Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Device Analytics Contain Identifying iCloud User Data, Claim Security Researchers

Unregistered 4U said:
Security through obscurity is what keeps your car and your living area secure. Just the simple fact that the way to open your house and car are available BUT kept hidden by you is a powerful enough to not require much else.
Click to expand...
Ok, fair point :)

What I really mean, is that we all have to trust Apple when they say that they are doing the best for us. But we have to take their word for it. I'd at least like to see some independent auditing of this, as as I said, I'm starting not to believe them always.
 
  • Like
Reactions: Unregistered 4U
bluecoast said:
Ok, fair point :)

What I really mean, is that we all have to trust Apple when they say that they are doing the best for us. But we have to take their word for it. I'd at least like to see some independent auditing of this, as as I said, I'm starting not to believe them always.
Click to expand...
But, if someone saw independent auditing of it, how could they be sure that the auditing was really independent? The fact that they could come to the conclusion that Apple is truthful COULD be because Apple’s being truthful, BUT it COULD be that the independent auditing was not really independent. Then, you’d need to have an independent audit of the auditor… but who’s to say that auditing companies don’t just stick up for each other. So, then there would have to be an audit done by an auditor that’s outside the control of Big Audit. But, if they come up with the result that everything is as Apple says, it may be that Apple’s being truthful, OOOOOR it could be that that company was just not good auditors, etc. etc.

If anyone doesn’t trust Apple, there’s no amount of documentation, auditing, or anything else that could “prove” to them that Apple is trustworthy. It would all be suspect. Apple does have a business and legal needs to be truthful about what they’re doing in these areas, though. Random “security researchers” looking for internet clout don’t have such needs. Before I’d be really concerned about what the researcher is saying about Apple, I’d look into the researcher to determine how they benefit. It could be a simple matter of “I like fame and recognition and here’s one way I can get it!”
 
  • Like
Reactions: steve09090
I just went and double-checked this was turned off on all my devices. It got turned back on on (2) of them (maybe in an update?).

Thanks for the reminder!
 
Unregistered 4U said:
But, if someone saw independent auditing of it, how could they be sure that the auditing was really independent? The fact that they could come to the conclusion that Apple is truthful COULD be because Apple’s being truthful, BUT it COULD be that the independent auditing was not really independent. Then, you’d need to have an independent audit of the auditor… but who’s to say that auditing companies don’t just stick up for each other. So, then there would have to be an audit done by an auditor that’s outside the control of Big Audit. But, if they come up with the result that everything is as Apple says, it may be that Apple’s being truthful, OOOOOR it could be that that company was just not good auditors, etc. etc.

If anyone doesn’t trust Apple, there’s no amount of documentation, auditing, or anything else that could “prove” to them that Apple is trustworthy. It would all be suspect. Apple does have a business and legal needs to be truthful about what they’re doing in these areas, though. Random “security researchers” looking for internet clout don’t have such needs. Before I’d be really concerned about what the researcher is saying about Apple, I’d look into the researcher to determine how they benefit. It could be a simple matter of “I like fame and recognition and here’s one way I can get it!”
Click to expand...
I know what you mean - it's the 'who watches the watchmen' problem.

But we have white hat hackers. We even have accounts auditing companies accounts'. They're not perfect, but they seem to mostly work.

I'm not really meaning anything complex - just Apple stating agile-like test cases/ user stories as to what they're doing and what their intentions are and then people auditing them to see if they hold up.

I don't mean a 3rd company suddenly politicising things and start stating what they think Apple should be doing.

Apple themselves even do a supplier transparency report that they use third parties to compile. Surely they could do the same for privacy?
 
bluecoast said:
But we have white hat hackers. We even have accounts auditing companies accounts'. They're not perfect, but they seem to mostly work.

I'm not really meaning anything complex - just Apple stating agile-like test cases/ user stories as to what they're doing and what their intentions are and then people auditing them to see if they hold up.
Click to expand...
Wouldn’t that come down to “I don’t trust Apple on what they’re doing, but I trust this third party, which Apple chose and gave access to precisely what they wanted them to have access to, if they say that Apple’s telling the truth.”? If you’ve been inside any company as it’s being audited, you know that they don’t talk to EVERY individual in the company, they just communicate with a subset. Apple could make sure that they only communicate to the RIGHT subset.

bluecoast said:
Apple themselves even do a supplier transparency report that they use third parties to compile. Surely they could do the same for privacy?
Click to expand...
EXACTLY the same for privacy. And guess what? The Supplier Transparency Report has the same faults. Let’s say, for example, that I really don’t believe what Apple says are the results of their transparency report. There’s no document or report that could convince me otherwise. Because the information, ultimately, is going to be coming from Apple or its suppliers and I’ve already stated that I don’t believe what they’ve come up with. And, I can readily not agree with anything anyone else would come up with because I know they’re not telling the truth, they’re just hiding it VERY well.

And, again, I’d go back to the security researcher that raised the alarm with their “could” laden report. That security researcher COULD be getting paid to report it. Or they “could” be stealing the private info of everyone that retweets their tweets. Or they “could” have had a bad break up with someone that worked at Apple. If it’s possible and “could” be happening, then it must be!
 
Unregistered 4U said:
Wouldn’t that come down to “I don’t trust Apple on what they’re doing, but I trust this third party, which Apple chose and gave access to precisely what they wanted them to have access to, if they say that Apple’s telling the truth.”? If you’ve been inside any company as it’s being audited, you know that they don’t talk to EVERY individual in the company, they just communicate with a subset. Apple could make sure that they only communicate to the RIGHT subset.


EXACTLY the same for privacy. And guess what? The Supplier Transparency Report has the same faults. Let’s say, for example, that I really don’t believe what Apple says are the results of their transparency report. There’s no document or report that could convince me otherwise. Because the information, ultimately, is going to be coming from Apple or its suppliers and I’ve already stated that I don’t believe what they’ve come up with. And, I can readily not agree with anything anyone else would come up with because I know they’re not telling the truth, they’re just hiding it VERY well.

And, again, I’d go back to the security researcher that raised the alarm with their “could” laden report. That security researcher COULD be getting paid to report it. Or they “could” be stealing the private info of everyone that retweets their tweets. Or they “could” have had a bad break up with someone that worked at Apple. If it’s possible and “could” be happening, then it must be!
Click to expand...
Yeah, agreed in that there's no such thing as certainty.

For example, I've never looked at the source code of Signal, but I have no reason to believe that they're not telling the truth. I trust also the reputations of people who do look at their code and state that they're telling the truth.

Does this mean that they're ultimately secure? No.
Does this scrutiny completely protect them from a bad actor inside the org? No.

I think it comes down in the end to trust.

I ask myself:

'Do I think that Apple might compromise on user privacy to sell advertising in its services and in iOS in order to help meet the figures expected of it by Wall Street?'

And my answer is:

'Yes, I really think that they might if they felt they could get away with it'.

So I guess in the end, I trusted Apple when they were more a company that focussed on selling premium hardware to users. Very simple.

But the Apple that is increasingly using Services as way to meet their quarterly figures - no, I'm not sure if I do trust this company.

There's nothing intrinsically wrong with services - selling Music, TV etc.for a monthly subscription is fairly straightforward.

I think that the big problem at Apple stems from their App Store commissions and ads (i.e. I'm being monetised simply by going on the App Store and of course, I have to to do get apps) and as the economy slows, I'm sure that they are coming under increasing investor pressure to monetise their massive user base, further.

Only the richer part of that base will pay for subscriptions. The rest will have to be monetised through ads. And as I saiid, I'm not sure that I trust Apple to do that in the right way (an ad-supported free or partially paid for Apple TV or Music with ads that are not especially granular and don't use user targeting information would be fine i.e. working the same as traditional TV or Radio advertising).

So in the end, trust is an intangible thing - it's a gut response (based on some empirical evidence of course).

And my gut is telling me that I'm finding Apple increasingly untrustworthy.
 
bluecoast said:
So in the end, trust is an intangible thing - it's a gut response (based on some empirical evidence of course).

And my gut is telling me that I'm finding Apple increasingly untrustworthy.
Click to expand...
Which is fine. There are a lot of folks that feel that way and why “security researchers” like the ones in this story will be able to continue spreading factually questionable theories as a result which validate those feelings. They do so because they feel they can get away with it (and they do).

For me, when I get to the point where I don’t trust Apple’s products, I’ll just have to stop using Apple’s products.
 
  • Like
Reactions: bluecoast
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back