cyphunk

Actually it's been reported very widely in Germany as well with exactly this headline.

Is the connectivity layer considered: Is the 3rd party "proxy" handler uploading the information using an Apple ID? Does Apple record, store IP information? It seems to me that by using this system you volunteer to send data to Apple constantly which may not reveal your GPS location but will reveal your network location.

I'm happy to see someone trying to innovate in this space. I still wonder if it is okay for journalists and risk affected users to use this or if they should be advised to avoid it.

Buying max RAM from start is a $200 extra which may validate saved space. Not justified is soldered SSD. Ive doubled SSD size once a year to extend laptop life by 6 or 7 years.

The comments in this thread indicate clearly, I think, why we should never listen to engineers on social topics and questions.

Note that these models are created in an era of great inequality. You can expect that if at any point a correction is made to this disparity these numbers will also be effected.

Additional information about the companies use of slaves.

https://en.wikipedia.org/wiki/Dutch_East_India_Company#Slave...

also if in the future we actually make cellular standards where encryption isn't demarcated at the tower and instead setup e2e between consumer devices, some risks are mitigated

it's really a shame that with both 4g and 5g standards bodies did not already work on this.

most abuse mitigated by their limits on the number of downloads allowed and how many days it can stay online. Currently at 7 days max and 100 downloads. If they see abuse they could reduce this further.

about revenue, there are so many valuable directions this can go. It could undercut competitors in ways they cannot sufficiently respond to. (google responding in kind would leave them less reason to not add encrypted storage for drive) By stabilizing this platform they can start to build new privacy-enhancing apps on top. Calendar, contacts, etc. With more dependency on the platform, they will find areas where more storage, longer retention, will be income generating.

privacy may be the only frontier that can displace google,apple,microsoft.

There are many use cases where compromise through code-interdiction after warrant is a perfectly acceptable risk. Also considering what it replaces may further increase the weight of privacy gain. Absolutism is definitely not the way to go, and looking at the state of the tech community (eg. npm, apt, pip, pacman, check that sha256 sum) we left the design-it-right-first a long time ago. A valid argument, though I wouldn't defend it to the death, is that we need to work slowly back toward more secure behaviors rather than chasing absolutely secure technologies. I think send.firefox is a step back from dropbox for some.

Could someone explain why this is on HN? I ask because this comes up often on other non-tech topics. Personally I'm happy these topics can be discussed here.

Overlooked: the apathy required to become techno-mercenaries started with the agents convincing themselves that spying on nationals was different than foreign nationals while working in the NSA. To resist this apathy cyber intelligence agents working for any government/corporation should deploy a moral compass that assumes they are working for the UAE.

This also begs for international conventions. New international conventions would provide a psychological back-stop against the infosec industry's unchecked nationalism. When an agent asks themselves "is what I am doing okay" international convention and law would give them an alternative to compare with other than the militarist default of "yes".

most comments are thoughts and opinions and only few provide new critique. The OP comment here, though presented in an obnoxious way, is new critique because no one else has discussed the civil liberty bias deployed by agents. Though the OP presents this in an offensive way, which is maybe breaking a different rule than just "new critique"

Taking the sources of the article on their word...

They said the tools use faded in late 2017 due to apple patches and that compromise required only sending a text message. Examining CVE's up until late 2017 may give more of an idea of how this tool worked. Judging from a cursory review, there are many remote code exploits so it would be hard to narrow down. But this is what I chose to look at when considering CVE's between Jun 2017 and Dec 2017 that could effect iMessage. Many of these are classified as Denial of Service bugs but often those can be extended to code execution with extensive research.

IOKit https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

IOMobileFrameBuffer https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

CFString https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

CoreText https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

CoreText https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

Fonts? https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

ImageIO https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

Messages https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

SQLite https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

SQLite https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

SQLite https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

SQLite https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

SQLite https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-20...

Kernel: too many to count

These were compiled by reviewing the apple security mailing list https://lists.apple.com/archives/security-announce/2017

I can't see how autonomous cars and Musky holes will be good for common people and not just turn into another form of exclusive transport for the rich.

until recently i tried using firefox to quarantine social media and google but the persona extensions would break all the time, leaving me to reconfigure things over and over. Is there another way to quarantine now?

Not about BAT,cryptocurrency. It's all about usable privacy. Makes it easy for me to quarantine Google services, social media, from each other. Privacy as the killer feature is what makes it killer

eventually this (e2e encryption everywhere) will happen once governments realize their security and secrecy depends on the security of consumer technology and to protect the public is to protect themselves.

This doesn’t explain how amazon has removed capability for themselves to mitm the whole process. Or perhaps I missed that part somewhere?

Your a stasi department in charge of monitoring the activity of privileged children (able to afford and get smuggled goods which from what I’m told was something most stasi family could afford to do) whom many probably have parents above your pay grade... what to do?

Is the OP Swiss and wants it hosted where he/she lives? I'd be fine with that as an alternative to US, but do not understand why that would be better than, say, Sweden

Are there by chance any samples with Arabic in this framework? Hoping it resolves the large size disparity between Latin and Arabic font sizes

This could be a tradeoff. But also, I have full disk encryption and an index I can search that is itself encrypted. Eventually doing this over internet wires will not be an issue, and may not be much of an issue for many already.

To your second point: indeed this could be run locally instead, if one is that concerned about storing sensitive information online

A defense contractor for the CIA named John Reidy claims he warned the agency that it was using insecure communications systems in 2008, and again in 2010 when he started to suspect the channels had been cracked. A year later he was fired by the agency, a move he claims was retaliation for not shutting up.

strongbox.gov is needed to protect people with brains from being strong-armed by management without brains:

https://medium.com/@cyphunk/the-nature-of-conflict-is-changi...

Landgrabbing is always unexpected

I would like to use this product but it feels irresponsible to do so. Why are we still making technology that stores such personal information without data being encrypted end-2-end?

Companies paying workers 3 to 10 times the average wage for an area adds real stress. Berlin's problems are that, and also:

+ A global shift toward freelance and remote work letting people take a risk and move to a new place.

+ The first German renaissance back toward the east after the wall fell. The older generation in the west still remember Berlin and people from Berlin in a negative light, but their children have quiet a different impression and their parents are alltohappy to buy property for them in under-priced Berlin. Additionally reunification gutted all industry in the east causing a renter exodus to larger east German cities

+ A global debt surplus and rich people everywhere looking for stable places to stash wealth with Germany's open markets an attractive destination. In some odd way financially conservative Germans think they win with this, not considering how it increases costs of all social services and thereby their tax burden as well.

Focusing on overpriced jobs is definitely only one of many places to start. Google just made it very easy that people target them first because their products are so disliked for their lack of care for privacy: post-snowden I'm not sure I know of a single service Google has switched to being e2e encrypted.

It's not about being smart enough. It's about time required to retrain and the cost to do so. Until Google, or PeidPeiper, have a on-job training program sufficient enough that they can walk into every Shop of Kreutzberg and say "here, we we'll teach you the skills you need just come work for us" -- we should assume their setting up shop will displace a ton of people. Until those companies add to that "and we'll pay your cost of living until you transition" their movement into a neighborhood should perceived as a Tax by the state.

The problem with "guess they don't want jobs" argument is that Google is not like Ford Motor Company. When they move into your town and your rents double you can't just be retrained. When a company that requires special skills moves in they kick people that do not have those skills out.

Absolutely! Everyone I spoke with and suggested google move into the newly built and absolutely hated Stadtschloss in the center loved the idea.

Actually a large faction of the protest has been getting local businesses off of google services and educating a thirsty public about alternatives. Most people in kreutzberg already thought of google as evil. their foothold organized people around removing it from their lives, regardless of how impossible that is