Matthew Green

And from a pure privacy perspective, the problem there is that once you’ve demanded every encrypted app add a scanning component, then changing what you scan for is just a software update to be agreed upon quietly in some committee down the line.

Boston. #meshcore

The problem with this idea is that most “moderated” versions don’t solve the central problem: you’re changing private, encrypted messengers to have a component that scans the plaintext of the message. This is what potential makes your messages vulnerable to theft.

As to question (1), the article isn’t super clear. But it’s worth pointing out that Apple doesn’t just provide end-to-end encryption for backups through their ADP feature. They also provide end-to-end encrypted backup for health data, web history and passwords, even without ADP. So “we want a backdoor to access iCloud encryption” could mean access to those password vaults and secure health data. This means Apple would have to disable those features in the UK as well, or deploy new insecure encryption code that could affect users globally. It’s also possible that the UK is asking for a backdoor in Apple’s iMessage text messaging system. That isn’t technically “iCloud” but it’s adjacent enough that I could see it getting presented that way. This would not be the first time the UK gov expressed interest in that. What’s worrying here is that the UK government seems absolutely determined to access user private data, no matter the bad press and the consequences. And they’re now willing to do it overtly. Between this and recent moves against encryption in the EU, we’re going to a bad place.

A final note: it’s not totally clear what the UK is asking for here, but one theory is: they want access to foreign users who have ADP encryption on, but are on UK soil (for example, foreign diplomats.) This would be a technical nightmare, but it fits the facts. Would be a technical nightmare because now you’d have two versions of Apple encryption, where the security changes depending on where in the world you are (ie your IP address.) This is so dangerous that it’s tantamount to a global backdoor, including against US citizens.

So what worries me come December is that we see a bunch of “moderated” proposals that preserve this central architectural change, but just use it for slightly less. That’s not going to save anyone.

So here we are again. This time the UK is narrowly targeting their request at UK users only. But this is baffling for two reasons. First, Apple no longer offers the ADP encrypted backup feature to new UK users, and existing users are being migrated. So what is the UK asking for? Second, how is Apple supposed to make a single encryption system that’s secure for US users but not for UK users? This would require that they partition their software globally and have many versions, which seems like a disaster. Are you sure you’re running the “secure” OS?

Right now it handles simulations that involve collisions, delays and other common events (in a very simple model). Each node is a simplified Meshcore node running as a process. #meshcore

Anytime someone sets a feature as a non-default, I assume 95% of users never touch it. When they put it under the “Privacy” settings menu, I raise my expectation to 99%. But Privacy -> Settings -> Advanced, wow. That’s like putting it in a disused lavatory in the basement of the town hall, with a sign that says “Beware of Tiger.”

For context: last year the UK demanded (in secret) that Apple create a backdoor into their iCloud Advanced Data Protection system. This was done via a Technical Capability Notice, and could have given the UK govt a master key to all iCloud users’ data worldwide. When this fact became public, it drew a huge backlash. Apple announced that it was entirely removing the encrypted backup feature for all UK users. Trump administration figures rebuked the UK government.

Just to give some visuals. #meshcore

I feel like we should introduce this to our CS students during their first year. “How to control the adoption rate of a feature based on where you place it in the Settings menu-tree.”

Ok the option to turn it off is tucked away under Privacy -> Advanced but it warns you that you might experience painful side-effects if you turn it on.

@marsik I’m planning to code this up next week.

These criticisms are mostly UX nits, but I had to remove a bunch of old devices with names like “Matthew’s iPad (3)” that have probably been gathering dust in a closet. I think that’s ok but was a little nervous I might nuke a device my kids were using.

Also had to update a MacBook Air, which was messy. Even after the update ADP on my phone refused to acknowledge the Mac was up-to-date. Activating ADP on the Mac was possible, but failed mysteriously several times.

@baro77 They said shared albums aren’t supported. As a special exception.

@jayrosen_nyu@mastodon.social Used to be similar on Twitter until the algorithm came down.

@fdlamotte @marsik @tuga I’m planning to prototype this next week just for fun, to see if it works. But curious if there have been any experiments in this model or if it’s a bad idea for known reasons. (I know iOS background BLE receiving is very very bad.)

@marsik oh never mind, I understand what you’re saying. What I want is that but bigger: I want a single radio to be able to support 100 simultaneous smartphone clients via BLE advertisements. For protests and natural disasters.

@baro77 Yeah looks like 16.2 and Ventura. And any devices that don’t support those newer updates have to be removed entirely. They can’t participate at all.

@fdlamotte @marsik @tuga My big concern is that in public spaces you have to throttle or gate people accessing the thing. For broadcast (read) only that doesn’t matter but for writes I guess you’d need permissioning or throttling.