iPhones send call history to Apple, security firm says

https://theintercept.com/2016/11/17/iphones-secretly-send-call-history-to-apple-security-firm-says/

by mcagl • 10 years ago

242 77 10 years ago

theintercept.com

galad87• 10 years ago

Call history is synced between devices via iCloud, so what's the news here?

TeMPOraL• 10 years ago

Well, of course it does. The question is - why?

M4v3R• 10 years ago

Apple's response in the article explains it - so the user of multiple devices has the call log on all of them, so he can respond to calls on any device. Also, this helps when you set up a new phone.

unethical_ban• 10 years ago

I feel like "sync" is an iCloud feature.

kimshibal• 10 years ago

i'm still using my trusty motorolla razr

faitswulff• 10 years ago

If you're not joking, I'm curious how long the battery lasts nowadays. Has it significantly declined since you first got it?

mi100hael• 10 years ago

It has one of those old-fashioned replaceable batteries, so he could always just buy a new one if it goes downhill.

cptskippy• 10 years ago

If he's referring the flip phone, and not the Droid Razr, then we're talking about a phone that had a standby time measured in weeks. At best it lasts probably 10x longer than today's smartphones so even a 75% reduction in battery life is still better than what we deal with today.

j452• 10 years ago

Razr is what the startac should have been.

djrogers2• 10 years ago

The razr came out 7 years after the startac - there's no way they could have built the razr with 1996 technology. That's like saying the McLaren F1 is what the ford model T should have been...

runjake• 10 years ago

With the in-built BREW environment and the SIM "capabilities", it's probably a lot less "trusty" than an iPhone -- especially an iPhone with iCloud turned off.

More luddite doesn't always mean more secure.

hackuser• 10 years ago

In what ways is BREW secure and insecure?

komali2• 10 years ago

But...why?

JadeNB• 10 years ago

A feature of the Razr that I desperately miss from modern phones: it would fire the alarms even when the phone was turned off. Somehow this ability has been lost on smartphones, and people behave as if it is a technical impossibility, but the Razrs managed it.

nicky0• 10 years ago

Yep, the old Nokias did that too

iblaine• 10 years ago

Motorola Brick here. My hipster street cred is through the roof.

pksadiq2• 10 years ago

Apple's Reply:
> Device data is encrypted with a user’s passcode, and access to iCloud data including backups requires the user’s Apple ID and password.

Can't Apple ID password be reset? If so, how can it be a true encryption?

murukesh_s• 10 years ago

That is a valid question.

redial• 10 years ago

Device data is encrypted with a user’s passcode

I think it uses the passcode you set on your phone, not the password of your iCloud account.

pksadiq2• 10 years ago

I think it uses the passcode you set on your phone, not the password of your iCloud account.

May be true, but

access to iCloud data including backups requires the user’s Apple ID and password.

probably doesn't requires the passcode that the user have set, because this data is available across several devices, and the only common thing would be the Apple ID and its password.

Someone• 10 years ago

I don't know whether they do, but the data still is on your device, so if you change your password, your phone can overwrite the version in the cloud with a newly encrypted one.

Using Apple ID and password is (for the typical user) fairly weak encryption, though. That could be improved by having your devices exchange encryption keys.

andmarios• 10 years ago

Maybe the password encrypts the actual encryption key? I don't know about iCloud but that's how LUKS works on Linux.

peterkelly2• 10 years ago

Except that would mean a password reset would involve losing access to all your data (unless you can remember the original).

piyush_soni2• 10 years ago

But everything on the iCloud can be obtained by the government and the law enforcement agencies. Right? (I don't care much, but apparently one of the reasons many people use iPhones instead of Android phones is that their data is perceived to be protected from the government, so might be important for them - and Apple does have a history of giving the iCloud data to them).

matthewmacleod• 10 years ago

No.

willstrafach2• 10 years ago

There may be a phrasing issue. Parts of iCloud data are protected with a device passphrase / passcode (or specifically: a encryption key generated based on that). Further, your iCloud account is protected with a password of course. So these are two layers of protection, not quite one or the other like the text may imply.

droopyEyelids• 10 years ago

Note to media companies (and everyone else) talking about security: You have to put security elements in context to say anything reasonable

That means both: 1) Consider your audience, and 2) Do a 'risk analysis' (Meaning figure out where the security issue starts to outweigh the convenience and describe the actual impact of the issue.)

This article (and Forbes') are both severely damaged by a failure to do either. Without stating the contexts where this call logging is a problem, and who it is likely to affect you end up writing alarmist nonsense- especially when the audience is the general public.

cndjckdovj• 10 years ago

I wonder if The Intercept will qualify as "fake news" in the near future for exposing things like this.

Amir6• 10 years ago

What (TF) are you talking about??!!

peterkelly2• 10 years ago

I'm not sure how this is "secret". If you're using iCloud on your mac and your iPhone, and open up Facetime on the former, you'll see a call list (including regular phone calls, not just facetime).

I agree it's undesirable that call history is sent to Apple - but it's pretty easy to notice if you use facetime across devices that the call history is synced.

wklauss• 10 years ago

Why undesirable? I found call log sync quite useful.

typicalbender• 10 years ago

I think the lack of control is undesirable. I agree the feature itself can be very useful. The title of this post sounds way more sinister than it appears.

benologist• 10 years ago

They sell ~10 iPhones per Mac so most people are only going to be using FaceTime on their phone.

jwtadvice3• 10 years ago

The "secret" part is that they include information that is only interesting to law enforcement (timestamps and durations) in addition to pulling information from third part communication tools like WhatsApp.

Namely, Apple chose to provide this information to government surveillance when they could have (and indeed promised) to design it in a way that allows for the iPhone to be used in sensitive situations and by people who need security from state coercion and violence.

SanFranManDan• 10 years ago

This doesn't make sense to me. Law enforcement has been able to get that information easily for quite some time directly from telephony systems. Timestamps and durations have been a part of phone UIs for quite some time, which to me indicates that it is in fact interesting to more than law enforcement... unless phone manufacturers conspired to display that information to help LEOs when they confiscate phones.

Anyone who cares about state coercion and violence should know phone calls are about the least sensitive way to communicate.

6u54wuwu5w2• 10 years ago

This is just plain wrong. Timestamps of course make sense in the context of call history.

jamisteven• 10 years ago

Please tell me they didnt spend any money to figure this out.

snowwrestler2• 10 years ago

The key detail for me is that if you delete the call from the log on any device, the next sync will delete it in iCloud.

So the probably-good-enough-for-most-folks way to deal with this is to just delete calls from your log that you don't want to get archived in iCloud for 4 months.

The sure way is to disable iCloud entirely, but that reduces convenience in all sorts of ways (syncing iTunes music, for instance).

The ideal would be for Apple to figure out how to provide the services of iCloud in such a manner that they don't have access to user data. Apparently they are working on that but it would obviously be a major change, and risky too.

Most people don't care that Apple has to see their data in order to sync, but boy will they be pissed if Apple makes their data permanently unreadable. Most people want to be able to go into an Apple store and get problems fixed. Imagine being an Apple retail tech and explaining to some 50-something lawyer that because they lost their password there is absolutely nothing you can do. "Sorry man--encryption."

anondon• 10 years ago

The key detail for me is that if you delete the call from the log on any device, the next sync will delete it in iCloud.

I highly doubt that it is a hard deletion of data. My guess is that it would be a soft delete, so your call log won't show up on your iPhone, but the data will be retained on Apple's servers.

snowwrestler2• 10 years ago

I'm just going by the article:

One way call logs will disappear from the cloud is if a user deletes a particular call record from the log on their device; then it will also get deleted from their iCloud account during the next automatic synchronization.

TazeTSchnitzel• 10 years ago

iCloud phone backups contain all sorts of other data, too. But it's encrypted.

JustSomeNobody2• 10 years ago

It has to get from one device to another somehow, right?

There's total[0] privacy and then there's degrees of privacy and convenience. You can't have total privacy and total convenience. At least not presently.

[0] Total is one of those words like 'always' and 'never' that people should try and avoid. Myself included.

babuskov• 10 years ago

You can't have total privacy and total convenience. At least not presently.

Encrypt the data using a password you enter on both devices and only transfer it encrypted across network?

haikuginger• 10 years ago

Cost to convenience: if you lose or forget your password, you lose your data.

JustSomeNobody2• 10 years ago

that's total convenience?

romjak• 10 years ago

Some other items that get synced through iCloud are phone numbers and emails of people you text, or send email to, even if they are not in your address book. Searches you put into Maps are also synced this way as far as I know.

Most of this data can be viewed on a macOS if you are signed in with the same iCloud account. It is stored in plist-files in a special folder called "SyncedPreferences".

~/Library/SyncedPreferences ~/Library/Containers/com.apple.corerecents.recentsd/Data/Library/SyncedPreferences

It has bothered me for a long time that there is no way to disable call log, text and email recipients syncing in preferences. While I can see how users might find this feature useful, it should be made more obvious what is actually happening when you sign into iCloud.

And by the way, disabling iCloud Drive does not disable the syncing of "SyncedPreferences".

MaysonL• 10 years ago

I'd be more worried about my carrier keeping call history forever than Apple keeping it for a few months.

junto• 10 years ago

I've never enabled iCloud on any of my iOS devices, since I find it a bit creepy.

What real benefits am i missing out on that outweigh the privacy aspects of not using it?

Find my iPhone would seem to be an obvious benefit, but are there any others?

dkonofalski• 10 years ago

What privacy aspects are you referring to? iCloud is extremely secure unless you disable certain aspects of its security or choose to use a weak password.

6u54wuwu5w2• 10 years ago

I'm only using "find my iphone" myself. The rest is of dubious use to me.

jwtadvice3• 10 years ago

The thing to note here is that it includes all information about the calls including the times and durations and the logs also intercept communications from third party apps like Skype, WhatsApp, and Viber, and that all of this information is available to law enforcement.

This is despite Apple's PR statements claiming that the company has designed the phone and its logs to minimize or eliminate the amount of information will be used to feed into law enforcement surveillance requests.

iPhones send call history to Apple, security firm says

Related Stories