all 18 comments

sorted by: hot top controversial new old
[–] 89 points 3 months ago* (3 children)

An option to pre-load new devices with the users data won’t be available, but Gurman says it was in the works for a while.

He says it would have been called a “white-glove component,” and if the user opted into it, it would have arrived “preloaded with all of your data via your iCloud backup.”

Since the title doesn't mention the feature in question, it's having a device delivered to you with your iCloud data preloaded with it.

  • source
  • hideshow 3 child comments
  • [–] 21 points 3 months ago (2 children)

    that’s really a pointless feature, since it doesn’t really take all that long to load the data yourself…

  • source
  • parent
  • hideshow 2 child comments
  • [–] 23 points 3 months ago (1 child)

    I can't confirm this, but I remember reading that Amazon will ship you devices with your wifi password already entered if you purchase a device from another Amazon device that is signed in.

    Sorta similar. And equally creepy.

  • source
  • hideshow 1 child comment
  • [–] 15 points 3 months ago

    years ago, i bought an Echo Dot for my home automation system. it was great.

    then, while testing out some digital signage devices, i bought a Firestick. connected that to my TV, and it said “one moment, while i connect to your network.” i literally said out loud “good luck without my (very complicated) password!”

    somehow, it connected successfully. i instantly disconnected both devices from power, and properly disposed of them, and changed my network password.

    i had always assumed the Echo Dot just handed the password over, but now i have doubts!

  • source
  • parent
  • [–] 15 points 3 months ago

    Maybe 'end to end' means different things to different companies

  • source
  • [–] 42 points 3 months ago (9 children)

    That doesn’t sound so sinister.

    This post bears the marks of manufactured outrage. Not required; we have plenty of real outrage.

  • source
  • hideshow 9 child comments
  • [–] 9 points 3 months ago (4 children)

    As somebody who would not want any corporation to be able to preload my data onto a phone it ships me, which implies it knows exactly what data I have to begin with, it sounds plenty sinister to me. Just swap "Apple" with "Samsung" or "Google" or "Microsoft" or literally any other company.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 3 months ago (1 child)

    Eh?

    This is if you a) purchase the phone in some way that is associated with your Apple account, b) have cloud backups already in place, and c) opt in to the preload.

    If any of those things aren’t in place, it wouldn’t have happened.

    Now your likely assuming they can get into that backup, which fair enough would be a concern. But (if you believe them, which I admit is a huge if) according to Apple, they can’t actually get into that backup without your password. Meaning (again, if you believe them) this would be as safe and secure as shipping your own phone cross country after rebooting it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 3 months ago

    I think the biggest concern for the average person would be feeling like the promises of Apple privacy would be severely compromised by this, regardless of whether that's the case.

    I didn't realize it at the time, but apparently all iCloud backups are encrypted? So either Apple was thinking of grabbing an unlock key from somewhere to decrypt before sending you the phone, or they were just going to include an encrypted backup file (or something) that you'd have to enter your password to unlock upon receipt (and then presumably wait for the decrypting).

  • source
  • parent
  • [–] 2 points 3 months ago

    none of the components are being used to assemble this self imposed panopticon sounded sinister because they were whitewashed through marketing -- that same device that can keep track of your movements and who you talk to was adopted by everyone because it was marketed as a fun and convenient way to connect with friends.

  • source
  • parent
  • [–] 1 point 3 months ago (1 child)

    I know people that assume apple can't access their cloud data without them. This breaks that assumption. Meaning any cloud can be used and given to anyone at Apples discretion.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 3 months ago

    There's actually a setting you can enable if you want Apple to not hold your iCloud keys. A necessary side effect is that you can't recover access through Apple so you'll have to set up another form of account recovery.

  • source
  • parent
  • [–] -3 points 3 months ago

    It's Apple...

    Not everyone with an iPhone is tech illiterate, but everyone who is tech illiterate has an iPhone

    Those people might think that the only way for their data to get from one phone to another, is them typing a password onto the phone physically.

    If they were offered this, they may realize that Apple could just clone their phone and everything on it.

    Don't forget how many social media savvy young celebrities had nudes leak a few years ago because they were iPhone users and iphones back everything up to the cloud by default. Most users most likely never realize that's happening.

  • source
  • parent
  • [–] 1 point 3 months ago

    To be fair, every time I've had to setup a new iPhone for a relative the transfer data feature just freezes up the phone and I have to force restart things and try again.

  • source
  • 4 comments in c/pulse_of_truth@infosec.pub view that post
    [–] 16 points 3 months ago

    Tldr they'd post you a new phone with all your personal data pre loaded

  • source
  • [–] 14 points 3 months ago

    I mean, if they restore a backup containing encrypted data and required the user to enter their info to decrypt it, I don’t see the problem.

  • source
  • [–] 7 points 3 months ago

    Oh no they’d back up my phone and restore it on a new model, just like i do. It’s 1984 all over again. Dogs and cats living together. Mass hysteria!

  • source
  • [–] 1 point 3 months ago

    This author is either:

    1. incompetent for not knowing about encryption; or
    2. malicious for deliberately avoiding the subject when talking about the privacy implications of copying encrypted backups

    Either way, we shouldn’t give them any further attention.

  • source
  • 2 comments in c/cybersecurity@sh.itjust.works view that post
    [–] 22 points 3 months ago (1 child)

    TLDR They were considering shipping a phone that had already been restored from a backup via their cloud servers.

    IIRC iCloud backups have already been the target of both hackers and law enforcement activity before.

    But more generally, if whatever service you use for backup isn’t end to end encrypted, then whoever has your backup could sift through it if they wanted.

    Note that Apple does allow “Advanced Data Protection” which includes end-to-end encrypted backups along with the warning that Apple cannot help you if you lose your password.

  • source
  • hideshow 1 child comment