Hacker News Reader

Comment by preek | Hacker News Reader

TL;DR - China likes to spy on everyones data and can do so, because they own their country. This incident is on iCloud, but is only in alignment with their greater strategy and not Apples fault.

View on HN

Of course, just as America likes to spy on everyone as well. But let's not completely pardon Apple, they can always do something more to strengthen their systems to be more and more resilient to these attacks. It might well be a cat and mouse game, but they should at least try and play rather than just give up. They're sitting on hundreds of billions of dollars, they get hundreds from many of us, the least they can do is look out for us a little more.

I'm not saying security is not an important issue. Inherently it is.

The problem is that Apple is using the industry standard for encryption here (SSL). China cracks that security by giving their folks a browser that allows them to easily swap the certificate out and send all the data to them before sending it to Apple. This is called a MITM (Man In The Middle Attack).

Personally, I'm a big fan of privacy - also I'm the CTO of a web-company, so I'm concerned with security for webapps, too.

When users are ignore warnings of their browsers (what Firefox would do in such an event) or even install a "trojan browser" by a mean government - well, then there is little you can do as a company.

Just wanted to give a short TL;DR on the article to prevent an icloud shitstorm on HN, because the article is really on how mean China is. Not saying or implying at all that other governments are better.

Also not saying that Apple is perfect in terms of security. Btw, as developer and sysadmin I'm using Debian stable - my Mac is for convenience and productivity. Just saying that to disqualify myself as the regular fanboy(;

What do you expect Apple to do in this case? What action can they take against a government-performed MITM?

Seriously "they've gotta do something" sounds good but I'm not sure what options they actually have. If the user clicks through a clear SSL warning, that's Apple's fault?

Half our industry is built on fooling users. Exploiting their cognitive biases. Seriously, we understand where they fall, and if we really wanted to, we absolutely could look out for them -- at least, certainly better than we're doing right now.

Your response is like saying when Facebook was privacy zuckering (http://darkpatterns.org/library/privacy_zuckering/), the user clicks right through the settings that should have sounded an alarm.

What can Apple do? They could make a better browser (I like how Chrome and Firefox do things - you have to go out of your way to reach a page with bad SSL -- compare Safari's rather passive and enabling error message: http://blog.serverdensity.com/wp-content/uploads/2009/05/ssl... vs. chrome's: http://i.imgur.com/ttmmDJ8.png -- you have to REALLY see and think how to access the site despite the warning, it's that good). They could be more vigilant in alerting users of where and how this can happen.

If we were talking about any other young startup, your apology might fly -- not so with Apple, they're sitting on billions, they have the resources to think of a solution and implement it.

I'll buy the argument that the industry has a duty to protect users, and also that Safari could be designed to better warn about SSL.

> Your response is like saying when Facebook was privacy zuckering, the user clicks right through the settings that should have sounded an alarm.

This is a bit odd, though. On one hand we have a company directly attempting to trick users; on the other, we have a company whose product is being attacked by a hostile government. Drawing an equivalence between the two is a bit ridiculous, no?

Yes that was probably not a very good analogy. I was trying to highlight the fact that we're really good at getting users to do what we want (things, specifically, that hurt them and make us more money). So far, we (the tech industry) have put a lot of effort into tricking them to do what we want, now maybe it's time to trick them for their own benefit, rather than ours.

The comparison was between a company who's web UI tricked unsuspecting/naive users into revealing private info to third parties, and a company who's browser UI is making it all too easy for unsuspecting/naive users to inadvertently reveal private info to third parties.

I think the two are quite comparable. In both cases, the software developer should be responsible for guiding the user to make the right decision.

Interestingly, up to now the only time I've seen an SSL certificate warning was a misconfigured server. This is the first that I've seen an attack throw up a cert. error (usually attacks leverage other avenues that don't alarm users). Microsoft research even confirms:

    "It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives."*

* http://msdn.microsoft.com/en-us/magazine/hh288087.aspx

Dang, didn't realize that the formatting cuts off the quote, here it is in full:

"It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives."

"and can do so, because they own their country"

Yes. But they don't own their own iCloud. Or their own iPhones. Or their own Apple.

It's Apple's choice to concede.

Reply on news.ycombinator.com