that physical access to the drives is secure, as well as electronic access. But the data itself was stored in the clear.
This was also stated in the article.

That's why most IT folks I talk to, usually require some sort of encryption *before* the data hits the online storage locker.
Agreed, but for the most part that is NOT an option for iCloud. All the data uploading/downloading is handled by Apple's software or APIs. There's no way to encrypt your contacts before uploading them to iCloud, nor is there a way to decrypt them once you have them. As it currently stands, there's no way for iCloud to work the way it does encrypting files this way.


But, so long as they're not transmitted i plain text (the stream to icloud is encrypted), what's in your contacts that you care about on matters of security? PII does not apply to the same standards as PCI or PHI or other private data. So long as apple only accesses your information on request of law enforcement, with warrant in hand, and cannot simply data mine your contacts, what's in your contacts you don't want cops to have??? Shit half of them are probably listed in your facebook profile open to the whole world to see...
 
Upvote
0 (0 / 0)
pm24601":1ky4s3ky said:
Those paranoid about their data being accessed by authorities

What a bunch of c*p! Doesn't Chris Foresman read Ars Technica?

Paranoid: Unreasonably or obsessively anxious, suspicious, or mistrustful

A person is not being paranoid when there IS a REASONABLE reason to be suspicious!

Chris should do these searches on ARSTECHNICA's own website:

National Security Letters :
https://www.google.com/search?q=Nationa ... chnica.com

warrantless :
https://www.google.com/search?q=warrant ... chnica.com

EFF version:
https://www.google.com/search?q=warrent ... %3Aeff.org

YOU are not being paranoid if someone really is out to get you. With these broad sweeps of data, it doesn't require a suspicious mind to be concerned.

Maybe reading http://jonathanturley.org/ would help as well. But Chris should start with the dictionary and use the word "paranoid" correctly.


OK, so you linked to a bunch of places that show what powers the government has, and that some of that information was supposed to be secret (or at least not openly shared). Now show me one pience of evidence where these powers have been openly abused, and where this abuse is ongoing. If you can find abuse, I'll likely be able to find the suit from the person back to the government where a massive amount of money was exchanged in repayment of that abuse.

More over, most of what you liked to is on matters of national security, and can;t be used against Us citizens, and even when it can be, there must STILL be due process. Due process is actually more powerful than a warrant, since all a warant boils down to is approval of evidence before it is collected, but if evidence IS collected without a warrant, it is subject to due process review and can STILL be refused access in a court of law. Without an open case file and formal investigation, you really think the NSA or FBI is going to send a letter to apple asking for your contacts (half of which you probably list in a PUBLICALLY accessdibly social page), or your calendar, or your safari favorites???

Here's another fact about warants for you. When one is requested, do you know how often theyr;e refused? Have you ever even SEEN a warrant? Do you know what happens to a judge if they refuse to sign one validly filled out? It;s one long piece of paper, 3-5 sheets of carbon, and asks a few VERY simple questions. They;re so rarely refused, it typically makes natinoal news when they are. Its a fucking rubber stamp process. DUE Process is what protects people, NOT warrants. Warrants just make an extra step in that process to prevent the abuses of LOCAL authorities and those unfamiliar with proper due process. Its a checksum, not a roadblock.

If the NSA feels your data is worthy, they WILL get a warrant. Nothing is stoping them except having a CASE you are associated with that makes you worthy of invesitgation. If they get it under false pretenses, with or without a warant the judge can still dismiss the evidence, charges, or entire case. If that fails, you APPEAL. And if you;re a little guy, the EFF would LOVE to help... You have nothing to fear unless you actually did something illegal. If you did, maybe you should not have documented it...
 
Upvote
0 (0 / 0)

bettercitizens

Ars Scholae Palatinae
779
AaronInGP":3593kwi6 said:
Aunty Technica":3593kwi6 said:
Apple is locking us all into its walled garden, while keeping a key for itself and the feds.

George Orwell's predictions have come true.

Wow, I hadn't realized that you were forced to use Apple products; or that even if you choose to, you are forced to use iCloud.

Learn something new here every day!


PS: OK, seriously, and as an aside, does anyone know of a resource on the net, or a book, that explains encryption starting from scratch? I'm basically looking for an "Encryption for Dummies" type of thing, if that makes sense. Thanks in advance.

Aunty must have had John Sculley's "trode" implanted - NOW Apple controls Aunty...
 
Upvote
0 (0 / 0)
Status
Not open for further replies.