Apple’s Tim Cook Delivers Blistering Speech on Encryption, Privacy

http://techcrunch.com/2015/06/02/apples-tim-cook-delivers-blistering-speech-on-encryption-privacy/#.s4ng9g:nsp4

by revscat • 11 years ago

272 307 11 years ago

msabalau3• 11 years ago

In other words, Apple is incapable of competing at delivering valuable user experiences on the basis of machine learning, so they are trashing the concept.

msabalau3• 11 years ago

Downvote if you want, but billions of people get value every day out of Facebook, Google, and Amazon knowing them. Saying scary words about advertising isn't going to keep people from abandoning Apple's premium priced lower quality photo service.

threeseed8• 11 years ago

People get value from the core service of Facebook, Google and Amazon not their machine learning driven advertising/recommendation engines. And I would argue that given that since those engines are used to drive company profit first and user experience second they are of limited value to the user.

And if you are talking about Google Now style functionality well I haven't seen that changing the world same with Siri, Cortona etc. But Apple did aquire Spotsetter and Cue so Apple will be coming out with an equivalent soon enough.

BinaryIdiot• 11 years ago

So I downvoted your original comment not because people get value out of machine learning (which I agree with) but that you purport that Apple is incapable of delivering something based on machine learning. Unless you're a core Apple engineer I don't see how you could know this for sure; it sounded more like an opinion that didn't further the discussion.

In fact I wouldn't be surprised if they use machine learning for a few things (they do collect data after all just not as much).

threatofrain4• 11 years ago

I think Apple may be communicating something different: I think Tim Cook is merely criticizing that those companies make money off of your information somehow, while giving you a service "for free".

I don't think that precludes Apple from using machine learning techniques on mass-collected data.

snowwrestler2• 11 years ago

Right, there is probably no machine learning at all behind Siri.

icpmacdo• 11 years ago

“I’m speaking to you from Silicon Valley, where some of the most prominent and successful companies have built their businesses by lulling their customers into complacency about their personal information,”

“They’re gobbling up everything they can learn about you and trying to monetize it. We think that’s wrong. And it’s not the kind of company that Apple wants to be.”

This is a great strategy to win the hearts and minds of privacy advocates like me and take shots at companies like Google at the same time.

mkozlows3• 11 years ago

It's also, more cynically, trying to cast Apple's business model as a moral issue.

I mean, to be fair, Google does this too -- their emphasis on openness with Android, or "the next billion" with the low-cost, low-margin devices they enable are casting their business model as more moral than Apple's -- but advocating for the moral superiority of spending high-end money, as Cook is here, always strikes me as kind of gross.

(Also, when he implies that Google sells your data, he's just wrong. Google uses the heck out of it, but they don't sell it -- why would they? It's their competitive advantage, they don't want other people having direct access to it.)

damon_c• 11 years ago

I agree with what you said here but I think that when Google, in the pursuit of their primary revenue stream, sells an ad targeted at you, they can only do that because of what they know about you and your search history. That is very close to the same thing as selling your data is it not?

govindkabra31• 11 years ago

How do you define "sell"? Adsense and Adwords - can very well be argued as selling the distilled gist mined from troves of data collected from your search history, email, photos, android app usage.

msabalau3• 11 years ago

Cynically, and hypocritically. Just checked, the Facebook app is still in the store. Apple has been happy to take the search payments from Google from the first iPhone. Astonishing how Cook's "morality" has no practical implications that require his company to do anything.

justaman2• 11 years ago

... trying to cast Apple's business model as a moral issue.

This was the idea behind the famous 1984 commercial. Creating a sense of societal urgency and philosophical crisis.

bla2• 11 years ago

I don't know, it looks pretty obviously like he's talking his book. I care about privacy, but Cook using it to sell me Apple products is a turn-off to me.

zak_mc_kracken3• 11 years ago

But it's still mostly bullshit, though, especially coming from a company using closed source software for most of its products. Nobody can really tell what they are collecting, what they do with it and how much of it they share with third parties (including governments).

If you google a bit, I bet you will find similar speeches from every single big company CEO these past years: "Privacy is our number one priority, blah blah blah".

If you think Apple is different just because Tim Cook has great speech writers, you're being naive.

All these companies are in it to win your private information, and we are all prepared to give them some of our private information if what we get in return is worth it. That's the game, simple.

MCRed6• 11 years ago

It's funny how Google advocates always "bash" apple for being "closed source" when this company ships the most popular Unix in the world... and all of their products, even the watch, are based on it. Yes, they do keep the Application/UI layer closed source, but so does google ("Google Apps").

Yet google has spend years propagandizing that they are "open" while Apple is "closed" and that plays right into the latent desire to hate Apple from those who got a PC instead of a Mac when they were a kid.

Apple is different because for nearly 40 years they have been honest and forthright and treating people different. Google says "don't be evil" and then goes out and does evil. Apple doesn't say it, they just don't do it.

The idea that all these companies want private info and thus are all going to be evil is cynical.

And it ignores the fundamental truth: Apple's product is really nice software sold in a hardware box. Google's product is your private info.

The business models couldn't be more different.

stephenr8• 11 years ago

All these companies are in it to win your private information,

The companies he Tim Cook described, that offer "free" services and data-mine/aggregate/sell your personal information to fund the business? Yes.

Apple has a vested interest in not collecting, analysing, aggregating and using the vast amounts of private information other companies do: they're seen by many as a premium brand, where you pay a bit more and get a better product/experience. Part of that is not getting "maybe you'd like X" emails from the App Store, or "Hey do you need a new printer for that Mac you just bought on Apple.com" type shit.

and we are all prepared to give them some of our private information if what we get in return is worth it.

You might be. "We" are not all prepared to hand over private information.

endgame• 11 years ago

I was shocked at the amount of registration info a new mac asks for. Haven't bought one since.

gambiter4• 11 years ago

Everyone was happy to believe Google when they used to say their motto was, "Don't be evil," but not willing to believe the CEO of Apple, even though they've done a LOT to show they are working inline with his speech. I'm not saying Apple is a saintly corporation, but just assuming they are bad because they they COULD be bad comes off as paranoid more than insightful.

Nobody can really tell what they are collecting, what they do with it and how much of it they share with third parties (including governments).

http://www.apple.com/apples-commitment-to-customer-privacy/

Yes, this could all be lies, but so could literally anything anyone says. Either you choose to live as a recluse in the woods with no technology, or you choose to trust at least some corporations. That might mean trusting your search engine, your cell phone company, your car manufacturer. Heck, you're trusting your ISP right now not to do a MITM attack on you. The natural conclusion is that you should use strong encryption in everything you do. At this point, there is one company spearheading this to get it into the hands of consumers who don't know any better.

Again, I realize Apple isn't blameless, but there's an awful lot about their recent actions to show they are making decisions based on what is best for the consumer. I think that's a good thing, and it's hard to imagine why someone would argue against it.

vacri5• 11 years ago

Perhaps a privacy advocate should be wondering about the 'sniff test' of the speech. What does “Like many of you, we at Apple reject the idea that our customers should have to make tradeoffs between privacy and security” mean? That there's a serious argument that less privacy is more security? Aren't they functionally the same thing in this context - 'security' here is about maintaining privacy.

It's also a bit rich that Cook is talking about other entities gobbling up your data for themselves, when Apple is the epitome of the 'walled garden'. Apparently being in control of your own information is only what Apple wants if it's concomitant with their control of your information.

Cook isn't being morally upstanding here. He's just reframing his company's position to make the other guy look bad. It's the traditional pattern of hide your weaknesses and expose those of your competition.

pen2l• 11 years ago

“I’m speaking to you from Silicon Valley, where some of the most prominent and successful companies have built their businesses by lulling their customers into complacency about their personal information,”

That is just really, really, REALLY RICH, coming from the company who's behind this kind of shit: http://i.imgur.com/1lGp7ps.jpg

Yep, to turn off ad-tracking, you have to go to... Settings... then 'General'... and then... About. Wait, "About"? Yes, "About", then "Advertising" ... and then do "Limit Ad Tracking". "Limit Ad Tracking", what a wonderfully clear label huh!

Of course that's coming to you form the individual who likes to give lofty speeches about how he and Steve Jobs led in 'advancing humanity through the equality of all its employees' [1]. Because let's please just forget about how Apple had its part in collusion over hiring policies [2].

[1] http://www.nytimes.com/2014/06/15/technology/tim-cook-making...

[2] http://www.washingtonpost.com/blogs/the-switch/wp/2014/04/23...

DigitalBison• 11 years ago

Not sure how recently it was changed, but on my phone running iOS 8.3 that setting is under Privacy -> Advertising.

supercoder• 11 years ago

That feature is there to let you improve your privacy, not to trick you in to taking it away.

http://appleinsider.com/articles/12/09/13/apple_adds_new_lim...

The problem is legacy, a bunch of stuff was probably going to break if they just enabled that en-mass.

kriro• 11 years ago

As long as Apple heavily relies on closed source technology I'm fairly skeptical about their commitment. Additionally being a US based company all it takes is a friendly government agent showing up and I'm sure they'll hand over stuff without putting up too much of a fight I'd also guess that they do use cookies for their website and pay for web based advertising (thus being an enabler). Siri also makes me rather uncomfortable.

Don't get me wrong, better privacy is an important issue and if Apple sees it as a potential competitive advantage that's pretty good (as it'll force others to improve there as well). I'll be very interested in seeing how much they push this as a general strategy. [sadly I'd argue it's not really all that great of an idea because if push comes to shove most people will readily give up privacy for convenience (imo)]

msoad3• 11 years ago

Software is eating everything, including hardware. If Apple is not capable of doing good software it's doomed. It appears to me that Apple is giving up on software. By software I mean the code that recognize things in my photos in Google Photos or the software that sort the items in my Facebook News Feed. Apple is incapable of doing software like that. At least today.

So what they're doing is bashing those who actually can do things with their data.

I like to believe there is a company that cares about my privacy but we all know if Apple can make a good business from my data it will(iAd). They simply can't!

craigyk• 11 years ago

Sure...

msoad3• 11 years ago

I know people from Apple data-related teams and talk to them a lot. Trust me, they simply don't have what it takes to build good data-heavy software.

rogerb• 11 years ago

Tim's argument is simply that free is not free: google's business model requires them to monetize your pictures, through advertising etc. Apple's business model is to charge you for it.

msoad3• 11 years ago

So why they have an ad network? Why they collect your searches in iOS and OSX? They don't mind doing what Google does on top of premium prices but they can't.

threeseed8• 11 years ago

What are you talking about ? Apple is far more invested in software than ever before and have acquired a lot of software companies over the last couple of years for which we not seen the output of:

http://en.wikipedia.org/wiki/List_of_mergers_and_acquisition...

And Apple does have software that does the recommendations for iTunes Store, Apple Store and App Store but I am guessing the billions of money to be made by optimising those wouldn't be worth investing the time in.

MCRed6• 11 years ago

Also, Apple has had face recognition in Aperture, and probably iPhoto, for many years. Probably around the time that Facebook got it.

Of course people who dislike Apple are unlikely to be using Apple software and wouldn't know this.

Edit after the vote brigade: These are two straight up statements of fact. When you down vote them, you tell me that you're being ideological and you don't care what the facts are.

Alas, Hacker News has always been this way.

supercanuck• 11 years ago

They don't have to care, but as long as our interests are aligned, isn't this a healthy tension between them and Google, regardless of "intent"?

randomsearch3• 11 years ago

Software is eating everything, including hardware. If Apple is not capable of doing good software it's doomed.

What? Apple makes nearly all its money from hardware, and it is selling more and more.

Software is a key part of their product, sure, and they seem to be doing ok there, but software usually runs on a hardware platform, which someone has to make.

72deluxe12• 11 years ago

I always organised my data myself in directories etc. and find any software that attempts to organise it for me to be incredibly annoying.

Admittedly, it seems most people's filing system is basically lob all their bits of paper in one room and shut the door hence the need for these "let me organise it for you!" software features.

joelrunyon• 11 years ago

This, combined with a few reports from a couple months ago, sounds like Apple might be ramping up a search engine competitor that could be more privacy-focused.

mark_l_watson• 11 years ago

I would like to see that happen.

In an ideal world, I believe, we would be able to pay for search, cloud storage, email, etc. with strong privacy and security guarantees.

madeofpalk• 11 years ago

Search engine and email is always going to be 'free'. The difference, what Apple claims, comes from who pays for that.

Google's free services are subsidised by advertisers.

Apple's free services are subsidised by hardware, the software costs are lumped in when your purchase an iPhone or a Mac.

jethro_tell• 11 years ago

Apple has shown they aren't really into your data, but they've also got a pretty atrocious security record (poor handling of data on phones and slow OS patching among others) making it seem like that's also not as much of a concern as it should be.

I don't trust google and I would love to pay for 'cloud' but I think trusting Apple is also misguided.

vacri5• 11 years ago

'Private search' already exists. If that's what you want, then use duckduckgo. As a bonus, it's outside the Apple ecosystem, so you're diversifying your risk.

72deluxe12• 11 years ago

I had never thought about paying for Search but I think it's a really good idea. A subscription to a search engine would be really useful.

MCRed6• 11 years ago

I think that's possibly the case, but what I wonder is why they don't just buy DuckDuckGo.

I've built a search engine, from scratch (Eg: before Lucene and Solr existed) it's not a trivial endeavor, and due to VC interference we lost to google... these days not only do you need the infrastructure technology (something that google, notably, is not open sourcing) but you need a decades worth of historical info from past crawls to train your systems.

EDIT: Ah, I see all of my comments are being downvoted, in a vindictive fashion.

I guess I should expect nothing less.

This site needs to reform itself. I'm signing off for awhile.

pervycreeper• 11 years ago

I downvoted this comment. Your claims that your startup could have been where Google is if it weren't for "VC interference", and that a search engine necessarily requires "decades worth of historical info from past crawls" are both of the sort that require at least some explanation beyond mere assertion.

b0sk• 11 years ago

A scathing attack because their business model doesn't depend on privacy, but if Apple is in a business like Google/Facebook, would he still feel icky like this?

johnrob• 11 years ago

Tim, if we're dumb enough to join your autocratic platform, then we're certainly dumb enough to not care about our personal data.

gress2• 11 years ago

Do you use Google's autocratic platform instead?

72deluxe12• 11 years ago

True!

The only safe way is to use a dumb phone from about 15 years ago. Now where's my Siemens A50 or Sony w810i.... I know I have them somewhere...

alaskamiller• 11 years ago

Caveat being how Apple looks at privacy isn't necessary how Facebook or Google views privacy because Apple is a store while Google and Facebook are clubs.

It's in a store's best interest to keep their customer records private.

A club's best interest is to broadcast how much fun it is to join them. That's not to say a club doesn't and wouldn't want to keep their member records private as well.

In fact, clubs work hard to do so, just ask how Meerkat is doing, or any other third parties looking to build on top of a platform they don't own.

Additionally a club like Google or Facebook doesn't sell sell your information. They do the same song and dance as all mass communication companies in the past do, they merely sell hints of it.

To compare a store's motive with a club's motive is interesting, it's almost like comparing apples and oranges. It might also speak to why the core DNA of Apple isn't in creating web services, why Google's core DNA isn't in creating physical products, and why I much prefer speaking to Google Now on my iPhone.

They both see the world differently.

The real interesting question is this.

Apple's service agreement states they store and encrypt iMessages. There have been 300 billion messages thus far. Apple has a centralized system for managing those messages while others use a decentralized peer-to-peer system.

So a positive is that the government can't hack into it.

The negative being that if the government justifies in asking for it instead Apple has no recourse but to give it up.

When push comes to shove, will Apple, the largest company in the world, step up to the plate and spend money to fight the United States in court?

Otherwise this is just a sales pitch that Don Draper pulled when he told a fictional cigarette company to start claiming their tobacco is sun-dried so that every other cigarette company looks weaker in comparison.

hackuser4• 11 years ago

I'm repeating myself (from other threads) but Mozilla should use this sales pitch. Very few users can evaluate business' privacy practices; they only can trust the business. Due to their non-profit, public good status, their mission, and their track record, nobody could compete with Mozilla on trust.

EDIT: I'll add: Certainly the other two leading browser makers couldn't compete, and in mobile platforms only Apple, if they sell Cook's pitch effectively, can provide any competition.

near• 11 years ago

Does Mozilla's track record include their suggested advertising tiles on your newtab page, based off your browsing history? Or their defaulting to Yahoo to send your searches because they were the highest bidder?

Now yes, they say the tiles are based on your local history and not transmitted anywhere; so it's not as bad (I don't care if other people don't see it, I don't want my data mined even locally for the purpose of showing me ads); but it's pretty clear that Mozilla is a business that wants to earn money. And as the saying goes, "if you're not paying for it, you're not the customer -- you're the product."

But you're right about one thing: they're probably the least bad of all the browser manufacturers on all this. Maybe what we need is a crowdfunded browser, where the company listens to their users and has no conflicts of interest.

riquito• 11 years ago

Maybe what we need is a crowdfunded browser, where the company listens to their users and has no conflicts of interest.

Then "just" collect enough money for Mozilla so that they don't need other sources of income

JohnTHaller• 11 years ago

The huge difference is that they are completely upfront about it, turning it off is trivial and requires no digging into settings as the switch is right on that page, what they do with your data in terms of the tiles is entirely open source, etc. Plus, the default search engine is paid everywhere. Google, Yahoo, Bing, Yandex, DuckDuckGo, etc all pay for placement in browsers. Users are free to select whatever browser they want in good browsers.

CHY8727• 11 years ago

Mozilla's a non-profit - the money it collects goes into supporting additional open-source products. At the moment, it does this on income of $300 million per year (mostly from their search provider). Of this money, $200 million goes on software development, $10 million goes on running their services (downloads, sync etc), and $70 million goes on administration, general costs (buildings etc) and marketing.

So yes, if you're hoping to crowdfund you a browser, then if you can't persuade people to donate millions and millions and millions then you're not going to be successful. A modern browser engine is millions of lines of highly optimised code long (check out Servo), and that corresponds to hundreds of millions of dollars of investment.

At the moment, you're essentially trying to say that being open-source and being actively developed are mutually exclusive, which seems odd (if Mozilla threw away Yahoo, they'd be bankrupt).

hackuser4• 11 years ago

Does Mozilla's track record include their suggested advertising tiles on your newtab page, based off your browsing history?

Yes, in fact it enhances Mozilla's reputation (or should): 1) It doesn't compromise your confidentiality because, as you point out, your data never leaves your computer; and 2) They provide a way (and open code) for the whole industry to greatly improve the confidentiality of their advertising.

I don't want my data mined even locally for the purpose of showing me ads

That's fine, but it's not a confidentiality issue.

defaulting to Yahoo to send your searches because they were the highest bidder?

Given that there are confidential search vendors, such as DuckDuckGo, I agree that this is a confidentiality issue.

hackuser4• 11 years ago

Apple's statements about privacy, combined poor end-user control and openness (transparency), are an interesting dichotomy. Usually I associate privacy with the latter two. What does it mean without them?

1) To what degree can you trust the systems without openness? Maybe what Cook thinks is valuable data, adequate confidentiality, or acceptable risk, is not what you think. On the other hand, few people actually review the security of FOSS systems.

2) To what degree can you have confidentiality without controlling the system and data? Maybe tomorrow an update will expose your data because you're doing something Apple didn't anticipate or approve. On the other hand, from a system administrator's perspective, it's much easier to secure systems that the sysadmin manages and controls than systems controlled by the users.

magicalist5• 11 years ago

Cook went on to state, as he has before when talking about products like Apple Pay, that Apple ‘doesn’t want your data.’

I was actually somewhat disappointed by the Apple Pay approach (and that Android Pay is going to follow suit). I'd actually much rather have Apple or Google as an intermediary and give the credit card issuer no information about my transaction. It may seem nice to say that your phone OS sees no data about it, but of course the tradeoff is that the issuer does, and they are notorious sellers to data brokers.

I'd much rather have one time tokens for both the seller and the bank, and only my phone knows what actually happened in between.

Sophistifunk• 11 years ago

You, me, and Apple. But no payment company would ever agree, so it's pretty much a non-starter for another 5 or 10 years.

wvenable• 11 years ago

credit card issuer no information about my transaction

Since the credit card issuer is actually the one paying (and you, in turn, pay them) this doesn't at all seem reasonable. Apple Pay is the middle man.

magicalist5• 11 years ago

Think PayPal. The bank pays Apple Pay, Apple Pay pays the vendor. Google Wallet worked sort of like this through the dummy MasterCard card (MasterCard knew about the payment and the vendor, but not sure if it knew who you were).

But as Sophistifunk says, this would be an incredibly hard sell for an industry already extremely reluctant to team up with anyone or anything new.

mcintyre1994• 11 years ago

Yea, that'd seem preferable but who would be on the hook for fraud/chargebacks etc? I don't see Apple or Google wanting to be in that game and I don't see consumers wanting to lose those protections.

hackuser4• 11 years ago

Can Apple really deliver the security it promises? Hundreds of millions of systems being used and configured in every way imaginable, and a very attractive target for attackers -- I don't know what promises I would make publicly.

krisgenre3• 11 years ago

I find taking pot shots at competing companies really cheap. Its 2015 and by now I think most people are aware that Facebook and Google collect all the information they can so that they can offer their services for 'free'.

How many would really pay for email, cloud storage, search, social network, browser..? what guarantees do I have that the government will NOT have access to my data if I pay for it?

JoeAltmaier3• 11 years ago

I do pay for email, cloud storage and browser. There's a strong argument my personal information should not be harvested by the folks I paid.

But paying for things is entirely unrelated to the government having access to your data. The govt can require a company to collect personal information that passes through their hands, even if they weren't collecting it for business purposes.

krisgenre3• 11 years ago

Honestly, do you really think majority of the users would pay for these services?

72deluxe12• 11 years ago

How do you pay for the browser?

Are you talking about Safari and the fact that buying Apple hardware has subsidised the Safari development to some extent?

callil• 11 years ago

They are setting the stage for announcing the launch of their google now compete which they will sell as more secure and private (no selling your info for ads!) [0]

This is all part of their marketing campaign.

[0] http://9to5mac.com/2015/05/27/apples-proactive-to-take-on-go...

dba7dba• 11 years ago

I agree. Don't mean to be cynical but every public speech given by Tim Cook (and everyone else of high profile) is about setting the stage for something. Aka posturing. They have too much money, control, brand, power at stake.

And this isn't much different from Google blasting Apple for selling products assembled in sweatshops (not that google does that)...

Tloewald• 11 years ago

Another way of looking at it is that they've built their business model this way and they're making the case why it's better for their customers and the right thing to do. Volvo likes to advertise the safety engineering of its cars. Is that cynical?

microtonal5• 11 years ago

I agree. Don't mean to be cynical but every public speech given by Tim Cook (and everyone else of high profile) is about setting the stage for something.

Apple is in the fortunate position that most of their profits come from hardware. With Snowden's publications, the security/privacy advantage is practically thrown in their lap. So, why not run with it? We customers only benefit (not only Apple customers, because this will put pressure on others).

As a side node, given Cook's sexual orientation, I am sure that this is an important issue for him personally as well. There are many countries where you can't be gay openly (yet), and digital privacy is a tiny part of the puzzle of protecting people in countries with less liberal laws.

onion2k• 11 years ago

I'm not sure it'd be possible to make a good competitor to Now without tracking what someone does all around the web. That's sort of the point of it - the more it knows the better it works.

k-mcgrady2• 11 years ago

The most useful things I get from Now are travel info (mostly comes from email/calendar), sports scores (I have to set these up manually), flights details (again from email), deliveries (again email). So they can do quite a lot with just email and calendar access. If you use iCloud they already have these things and don't sell ads against them so you can get some of the functionality (imo the best parts) without tracking. What parts of Now do you think they couldn't do without heavy tracking?

CurtMonash• 11 years ago

I'm beyond thrilled at this, because the chilling effects point hasn't been made nearly often enough. My version is at http://www.dbms2.com/2013/07/29/very-chilling-effects/

That it happens to be commercially advantageous for him to say that his business model is more virtuous than Google's or Facebook's doesn't bother me. In fact, I think there are fixes that could preserve their business models yet reduce the threat. Great. In the mean time, we need people to understand that unfettered surveillance and data use, taken together, are a drastic threat to human freedom.

jkestner2• 11 years ago

I like the idea that doing the right thing can be profitable, and don't see why a business should be criticized for aligning interests with its customers. It's a better way to enforce privacy than laws.

maqr• 11 years ago

For years we’ve offered encryption services like iMessage and FaceTime because we believe the contents of your text messages and your video chats is none of our business.

Sounds great, but take note that it's none of their business today and we know they can be compelled to spy on their users by NSLs.

They control the key infrastructure with their closed-source software that runs on their closed-source hardware.

If they wanted to go into the business of sucking up all of your private messages and parsing them to sell advertising or if the government wants to read some messages, they wouldn't need to do anything besides issue you a different key.

iMessage won't even let you look at the fingerprints of your friends, and it won't warn you if they've changed. [1]

[1] http://blog.quarkslab.com/imessage-privacy.html

Johnny_Brahms• 11 years ago

TBH, the only app that does this correctly is Threema, with a clear indicator that you have verified the contact. Not even TextSecure does it correctly, and TS is supposed to be the gold standard (you can verify fingerprints, though)

MichaelGG• 11 years ago

If anyone manages to make a messaging app that both has strong security and is user friendly and supports features users expect, they will become very rich. Seeing as no one has even proposed a solution in theory, it's most likely unsolvable. I'll bet if you can formulate it clearly enough, you can even prove it so.

Look at say, Dark Mail. After all that hype, their design is "uh basically SMTP+TLS, or PGP if you're paranoid". The only thing that comes close is PGPfone and similar things (ZRTP). And that's because when you call someone, there's an obvious and built-in verification system, voice. (Note: doesn't work as well with deaf people or async comm).

So pointing out Apple fails here? Yes, sure. Expecting anything different? Seems very unlikely. Either they'd break all user expectations, or they'd get an NSL/court order to break the whole system in order to comply with a wiretap.

lmm3• 11 years ago

If anyone manages to make a messaging app that both has strong security and is user friendly and supports features users expect, they will become very rich.

How so? Who's going to pay for it?

I reckon I could do it, you know. Use PGP for the backend (duh) but take some time off work, hire actual designers for the UI, make the identity verification step make sense for the user. But 98% of users don't care about security, and 98% of the remainder can't tell the difference between good and bad security.

hutattedonmyarm• 11 years ago

If anyone manages to make a messaging app that both has strong security and is user friendly and supports features users expect, they will become very rich. Seeing as no one has even proposed a solution in theory, it's most likely unsolvable. I'll bet if you can formulate it clearly enough, you can even prove it so.

Something like Threema?

cromwellian3• 11 years ago

This is marketing folks. Apple's behavior towards Google changed dramatically after Android starting getting traction, and this sudden pivot towards pro-privacy is an Apple's attempt to damage the reputation of it's biggest competitor. Apple hasn't been consistently speaking with the same voice on privacy, both before or after Snowden, and Tim Cook's comments IMHO look cynically designed.

Apple collects plenty of personal data in their cloud services:

1) iTunes and App Stores can track your browsing and purchase data. This is likely used to model and create profiles of your app store behavior so as to revenue maximize what's offered or displayed to you as alternate suggestions for what you might like.

2) Their streaming media services will have data on music preferences. Beats Audio will know whether you like Classic Rock or Jazz, or Beyonce.

3) iCloud Photo Library is not encrypted client side in a way that prevents Apple from decrypting it on the server, so like Google Photos, Apple will have your photos. Apple is not good with cloud services, it's their weak point, so naturally their incentives are to argue against better competing services.

4) iOS ecosystem is freemium based and there are tons of iOS apps in the store that show apps or collect analytic data. You can't claim to value privacy, run a walled garden, and then let third parties collect data to make your ecosystem monetizable and viable. It's benefitting from data collection indirectly, but looking like you're clean.

Now, you can make an argument that you trust Apple more, and make the usual arguments about business model motives, but that's just arguing that Privacy doesn't matter as long as the person violating your privacy isn't monetizing it. Just because Apple isn't monetizing it now doesn't mean they won't later, especially if hardware revenue tops out. If your want total protection, you can't rely on "trust", you have to rely on not sending plaintext in the first place. That rules out iCloud as well.

Overall, Apple may be painting themselves into a corner like Google's "Don't be evil" phrase, where they go all-in on privacy claims so much, that people will over scrutinize any exceptions or violations of principle. When you cloak yourself in piety, people start looking for hypocrisy.

As an example of boxing ones self in, certain kinds of services simply are impractical to run completely client side right now, and homomorphic encryption/computation isn't there yet to make server side computations on ciphertext feasible for many types of services you'd want to offer.

Take for example, organizational assistance, image search, voice recognition. Apple can't improve it's Siri quality without getting actual voice samples from tons of users and storing them so they can use machine learning algorithms to improve accuracy. That's not really feasible to do completely client side. Likewise, if you're trying to train up an image clustering service, you could try running them on publicly published Flickr professional photos, but it won't give you a good sample of real world photos that people take.

Apple may be working on a Google Now service that runs locally, but this might be fundamentally limited in how good it, or Siri can get, and so Apple's ambitions of an intelligent assistant could be limited. Apple also may be working on a search engine, but fundamentally, the iPhone can't store the index for 40 billion documents, which means any search service they offer will have to send your queries to the server, which again, creates an audit trail.

My point is, you may agree with Apple's arguments, but other individuals have been making those philosophical arguments for ages -- those without $180 billion in cash and a huge empire of phones under assault from competitors -- so when Apple execs parade around talking about privacy, you should have the same skepticism you have for any other executive with a vested interest in hawking their products.

xnull2guest• 11 years ago

Thank you.

Even Microsoft started to fund "Scroogle" ads - while themselves being a similar offender.

The point is that Apple is compelled to hand over your data and backdoor their services just like every other company. The Third Party Doctrine, section 702 of FISA, tap and trace laws, Stored Communications Act, CALEA and numerous other provisions are requirements for Apple to follow - just like every other business.

The only thing Apple can do is not voluntarily give extra information (it's true that many large companies do this).

Apple's "vault" technology doesn't mean anything if the key space provided by the user is 15 bits and the rest is located in some hardware manufacturer that keeps a list of keys that are available to request.

No business is your friend. Every business, by law, has to maximize the profit it can extract from you in return for handing the minimum over. A healthy market will a lot of competition can increase the minimum and lower the maximum, but the relationship stays the same. The rest is branding and marketing. That's not to say that you can't benefit from making trades - it just means that care need be your first priority, and the first part of that is understanding your and Apple's incentives.

tremendo• 11 years ago

It seemed to me Mr. Cook's statements could be in reaction to Google's strategy with their Now service http://www.wired.com/2015/05/google-now-io/

I don't know that Siri can compete with that. An obvious way to counter is to raise privacy concerns, and of course downplay or negate any benefits.

microtonal5• 11 years ago

Note: I think you should have started your post stating that you work for Google. It's relevant information in this context.

3) iCloud Photo Library is not encrypted client side in a way that prevents Apple from decrypting it on the server, so like Google Photos, Apple will have your photos.

Having the data is only one part, the other part is what you can do with the data. Google's rights are extremely broad, although they conveniently did not put most stuff in the privacy policy:

When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps).

Source: https://www.google.com/intl/en/policies/terms/

tl;dr: Google can keep your data, even if you stop using their services. Google can use your data for promoting their service and in new services.

I don't think most people realize that there is no way back: once you store your data (e.g. photos) in a Google service, it's theirs to keep (how that works with Dashboard, I don't know).

Please show me comparable terms for Apple Photos (Apple can keep your stuff forever and use it to promote services). If they are not there, there is clearly a difference between storing photos in iCloud or Google Photos.

Shooti• 11 years ago

We also use personal information to help us create, develop, operate, deliver, and improve our products, services, content and advertising, and for loss prevention and anti-fraud purposes.

We may also use personal information for internal purposes such as auditing, data analysis, and research to improve Apple’s products, services, and customer communications.

https://www.apple.com/legal/privacy/en-ww/

No time limit specified = No time limit

cromwellian3• 11 years ago

I'm not a lawyer, and this is strictly my own guessing, but I think often times these privacy policies exist to prevent being sued for regular app behavior. For example, ability to create derivative works, publish, or distribute content could cover things like transcoding, proxying, caching, and redisplay.

So for example, if you don't claim the right to create derivative works, then transcoding an image, sending it from a different CDN domain, etc could get you in trouble.

Trying to read worst case scenarios by reading between the lines I think amounts to FUD because the policies are authored for the judicial system, not the consumers. Lawyers try to stake out as much leeway as they can. These companies will be judged on what they say they will and will not do and that doesn't just mean the legalese.

For example, if Google Photos says they will not do X or Y with your photos, they will be judged on whether or not they ever do that, whether or not that particular restriction is part of the general blanket policy for all services.

My general opinion is to attack people for actually what they do, not what they could theoretically do. Really, do you think Google Photos is going to people's private photos and use them without permission in promotional materials without permission? You've taken a particular example (a public business listing) and applied it to a case like Photos.

If you link here: http://www.google.com/intl/en/policies/privacy/

You find this:

"Because of this, after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems."

Which seems to suggest that if you delete data, it will eventually be removed, but might linger on in old backup tapes. Now imagine you don't carve out such leeway, and nuisance lawsuits are brought against you because say, you only destroy your oldest backups every N months for practical reasons. Or perhaps an HTTP caching proxy ends up with a non-accessible copy lingering on its disk.

There's two ways you can think about such policies, cynicism or optimism. The cynic can assume the worst, and they want to keep your photos even after you leave, because machine learning algorithms predicted you'd be the best model for a new TV commercial campaign. The optimist will see it as part of providing a reliable, fault tolerant, cloud service, and that the data is actually used for what they say it is: to improve services.

If you want to be cynical and paranoid, at least be consistent. Run your own Cloud servers, don't upload unencrypted data to other people's cloud, that includes Apple, don't trust anyone, because they can always change their mind, management, policies, later.

But if you are willing to trust, then stake your trust on what ills have actually been done or not done. A lot of claims are continually put forward about harm, but IMHO, the only one that really hold any water are the ones that involve the government getting access to your cloud data, and that'll apply equally to all vendors in the jurisdiction, which goes back to the former point about cynicism and paranoia. If you're paranoid enough, you should avoid cloud services altogether.

BTW, Google is blocked in China, Apple isn't. What do you think Apple is doing differently in China that allows their services not to get blocked by the government?

snowwrestler2• 11 years ago

While there is obviously plenty of eye-rolling at the obvious digs at Google, I'm pleased to see such strong push-back against the government arguments for weakening or punching holes in encryption.

I think that in the long run, this will matter way more than which giant tech company makes a bit more money than the other.

brazzledazzle• 11 years ago

Apple collects data deceptively don't they[0]? Seems like a case of the pot calling the kettle black.

[0]https://github.com/fix-macosx/yosemite-phone-home/

alan_cx• 11 years ago

Am I to take from this that are we getting excited that privacy is a premium item that you have to pay for?

SG-• 11 years ago

It's too bad the debate here has turned into a huge Apple vs Google thing when it's really a story about not letting the government strip away people's privacy and ability to properly encrypt their data.

Like really, we get it you might not like iOS or OSX, but it's not about that right now.

microtonal5• 11 years ago

But these issues are not independent. Full end-to-end encryption is not acceptable to Google in the short term, since it would mean that they have to store or transmit data that they cannot profile.

This has two consequences: 1. end-to-end encryption is less important to Google and they'll be less inclined to fight governments' attempts to strip away the right to do end-to-end encryption; 2. having data unencrypted data at rest[1] makes it easier for government agencies to request and use that data.

[1] The whole 'data encrypted at rest' thing seems to be doublespeak to me. Their storage backends may only see encrypted data, so it may protect against storage server theft, but as long as they also hold the encryption keys it's only marginal security against hacks and the government, and no protection against the cloud providers themselves.

randomsearch3• 11 years ago

Everyone seems to be Apple-bashing, and ignoring the fact that Apple really don't make money out of your private information. They make cash out of selling devices. So their interests are more aligned with yours. You may have noticed that Google don't make their money out of selling hardware. So they make it through other means. This is really inarguable, regardless of whether you think Apple are using that for marketing or whatever.

Personally, I'm happy to pay a company with a sound business model that doesn't rely on advertising (and by proxy your private information).

How on earth some of the other commenters arrived at their worldview, I have no idea. Unusually close-minded for HN. A lot of Google employees, perhaps?

davidcgl2• 11 years ago

So their interests are more aligned with yours.

Exactly how does a company that makes money through selling you products have its interests more aligned to yours?

etchalon4• 11 years ago

Because that company makes its from me, directly. It has to cater its products to ME, and not to advertisers, or enterprises, or anyone else.

slyn• 11 years ago

By building and providing a product or service that you need/want/like enough to pay for?

tdkl2• 11 years ago

Because money brings support and customer care too.

Ensorceled• 11 years ago

Apple is "more aligned" as in more aligned than Google, not "more aligned" as in perfectly aligned.

Stop viewing the world in black and white.

fpgeek7• 11 years ago

I think the strong reaction is because the distinction between Apple and Google is much fuzzier and weaker than Tim Cook (and some commenters here) are trying to make it sound.

Apple makes money from device sales. Apple can make more money by using private information (to improve their cloud services, selling the search default to Google, for iAds and so on) - as long as they don't do something with it that makes people reconsider their next device purchase.

Google makes money from advertising. Google can make more money using private information with their advertising - as long as they don't do something with it that makes people reconsider using Google services.

There's a difference here but it's a difference of degree, not kind. At bottom, Apple and Google are both companies with incentives for collecting and using private information and risks that encourage them not to misuse it. You can try to squeeze a moral distinction out of the details, but it is spin, not substance.

randomsearch3• 11 years ago

There's a difference here but it's a difference of degree, not kind.

True, but what a degree, and the difference matters [1]:

- 91% of Apple's income is from hardware.

- More that 90% of Google's income is from advertising.

There's also a very big difference between trying to understand your customers better so that you can build a better mousetrap, rather than selling their information to third parties, directly or indirectly.

[1] http://www.zdnet.com/article/apple-google-microsoft-where-do...

QuantumRoar7• 11 years ago

Making a speech is easy, compared to actually doing the right thing.

Just a month ago, I was asked by an employee of an Apple Certified Service Provider to decrypt my hard drive in order for Apple to make a "hardware test". There was an issue with my display, but they insisted that Apple's hardware test needed to have access to the data on my hard drive and send information back to Apple via the Internet. What about privacy, now?

So, don't believe anything they tell you. If you want to be secure, you need to take care of it yourself.

Edit: Just to make it clear, the employees were asking me, to hand over my administrator password, which should be added to their database, in order for the technician to successfully run Apple's hardware tests. This is literally the most insane thing that ever happened to me...

etchalon4• 11 years ago

That's not even a little insane.

They needed access to something, and asked you for it to complete their work.

It would have been insane if the guy had just hit a button, and your data was decrypted.

As it stood, you were always in complete control of your data.

QuantumRoar7• 11 years ago

I added a little bit to my comment above. They are asking people for administrator passwords and put them into forms in their computer system. Rule number one of computing is that you shouldn't ever tell anybody your passwords. Asking for it is ridiculous. Considering how casual they acted, I can only assume that quite a lot of people actually told them. That makes me really worried.

iribe• 11 years ago

Yes, this speech is more marketing than anything. At the end of the day, just like with google, apple is sending your data to the cloud. Location data, they even have their own street view now...

CHY8727• 11 years ago

At an Apple Store, I've been asked this a few times. Then, I just say "I'd prefer not to" and have no problem.

QuantumRoar7• 11 years ago

Well, I was arguing with them for 10 Minutes. They tried to get my administrator password (because I use FileVault) and I refused. They wouldn't even look at the display issue (not software or data related) without the password.

In the end I just wiped the hard drive. They should've asked for that immediately.

kranner• 11 years ago

My out-of-warranty MBP needed a new battery because the original battery had started to swell up. I called my local Apple Authorized Service Provider (the only one within 250km) what the procedure was if I wanted to purchase a new battery.

They said I would need to drop off the computer with them; they would order a new battery and I could have it back in a week or so. I said I couldn’t do without the computer and I couldn’t let them access the hard drive (not encrypted) as I have proprietary data on it.

They said I could make the full payment and bring it in when the replacement battery arrives, leave it with them and collect it in a few hours. They insisted they could not replace it with me present and the minimum time I would need to leave it was 3 hours. This is easily enough time to clone the hard disk, which I did point out, politely, but they said this was the most they could do for me.

I ended up buying a third-party battery and changing it myself. It took less than 10 minutes. If it doesn’t last long, I’ll just have to buy a new Mac.

So yes, apparently there are no standards in place for data security as far as authorized service centres are concerned.

Margh• 11 years ago

Could have cloned the drive yourself and given them a nice clean factory new OSX install to snoop on.

jkestner2• 11 years ago

If Cook is serious, the message will have to trickle down to the people who make these processes to be sensitive to privacy needs. It takes some commitment.

unprepare• 11 years ago

This is akin to giving your car to a mechanic to repair but refusing to give him the keys in case he might make a copy.

terminus• 11 years ago

We believe the customer should be in control of their own information. You might like these so-called free services, but we don’t think they’re worth having your email, your search history and now even your family photos data mined and sold off for god knows what advertising purpose.

That's very sanctimonious of the CEO of the richest corporation in the world. Speeches are great but what would be even better is for them to deign to actually sell something to the poor, the people who cannot afford to buy into Apple's privacy respecting products.

threatofrain4• 11 years ago

Apple collects tons of user data, and I'm sure they use some of it to provide machine-learning backed services, and I'm sure they'll come out with much nicer products to compete with Google in the future, also enhanced by machine learning techniques.

The difference that Tim Cook wants you to believe in is that Apple doesn't directly make money from your data, they just use it to improve their product; alternatively, Google makes money from your data by providing advertises with guided access to your eyeball.

But the danger isn't in the fact that Google lulls you into complacency with free services. The danger isn't in the fact that Google sells guided access to your attention. The danger is just in the collection of data, and the fact that one day the government or somebody could find a way.

There's only one way to be safe. And that's to collect only minimal amounts of data for minimal apps. That means gimped Siri. No Apple competitor to Google Photos. And I don't think Apple will do that. I think they'll continue to amass all the data they use to improve customer experience. The fact that Apple makes money differently off the data doesn't change the fact that it's collection that's inherently dangerous.

Aissen4• 11 years ago

Actually, there's another alternative. Provide all these "insights" with offline, data-on-computers-you-own systems. The intelligence can be carried with you, without internet. This is traditional computing. Apple or Microsoft, or even any other competitor could provide that. They just need to sell you this software (oh and also build it first).

msellout• 11 years ago

Not possible. The insights come from the combination of everyone's data, not the analysis of any individual in isolation.

GaiusCoffee• 11 years ago

On-premise vs. Cloud?

pdkl95• 11 years ago

Apple doesn't directly make money from your data, they just use it to improve their product

Apple improves their products for several reasons, but as a for-profit business the main reason they would use some of their limited capital to "improve their product" would be to make money.

The details about how a business exploits user data is not that interesting. Arguments about this kind of minutia are a distraction and a waste of time. The problem is, as you say, the fact that they collect data at all.

That means gimped Siri

As Dan Geer said regarding the inevitable software-industry complains about liability legislation

    "Yes, please!  That was exactly the idea."

Some people may wish to trade their future privacy for whatever clever trinket is being sold. I believe that is usually a bad trade, but they have the right to make that kind of choice. What is not being discussed is how the people that use Siri (and similar live-microphone-with-network-access products, including newer "smart TVs") are making that privacy decision not only for themselves, but they are also imposing their choice on everybody else the microphone can hear.

In his recent (highly recommended) talk[1], Aral Balkan suggested a very interesting model, because there is another product that is well-known to adversely impact the people "near" the user as a secondary effect: tobacco. Siri, Amazon's Echo, and most of Google's services are like software "second-hand smoke". Like smoking, I don't care what you do in your own home. What we need - at a minimum - is new social conventions/etiquette where you ask permission or step outside before enabling any of these recording devices.

[1] https://projectbullrun.org/surveillance/2015/video-2015.html...

Silhouette3• 11 years ago

The third party surveillance issue is certainly one that needs more attention and consideration.

Not on a social networking site? Don't worry, they probably know a significant amount about you anyway, just from friends who have given the social network the entire address book from their phone and a few photos with you in them.

Decided not to use Google because you're not sure about how much data they collect these days? Don't worry, they probably have a significant proportion of all the e-mails you ever send from one of the other parties anyway, and you have no reliable way to determine when this is happening or to avoid participating.

And of course there are the numerous third party widgets that not only make the modern web a slower, sometimes malware-ridden, often ad-ridden mess, they also follow those not technically skilled enough to protect themselves around. Don't worry, they promise they won't tell your health insurer about the medical conditions you were looking up. No, wait, they didn't.

Now we have the kinds of technologies mentioned in the parent post, with smartphones and headsets and home automation systems that have sensors and network connections being placed just about everywhere, and we really are starting to live in a society with permanent surveillance.

In many ways, these kinds of issues are much harder to address than the already difficult questions of how to control first party data collection. Most of them by their nature operate in the background where a lot of people will never even know they are there, and even those who do may or may not be able to do much about it.

justaman2• 11 years ago

In a perfect world Amazon's Echo wouldn't record any voice other than that of the owner unless directly addressed == "Hey Echo, change the channel."

Social conventions would not/do not work as much as we would like.

makeitsuckless• 11 years ago

This is just a another way of saying "business good, government bad".

The fact that Google abuses the data and Apple doesn't is already a major difference. Just because government can use its monopoly on violence and imprisonment to go one step beyond doesn't make what businesses do harmless.

Yes, the collection is already inherently dangerous, and what Apple does is certainly not harmless. And yes, they will use that data to their advantage.

But the unscrupulous abuse of that data, the blatant disregard for privacy, a business model that depends on abuse of that data, and the obvious hunger for social and economic power by Google and co is not a minor difference.

amirmc• 11 years ago

"There's only one way to be safe. And that's to collect only minimal amounts of data for minimal apps."

No. The only way to be really safe is to go live in a cave, not to have any friends and never go anywhere near any tech ever again. I'm sure you can tell that I don't consider that to be much of an option.

It's unhelpful to label 'data collection' as the source of the problem as 'collection' happens everywhere in our interactions with the world. There are valid arguments and discussions to be had about who really owns that data. It may well be about me, but that doesn't necessarily mean that it's mine. I'd say the majority of people are only just beginning to understand that a discussion needs to take place even though technical folks have known this for a long time.

One solution to the 'ownership' problem is to make it possible for everyone to run their own infrastructure. i.e. have their own 'backend' that apps/services can be installed into, which their end-devices can then connect to. This is already possible for the technically savvy but a lot of work is needed before I feel we can trust such systems (I'm working on approaches to this [1,2], based on unikernels).

In the meantime, I applaud business models that are not built around profiling (which is the crux of the issue cf. advertising). They're the only ones where the incentives have any hope of aligning.

[1] http://nymote.org/blog/2013/introducing-nymote/

[2] http://amirchaudhry.com/brewing-miso-to-serve-nymote/

higherpurpose• 11 years ago

Or researching fast fully homomorphic encryption so they can one day be able to mine data while preserving strong user privacy.

hobs• 11 years ago

My thoughts are basically:

+ "Run your own infrastructure" is currently a pipe dream for what is 99.9% of people.

+ Companies selling data when they go bankrupt or M&As changing the nature of what they do with the collection happens regularly.

+ Discussing ownership is fairly simple as well, "Does the company already have your data?"

+ Any business not based around profiling has a additional options to make more money by selling their (your) data.

Why isnt excess data collection a problem? Is it because its very very hard to solve and if we pass laws bad actors will continue to flaunt them? Is it because we are past the point of no return?

Silhouette3• 11 years ago

Thank you for posting a well-balanced summary of the situation.

I think the biggest difficulty with balancing privacy concerns against other factors -- or even encouraging debate about and awareness of the issues among non-technical friends and family -- is that an item of data is itself neutral. It is how that data is used or combined with other data that may or may not be in any given party's interests.

Sometimes the exact same technology or data could be used for very good purposes, useful and generally harmless purposes, or hostile purposes, depending on the context. For example, consider automated number plate tracking of motor vehicles. If your child has been kidnapped and a witness caught the plate of the kidnapper's vehicle, you're going to appreciate the police being able to find and intercept that vehicle as quickly as possible. If you're an urban planner responsible for keeping transport infrastructure as efficient as possible in the face of a rising population, an aggregated data set showing how real travellers want to move around your city could be very useful, helping you make decisions that improve the system for everyone. If you're that same urban planner but on the side you're working with a load of jewel thieves and abusing your access to historical movement records to figure out when specific wealthy residents are usually away from their homes so the thieves can break in and then abusing your access to real time tracking to confirm that the residents really are out or warn if they come home early, that's not such a happy ending for the data subject. Analogous issues arise with many kinds of personal data, including more sensitive areas like financial or health data.

In the modern world, with vast databases and powerful data analysis tools and effectively instant communications and effectively unlimited storage, sometimes seemingly innocuous data can also give away a lot more about you than you might want or need. Things like what you bought at a store, or who you were tagged with in photos on social media, or a recording of you walking across a street on CCTV, can be used to determine many apparently unrelated things about you with relatively high (but, significantly, not complete) reliability, again sometimes quite sensitive ones that you might very much prefer to keep to yourself. Consider the store loyalty programme that determines a girl is pregnant from her purchasing patterns long before her partner or parents know. What about the person outed as gay because they were tagged with a whole group of openly gay people on holiday? Oh, by the way, unlike their friends in the photos, the first person lives in a country where homosexuality is still frowned upon and being open about it has real consequences. Also, gait analysis said you looked nervous as you walked into the airport, but it couldn't tell whether you just read a news story about a plane going down or you have inside knowledge of a terrorist threat, so unfortunately you won't be flying today. Just wait until automated text analysis software reaches the point that it can effectively de-anonymise posts like this one, and suddenly a lot of people who thought posting under a pseudonym was going to hide their criticism/whistle-blowing/advocacy of some controversial subject realise they weren't as safe as they thought and those comments are now permanently recorded on some public web site.

We therefore need to move beyond black and white assessments like "data collection is dangerous" or "social media sharing is fun". What matters is not just what data is collected, but also who has access to that data, what they are allowed to use it for (including for how long it's stored, what else it can be combined with, and the like), and crucially, how these things can effectively be controlled or regulated to ensure that everyone is playing by the rules when data is data and once someone has it for one purpose it can readily be used for another.

castell2• 11 years ago

It's more complicated. Apple's position as a hardware company that sells them with very good software is certainly the better position in comparison to Google, Microsoft & co.

Siri (as well as several other similar products) is based on Nuance technologies (speech recognition, text-to-speech, etc). It was recently in the news that Nuance outsourced their voice technology quality control (US based human workers listen to your voice data and checks the speech recognition quality, some workers mentioned they recognized single persons from reoccurring voice data). So your voice data is being processed by several parties.

The two big mobile OS vendors Apple and Google and also smaller players like Microsoft make it incredible hard to not-use their cloud storage&sync offering. Storage space is synthetically limited to low GB, with an high up price for additional storage. An SD-Card slot (= cheap extra storage, as a card is very cheap) is only available in Android devices (third party vendors hardware manufacturers like Samsung, Sony, etc.) but not from Google itself. All the inbuilt sync functionality only works with their own cloud storage, no third party cloud nor a simple sync over Bluetooth, Wifi or USB-cable. They could do better.

gesman• 11 years ago

Agree 100%.

Essentially Tim Cook said: "Apple is a good girl (we do the same things that bad girls do but better)"

flycaliguy• 11 years ago

It feels like the same underlining luxery branding of Apple products. Those guys are tacky and cheap, we are HBO. Apple doesn't even own a TV, they go to the art house theater...

With the car industry about do become part of the ecosystem it makes sense. Get in a Google Taxi and you'll have to watch targeted ads the whole way there. Get in an Apple Taxi and listen to classical music.

dmschulman• 11 years ago

Or the latest U2 album (and the doors lock once you enter the taxi)

minthd2• 11 years ago

It's even worse than that.Not using Apple's products is a good way to increase privacy. How ?

If you use Google's products(and who doesn't use Google Search ? ) , Google already knows plenty about you. And even if you don't use Google products, Google knows plenty about you, since it's tracking software is installed in large percentage of sites, etc.

And if you add machine learning on top of that , the amount that Google knows about you is great - even if you use Apple's products.

In reality, by using Apple's products, you don't gain privacy , you lose privacy - now two companies know a lot about you, instead of one.

dashoffset• 11 years ago

Isn't it better to have two companies that have partial information about you than one company that knows it all?

gwu782• 11 years ago

"Apple collects tons of user data..."

I gateway all my devices through one computer running a stripped down kernel. Through this host I monitor all attempted network connections. I block ads and of course this means I block Apple.

Apple devices are like beacons, attempting to contact a variety of Apple servers from the moment you turn them on and continuing to "phone home" incessantly 24/7 until you turn them off. That is only one example, but to me it is the most egregious.

Apple's competititors are no better. Do users really believe that one of these companies is going to protect them?

When the owner of a Chromecast plugs it in for the first time it tries to connect to Google to patch itself and prevent the owner from jailbreaking.

Perhaps my favourite was this patent application from Apple, with the CEO as a listed inventor.

http://www.google.com/patents/US20090265214

As for "providing advertisers with guided access to your eyeball" I believe that is what the App Store system does; it lets the app developers do the providing by embedding advertising into applications (cf. operating system, as in the above application).

coned882• 11 years ago

I gateway all my devices through one computer running a stripped down kernel. Through this host I monitor all network connections. I block ads and of course this means I block Apple.

Do you do this always via a vpn or something or was it just to try it out?

snom3203• 11 years ago

Have you analyzed this traffic to see what it is? I would expect some of it to be stuff like NTP, checks for internet connectivity and app store updates.

snom3203• 11 years ago

IMO, the main difference is that Apples gives you more choice in the matter. I can still choose to not enable iCloud, and only sync my iPhone / iPad to my computer. Also, for some data collection Apple explicitly asks you whether you want to share the data to improve its service (location data and crash report data, for instance)

hkailahi3• 11 years ago

At the moment, this thread seems more like a YouTube comment section than a HN one. Though it's not exactly surprising given that Tim Cook's speech is obviously aimed at Google/FB.

Let's start with the facts. Apple makes its major money in hardware. Google makes its major money in search. Obviously, iOS has to be able to compete with Android in order for iPhones to sell well. Google offers services like Google Now and Google Photos that can be tailored in a more personal and effective way. How? They collect as much data as they can get away with. Consumers get to have services that should be better suited to them because of this.

If Apple wants to compete, it seems that there are two options:

1. Start mass collection and become a better Google.

2. Reject Google's model, and build iOS around privacy and non-invasiveness.

That's what this is. I do think Apple will either make a search engine focused on privacy or buy one (e.g., DuckDuckGo). Personally, I am happy that Apple and Google are competing in this way.

collyw4• 11 years ago

The problem is that Duck Duck go doesn't provide as good results, because it lacks the personalized data. Google knows that when I search for Django I want the web framework. Duck duck go gives me that as well as many links to the film. I think option 1 is more likely for Apple.

hkailahi3• 11 years ago

I've been using DuckDuckGo as my main search engine for about a year now. It is good enough for me in most cases. For the times it isn't, I use Google.

I think there is a large amount of value in both of options 1 and 2. To me, the idea of Now on Tap and Google Photos is absolutely horrifying. On the other hand, my roommate told me that the Google Photos app was perfect.

I suspect that my views will hold, but it is possible that personalization becomes too important to opt out of. I tried to delete my Facebook for similar reasons recently. I missed out on enough party invites and messages from classmates that I ended up going back.

stephenr8• 11 years ago

Google knows that when I search for Django I want the web framework

That isn't a good thing. http://dontbubble.us

Unless Jamie Fox someday starts giving speeches about Django framework, this sounds like a pretty weak excuse to use a google-style (i.e. 'personalised') search engine.

I think option 1 is more likely for Apple.

Google's business model is basically selling aggregated user data - not in the form of raw data but in the form of targeted ads - for $0 (note, they aren't "free") services.

Apple's business model is about selling hardware and software, and providing a fairly complete ecosystem to use those products in/with.

Given that Apple's iOS+ecosystem accounts for close to 90% of the profits in the smartphone market, I don't understand this claim by people "Apple will have to adopt google's strategy to remain competitive".

If anything people are becoming more sensitive and more aware about the "creepy" factor of having all your personal information in the hands of some corporation that uses it for profit.

panglott2• 11 years ago

Is it really so much harder to search for "django framework" instead of "django unchained" or "django guitar"? When you type in "django", DDG will suggest some searches to autocomplete as well. Is the performance benefit of personalized searches really worth it, compared to refining your search technique in small ways?

Personally I prefer DDG simply because the bang codes are so convenient.

threatofrain4• 11 years ago

I don't think Tim Cook specifically rejects the collection of data on customers. I think he is pro-collection of data where it helps improve customer experience. His criticism is for companies whose model of business involves selling guided access to customer attention, aka Google and Facebook. His criticism is for what you do with that data. He would probably say that Apple uses its data to help its customers, while Google or Facebook "sells" out their customers.

From that communication, I read that Tim Cook is against some business models, not machine learning or data collection.

sangnoir4• 11 years ago

From that communication, I read that Tim Cook is against some business models, not machine learning or data collection.

Which sounds exactly like posturing to me. Contrast this with what he says about back doors - if it's there a key under the mat for cops, the bad guys will get it. The same applies to data collection - the motives behind the collection don't matter. If data is collected, sooner or later some of it will fall into the hands of a 3rd party the user didn't expect - possibly bad guys (through legal discovery, a hack, bankruptcy sale, or some NSA ALL-CAPS program).

The right thing for privacy is to not collect the data, but Apple is unwilling to take that business decision (imagine how bad Siri would be if voice data wasn't sent to a backend).

72deluxe12• 11 years ago

It makes me chuckle when you mention this being like a YouTube comment section, thanks! I always found it very sad that the comments section on YouTube is typically chock-full of disgusting insults, profanity and general horrible comments. It should be renamed the "abuse" section instead of "comments". It makes you lose any hope in humanity pulling itself out of the cess pool.

toxican2• 11 years ago

Doesn't the bulk of Google's money come from advertising, rather than search?

hkailahi3• 11 years ago

You're not wrong, but I wouldn't separate the two. The reason Google can have the #1 advertising platform is because it runs the #1 search engine. Search powers personalized advertisements, and is responsible for most of the money in Google's business.

bwilliams18• 11 years ago

The money comes from advertising that is placed on searches.

pmontra• 11 years ago

"It could be argued that it [(Apple)] doesn’t gather enough, as Google Now, Google on Tap and other holistic offerings have the potential to give users much more lateral movement and ‘delight’ moments on Android specifically due to how much data Google gathers on its users."

Many years ago, thinking about the future, I imagined to have a device that would give me more or less what Google Now can give me. What I didn't imagine is that it would be a central server to collect all of that information (about everybody) and send me only a feed. This is very mainframe-like and that was the time we were starting to use Personal Computers (IBM/Apple/any) so you could forgive my naivety. Still I think that's possible to build a Google Now without a server owned by a single central organization and there are things like this https://news.ycombinator.com/item?id=9204954 to prove it (and also prove how hard it is).

So I'm left with not using Google Now and most Google services (no Gmail) because I feel that letting a company access to all those information is creepy and a transitive distrust for every company in similar markets. Recap: what I want is my data only in my hands and clients that query servers and collect the information I need. No clouds thanks, those are good only for encrypted backups. If I want sync and continuity, that should go through a server I control.

pasta_2• 11 years ago

If what Tim Cook said could be easily discounted as puffery, it would be largely ignored by the Google fanboys. But the fact that you don't even have to believe what Tim Cook says or even trust him, because Apple's business model doesn't benefit from the perverse incentive that Google's does, is driving them crazy. And no iAd doesn't count, that's a service for third party developers to monetize their own apps. There are no ads in Apple's first party apps. It's also been criticized by advertisers because of Apple's protection of customer privacy. http://adage.com/article/digital/amazon-apple-catch-a-break-...

It's an interesting twist for HN, which is normally ready to take strong pro-privacy positions in the wake of the Snowden leaks under the premise of potential abuse by governments.

surferbayarea• 11 years ago

The internet was built on open peer-to-peer protocols. Email was designed to be p2p, not client-server like gmail is. In the near future, the fundamental structure of the internet as we know it today will change. All of a user's data, activity log etc generated by all the 100 sensors + services that a user uses will be centralized in a repository that will be owned by the user. Different services and tools and devices will just get on-demand access to the data as and when they need it to provide a service to the user. It will also require them to contribute any activity data back to this repository. This will lead not just to solving privacy, but way better user experience and services that are not possible today due to data silos. It is sad how corporations with an objective to make money(which it should be) have misguided internet to become a siloed structure designed to benefit different corporations. This incorrect structure needs to and will be broken...

erikb• 11 years ago

I've read many highly rated comments that state something on the lines of "Apple sells hardware not ads, so they don't want to collect your data". If we shorten this to "<somebody> sells <whatever>" then you already have the foundation of what requires data. Sales and marketing probably eat the biggest amount of money in any company. And they get better and cheaper with more data. That's why Google ads works so well. They can connect the right customers with the right products, because they have the data.

Therefore I'd say everybody wants all data about you they can get, including Apple, because everybody sells. I would guess they'll collect your data and call it privacy because they protect it against third parties, but they themselves wouldn't protect your data from Apple.

It also doesn't make much sense to really protect data. The supermarket in front of my office sells so called "Extra Cards" which advertise to not care about your data because you don't have to enter your name or something. That they still collect what you buy, when you buy, and where you buy they simply don't say and many people are fine with that. Even software developers have this card because they think their data is safe.

It's hip to sell privacy, it's not hip to really offer privacy.

plg• 11 years ago

In addition to the comments already here, I think this comes down to trust. Which companies do you trust? Which CEOs do you trust?

Eric Schmidt: "If You Have Something You Don't Want Anyone To Know, Maybe You Shouldn't Be Doing It." [1]

Mark Zuckerburg: "They trust me — dumb fucks." [2]

Tim Cook: "I’m speaking to you from Silicon Valley, where some of the most prominent and successful companies have built their businesses by lulling their customers into complacency about their personal information,” said Cook. “They’re gobbling up everything they can learn about you and trying to monetize it. We think that’s wrong. And it’s not the kind of company that Apple wants to be." [3]

Tim Cook: "Our business is based on selling products, not on having information about you. You are not our product." [4]

Tim Cook: "We take a very different view of this than a lot of other companies have. Our view is, when we design a new service, we try not to collect data" [5]

[1] https://youtu.be/A6e7wfDHzew

[2] http://gawker.com/5636765/facebook-ceo-admits-to-calling-use...

[3] http://techcrunch.com/2015/06/02/apples-tim-cook-delivers-bl...

[4] http://www.macrumors.com/2014/09/15/tim-cook-on-privacy/

[5] http://techcrunch.com/2014/09/15/tim-cook-holds-firm-on-imes...

sp3322• 11 years ago

Currently Mozilla is the only Internet company that I trust not to sell me out. And I'm keeping an eye on them as they develop the new New Tab, which will feature advertising.

htormey• 11 years ago

I know Mozilla are a non profit but doesn't most of their funding come from google (I.e advertising) for promoting their search product?

minthd2• 11 years ago

Words are cheap. Trust is gained by actions.

bengali3• 11 years ago

and lost by acquisitions and should be reconsidered after leadership changes.

ctb_mg• 11 years ago

Why the title case on Eric Schmidt's quote? Serious question. Can't watch the linked youtube video right now.

Oletros2• 11 years ago

Schimdt quote is taken out of context and it is not the whole quote.

snom3203• 11 years ago

Even with the context, it's pretty bad. And it's not like his other quotes on privacy paint a better picture.

magicalist5• 11 years ago

Actually I trust Schmidt more after that particular quote because he was warning about the Patriot Act before pretty much anyone but privacy advocates cared:

"People are treating Google like their most trusted friend. Should they be?"
"I think judgment matters. If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. But if you really need that kind of privacy, the reality is that search engines, including Google, do retain this information for some time. And it’s important, for example, that we are all subject in the United States to the Patriot Act. It is possible that information could be made available to the authorities."

But as I said below, that never got play back then, so we get the incomplete quote everywhere. It took Edward Snowden to make the tech blogs finally change narrative.

Also I'm not sure how an obviously poor sampling of quotes demonstrates much of anything. Even if you were doing some squishy sentiment analysis your study would still be thrown out for poor coverage.

nemik• 11 years ago

I'm unsure of how to reconcile the conflicting things Cook says, then does: http://www.businessinsider.com/apple-china-security-checks-o... China will ask for keys and Apple will give them up. I guess because China's a much bigger market than the US.

jgalt212• 11 years ago

I don't want to hear anything Tim Cook has to say on Public Policy matters until Apple stops dodging taxes.

Apple’s Tim Cook Delivers Blistering Speech on Encryption, Privacy

Related Stories