Hacker News Reader

Comment by shalmanese | Hacker News Reader

Yup. As the celebrity photo hacking should have made clear, Apple can only offer far weaker security guarantees on the web because they control less of the ecosystem.

At a minimum, if the police get access to your email account, they can force a Apple ID password reset and then restore your data onto a new device without needing permission from you or Apple.

Note however it is still possible to backup your iphone locally using iTunes and Apple now supports encrypted local backups. If you are worried about this threat vector, encrypted local backups provides a large degree of the same usability with significantly stronger security guarantees.

View on HN

"if the police get access to your email account, they can force a Apple ID password reset"

That's an interesting assertion. I mean, yes, sure, they could do that, but it's an interesting question of whether they are legally allowed to do that. Effectively they'd be misrepresenting themselves to your email provider and to Apple as if they were you. Is that acceptable 'undercover policing'? Can they reset your banking password too? Can they do this only while they have you under arrest?

They don't need to admit they did it. Parallel construction works more effectively.

If they have information that was only present on your device or your iCloud backup, and they already can't get at your device, how exactly does parallel construction help them explain the fact that their evidence includes information that could have only been obtained one way?

Because that's not the evidence they present, they use that to figure out where else to look for evidence, pretending they found that randomly or by guesswork or suspicion or following an anonymous call.

Right. "By virtue of my training and experience, I had reason to believe" is a stock statement re anything, in trying to establish probable cause for searches, stops and the like.

It's a broad, overarching, and highly vague statement that amounts to, in many cases, "I decided you do, so therefore I have the right to act as if you do".

now supports encrypted local backups.

iTunes has supported encrypted local backups since the beginning of iOS.

restore your data onto a new device without needing permission from you or Apple.

and that's a great reason to verify your iCloud backup is always disabled on all devices (if you care about privacy). You just have to be vigilant about not accidentally enabling it during any setup process since iOS wants you to enable the feature, but it's easy to disable everywhere.

You make it sound like Apple is trying to trick you into enabling it, like they have default-on checkboxes everywhere to turn it on. IIRC they only ask once, during the setup wizard, and you're forced to make a choice (no default behavior). So just don't turn it on and you're good.

Apple has supported encrypted iTunes backups for years. I remember having it enabled when I upgraded to the iPhone 4. A quick Google search finds articles talking about it from 2011.

Reply on news.ycombinator.com