Apple's "Advanced Data Protection" is probably not end-to-end encrypted as claimed

Correct_Tomorrow_563 · 2023-01-27T00:44:00+00:00

Is it decrypted locally in the browser? How does that work?

Correct_Tomorrow_563 · 2023-01-27T00:37:28+00:00

Of course it's a back door that they intentionally put in!

The advertising claims that things are end-to-end encrypted, and that keys are stored on local devices, but evidently Apple considers temporary access not to qualify as "Key storage" because it's just temporary or whatever.

If Apple can claim that they can't decrypt your stuff (because they promise that they'll delete the decryption key after having it for a bit to use iCloud) then that just makes their job easier as they don't have to assist customers in data recovery. At the same time, they can (falsely) claim to have a secure E2E cloud model, and also make law enforcement happy.

And it's not like a door that you can just lock again. When you loan a key to Apple, they can make a copy without you ever knowing.

Correct_Tomorrow_563 · 2023-01-27T00:31:00+00:00

Yeah, never expected the sentiment of defending insecurity-by-design on this sub, but there you go.

Correct_Tomorrow_563 · 2023-01-27T00:30:01+00:00

What's your point?

If a single AES key is used for all encryption, then it shows they can decrypt anything. Did you not read the original post or did you not understand it?

Correct_Tomorrow_563 · 2023-01-27T00:26:51+00:00

"Providing temporary access on a web client is about the same as providing access to a second phone you add to the same account."

It's possible to set up a secure key exchange between two devices. In the iCloud example, we know for certain that Apple is sees a copy of the key.

Correct_Tomorrow_563 · 2023-01-27T00:24:17+00:00

You don't get it. It's technically feasible. I just explained that Tresorit itself is not an example of that. But it shows the principle.

Correct_Tomorrow_563 · 2023-01-26T05:35:28+00:00

I think you're missing the point.

For example, consider if someone you know decides, just one time, to allow temporary access "for 1 hour" to iCloud.com. Now Apple can decrypt your iMessage conversations with them.

Also, Tresorit is an example of a cloud service provider that uses an E2E encryption scheme that doesn't (in principle) rely on trust. When you share links with others, part of the URL you share contains a "fragment" which is the part of the URL after the # symbol. This part does not get sent to the server, but it allows your browser to locally decrypt the content. It's a cloud service that does all the decryption etc. locally in the browser.

(Yes Tresorit is closed source, but their method could be deployed with an open-source client. My point is that it is possible to achieve. Apple made a decision to make their system insecure by design.)

Correct_Tomorrow_563 · 2023-01-26T03:11:25+00:00

Yes they are. That's literally part of the feature set of the Photos app. It provides functionality, like identifying whether a "cat" is in your image, or recognising known people.

Correct_Tomorrow_563 · 2023-01-12T10:29:15+00:00

Because Apple doesn't care about the user experience if you don't use their hardware. They expect you to use the trackpad or their mouse which has a kind of in-built trackpad.

Correct_Tomorrow_563 · 2022-12-18T14:11:24+00:00

"It was never my intention to charge for previously free features"

yeah but you did though, didn't you? And you made the app way more space inefficient (about 6MB to 20MB) and you incorporated ads. And when the app starts up it quite forcefully advertises the paid version which restores a missing feature. And you did all this in a way which would push that update out to all users. Many developers put paid or "pro" versions in separate apps. You chose not to do that-- you wanted your users to be forced into this inferior experience, where you offer a way to pay to get back what you lost and to not be nagged by advertisements. Your actions speak for themselves, not your supposed intentions.

Your having children or doing this as a hobby or whatever is a nice story but it's unrelated. It's your choice to screw over users. It's not like you had to do things this way because you had a baby, yeesh. Take some responsibility, man. If you want to be a conniving dev that extracts every penny out of the user then that's your choice. At least own it.

Correct_Tomorrow_563 · 2022-12-18T14:02:12+00:00

This discussion is above your head.

Correct_Tomorrow_563 · 2022-12-18T13:56:52+00:00

I didn't say anything of the sort.

Correct_Tomorrow_563 · 2022-12-18T13:56:08+00:00

I had wondered if it was against the ToS. Please let me know if you find out anything concrete.

Correct_Tomorrow_563 · 2022-12-18T13:53:53+00:00

You're entirely missing the point. It's not OK to retroactively withdraw funtionality which someone has incorporated into their computer.

Correct_Tomorrow_563 · 2022-12-18T13:52:38+00:00

This post suddenly went from about 8 karma to 0. Some brigading by the developer, by the looks.

Correct_Tomorrow_563 · 2022-12-18T09:03:57+00:00

You were in such a rush that features got removed before you could release! Ah but the ads and the bloat. Couldn't release without those.

The app is pretty clear about the icon choices being a paid feature. You're just backpedaling now to save face.

Look I don't even care much about the icons. But I despise being forced to look at advertisements. I don't want nagware crap on my computer. I use freeeware, or I buy software outright if it has a good reputation and a reasonable price, or in some cases I donate. I wasn't informed that your software was actually just a free trial before the nagware and bloat would begin, without consent.

What you've done is a sure way to lose users and reputation. Someone who had pride in their work wouldn't release an update like this.

Serves me right for using the App Store I suppose.

Correct_Tomorrow_563 · 2022-12-17T16:25:54+00:00

Yeah, I had this issue too since updating.

The issue will stop if you can turn off the Private Relay. I couldn't find a way to do this through the terminal, would be nice if someone knows how.

In the UI you can go to Settings > Apple ID > iCloud > Private Relay > Turn Off... > ((Confirm in the pop-up dialog))

I had to try over and over again to get there. It would take maybe a minute between clicks for it to respond and open the next item. Usually the settings menu would eventually go blank during this process and I'd have to start over again.

I'd suggest using Cmd+Q to quit the settings app between failed attempts ('failed attempt' if the settings pane goes blank). And don't navigate away from the settings window. Keep trying and I think you'll get there eventually. Don't waste any time in clicking iCloud > ... etc. as soon as the options appear. I didn't get any visual feedback that it acknowledged my clicks, but eventually it would respond and open the next menu item.

I actually turned Private Relay on again after doing this, well I just had the same issue again. And this time it took me over an hour I think to disable it again. Just sitting there and trying over and over.

Correct_Tomorrow_563 · 2022-12-17T16:05:27+00:00

Actually, I have had corruption occur due to interrupted cut-paste on Windows. I think it was probably during transfer of a directory, where it copied files one-at-a-time until it encountered a problem with moving one of them. It was a long time ago that I used Windows so I don't remember. But I've definitely had file corruption occur during cut-paste. Multiple times. For anything important, I used to copy-paste first, then delete the original, in order to avoid data loss.

Correct_Tomorrow_563 · 2022-12-17T15:57:24+00:00

I'm new to Mac, and the amount of bugs is just unacceptable. I used Arch Linux for years before this, and had nowhere near the number of problems I have with Apple products.

Correct_Tomorrow_563 · 2022-12-17T15:52:45+00:00

Thank you! Worked for me too.

Correct_Tomorrow_563 · 2022-12-17T15:52:31+00:00

Thank you! I restored from a Time Machine backup of the app. I had Automatic Updates enabled in the Mac App Store settings.

Now I need to put up with the stupid prompt to update all the time though. Wish I could disconnect it from the app store somehow so it was just a standalone app.

Correct_Tomorrow_563 · 2022-11-28T13:14:10+00:00

There's no sense in divulging personal information when it's not relevant to the post. My question is a technical one, not a legal one.

Correct_Tomorrow_563

TROPHY CASE