Chinese iCloud data moved to servers operated by state-owned telco

2»

Comments

  • Reply 21 of 30
    Rayz2016Rayz2016 Posts: 6,957member
    gatorguy said:
    Rayz2016 said:
    For its part, Apple has repeatedly said the move is a requirement for operating iCloud and other cloud services in China. The company last year said its Chinese servers do not include backdoors, adding that it would be control of iCloud keys, not GCBD. Whether the situation has shifted with the Tianyi agreement is unclear. 
    And this is the part that needs clarity: who has the damn keys?

    Apple has never stated that GCBD could not access iCloud data, and in fact acknowledges that GCBD can access a Chinese user's iCloud data.
    "...You understand and agree that Apple AND GCBD will have access to all data that you store on this service, including the right to share, exchange and disclose all user data, including Content, to and between each other under applicable law.

    Of note and something many here would not be aware of: There is no Apple iCloud service in China so they have nothing to operate. It's a GCBD operation under GCBD control and rules, with Apple as a junior partner who will sometimes be required to provide support. 

    Welcome to iCloud operated by GCBD

    THIS LEGAL AGREEMENT BETWEEN YOU AND AIPO CLOUD (GUIZHOU) TECHNOLOGY CO., LTD. (“GCBD”) GOVERNS YOUR USE OF THE ICLOUD PRODUCT, SOFTWARE, SERVICES, AND WEBSITES (COLLECTIVELY REFERRED TO AS THE "SERVICE").

    https://www.apple.com/legal/internet-services/icloud/en/gcbd-terms.html

    Simple logic will tell you that GCBD in order to run the service and ensure their interests are protected (!) must have control of the keys to do so, even if Apple also retains some control of their own. They are GCBD's partner, with GCBD in the driver's seat.  

    At least it will be a good day for Apple making sure this doesn't get much play on the web blogs or the news. There's a big money story coming in a few hours that will drag any attention away from this one. 

    Yeah, but who has the keys?

    Apple said some months ago that it would retain the keys, not GCBD.  The reason that the Chinese government wanted the data and the keys moved to the mainland is because they don't want to have to go through the US legal system to get access to the data. The data is living on a third-party hosted server in China, just like US iCloud data is hosted on third-party servers run by Google and Amazon. But without the keys, what's stored on those servers is unreadable blobs. Apple and GCBD having access to your data is not the same as them being able to read it. 

    Still, if Apple does have the keys, then it makes no difference; the Chinese will ask for access to a user's information, and Apple, in compliance with the law, will hand that information over. Given that, then I'd much rather they sent the legal request to GCBD.
  • Reply 22 of 30
    Rayz2016Rayz2016 Posts: 6,957member

    gatorguy said:
    ivanh said:
    Forget the back door. Now China Communist Party holds the front door key. Apple should seriously consider renaming the China iCloud as ChiCloud in order to set up a gateway from iCloud, in order to protect iCloud users in the world.
    It's no longer Apple's and has been renamed,

    Ah, good.
  • Reply 23 of 30
    gatorguygatorguy Posts: 24,176member
    Rayz2016 said:
    gatorguy said:
    Rayz2016 said:
    For its part, Apple has repeatedly said the move is a requirement for operating iCloud and other cloud services in China. The company last year said its Chinese servers do not include backdoors, adding that it would be control of iCloud keys, not GCBD. Whether the situation has shifted with the Tianyi agreement is unclear. 
    And this is the part that needs clarity: who has the damn keys?

    Apple has never stated that GCBD could not access iCloud data, and in fact acknowledges that GCBD can access a Chinese user's iCloud data.
    "...You understand and agree that Apple AND GCBD will have access to all data that you store on this service, including the right to share, exchange and disclose all user data, including Content, to and between each other under applicable law.

    Of note and something many here would not be aware of: There is no Apple iCloud service in China so they have nothing to operate. It's a GCBD operation under GCBD control and rules, with Apple as a junior partner who will sometimes be required to provide support. 

    Welcome to iCloud operated by GCBD

    THIS LEGAL AGREEMENT BETWEEN YOU AND AIPO CLOUD (GUIZHOU) TECHNOLOGY CO., LTD. (“GCBD”) GOVERNS YOUR USE OF THE ICLOUD PRODUCT, SOFTWARE, SERVICES, AND WEBSITES (COLLECTIVELY REFERRED TO AS THE "SERVICE").

    https://www.apple.com/legal/internet-services/icloud/en/gcbd-terms.html

    Simple logic will tell you that GCBD in order to run the service and ensure their interests are protected (!) must have control of the keys to do so, even if Apple also retains some control of their own. They are GCBD's partner, with GCBD in the driver's seat.  

    At least it will be a good day for Apple making sure this doesn't get much play on the web blogs or the news. There's a big money story coming in a few hours that will drag any attention away from this one. 

    Yeah, but who has the keys?

    Apple said some months ago that it would retain the keys, not GCBD.
    I don't think they ever said that GCBD would not also have "the keys". Perhaps I'm wrong. Can you point me to the official Apple statement on it? IMO you're misconstruing what Apple actually stated. 
    edited July 2018
  • Reply 24 of 30
    ksecksec Posts: 1,569member
    $300 , or even $400. That is the amount I am willing to pay to pay a iCloud Server at home. Or more like TimeCapsule for iOS. 

    why cant Apple just make one? Instead they try to get you sign up to their "services" to increase its revenue.
  • Reply 25 of 30
    blah64blah64 Posts: 993member
    ksec said:
    $300 , or even $400. That is the amount I am willing to pay to pay a iCloud Server at home. Or more like TimeCapsule for iOS. 

    why cant Apple just make one? Instead they try to get you sign up to their "services" to increase its revenue.

    Bingo!!

    Ultimately this is where we should all be striving to be in the future, and it's a passionate interest of mine.  You've set your price of $3-400, but I think for many people anything more than $100-$150 would be a hard sell, and frankly, for most (ignorant) non-tech people, anything greater than "free" is more than they want to consider.  Even if "free" isn't really free.

    It's also a lot harder to do what you're talking about than you think.  At least at scale.  Remember, even if the encryption is rock-solid, the code is 100% bug free, etc., it's not easy to protect individual servers running on home networks from even medium-scale DoS type attacks.  You'd have to subscribe to (yet another) service to help, and I'm honestly not sure how well they can help in those kinds of scenarios.  Most centralized systems suck from a privacy standpoint and from a cost standpoint, but they are easier to protect -- and even then they're not perfect.
  • Reply 26 of 30
    ksecksec Posts: 1,569member
    blah64 said:
    ksec said:
    $300 , or even $400. That is the amount I am willing to pay to pay a iCloud Server at home. Or more like TimeCapsule for iOS. 

    why cant Apple just make one? Instead they try to get you sign up to their "services" to increase its revenue.

    Bingo!!

    Ultimately this is where we should all be striving to be in the future, and it's a passionate interest of mine.  You've set your price of $3-400, but I think for many people anything more than $100-$150 would be a hard sell, and frankly, for most (ignorant) non-tech people, anything greater than "free" is more than they want to consider.  Even if "free" isn't really free.

    It's also a lot harder to do what you're talking about than you think.  At least at scale.  Remember, even if the encryption is rock-solid, the code is 100% bug free, etc., it's not easy to protect individual servers running on home networks from even medium-scale DoS type attacks.  You'd have to subscribe to (yet another) service to help, and I'm honestly not sure how well they can help in those kinds of scenarios.  Most centralized systems suck from a privacy standpoint and from a cost standpoint, but they are easier to protect -- and even then they're not perfect.
    2TB iCloud is $9.99 Even at 24 months that is $240 already.

    May be a TimeCapsule doesn't have to face the Internet. I want to backup when ever I am in home with WiFi. Within Apple's purchasing power, in house Controller, it is entirely possible for Apple to put out a TimeCapsule with 1TB SSD and sell for $300, all with their usual margin. When you discount iOS, Apps, Apple Music, most people has less then 100GB to Backup. 1TB allow all your family's iPad, iPhone to backup under one devices.

    In a idealistic world, all of our Data would be in cloud and we have 1Gbps Internet Connection, and government cant touch our Data without many steps in warrants. But unfortunately we don't live in that world.
  • Reply 27 of 30
    gatorguygatorguy Posts: 24,176member
    ksec said:
    blah64 said:
    ksec said:
    $300 , or even $400. That is the amount I am willing to pay to pay a iCloud Server at home. Or more like TimeCapsule for iOS. 

    why cant Apple just make one? Instead they try to get you sign up to their "services" to increase its revenue.

    Bingo!!

    Ultimately this is where we should all be striving to be in the future, and it's a passionate interest of mine.  You've set your price of $3-400, but I think for many people anything more than $100-$150 would be a hard sell, and frankly, for most (ignorant) non-tech people, anything greater than "free" is more than they want to consider.  Even if "free" isn't really free.

    It's also a lot harder to do what you're talking about than you think.  At least at scale.  Remember, even if the encryption is rock-solid, the code is 100% bug free, etc., it's not easy to protect individual servers running on home networks from even medium-scale DoS type attacks.  You'd have to subscribe to (yet another) service to help, and I'm honestly not sure how well they can help in those kinds of scenarios.  Most centralized systems suck from a privacy standpoint and from a cost standpoint, but they are easier to protect -- and even then they're not perfect.
    2TB iCloud is $9.99 Even at 24 months that is $240 already.

    May be a TimeCapsule doesn't have to face the Internet. I want to backup when ever I am in home with WiFi.
    Aren't you asking for a NAS?
    https://thewirecutter.com/reviews/best-network-attached-storage/

    Anyway, PatentlyApple's Jack Purcher is nailing Apple hard about issue, which I personally found a little surprising as I had always considered them a highly pro-Apple site.

    "...It's a little disturbing that Apple will give up customer information to the Chinese Government on demand. Some in China must be in shock that Apple has betrayed their trust. But at the end of the day Apple is a business and pretending to stand on principles about protecting your data is simply a marketing exercise and no more. Don't be fooled. 

    It's now clear that this is the route that any foreign government could take in the future in order to break Apple's holier than thou stance on handing private data. China has shown them all the way. Pandora's Box has now been opened and other foreign governments with any clout are likely to adopt China's policy on privacy over time and that's the sad reality of the day."


    edited July 2018 muthuk_vanalingam
  • Reply 28 of 30
    mike54 said:
    The NSA snoops on data/products in the US, that's a fact. Cisco products come with NSA approved backdoors. Microsoft also works closely with the NSA, hence China has asked to see the source code for it and there a special edition for the Chinese gov. No one should be complaining because another country does the same. China does not make US laws, nor should US make Chinese laws.
    China imprisons hundreds of thousands, scowl media constrains millions and executes thousands for opposition to their one party dictatorial regime. If you are American you should hang your head in shame for your failure to see the difference.
  • Reply 29 of 30
    genovellegenovelle Posts: 1,480member
    gatorguy said:
    mike54 said:
    The NSA snoops on data/products in the US, that's a fact. Cisco products come with NSA approved backdoors. Microsoft also works closely with the NSA, hence China has asked to see the source code for it and there a special edition for the Chinese gov. No one should be complaining because another country does the same. China does not make US laws, nor should US make Chinese laws.
    Apple didn't have to turn over any of their services to the US government to run. That's what's unique about this. 
    Well remember we blocked one of their smartphone providers because we deemed them a security threat. Basically, because their servers that support their products are in China. Same thing. 

Sign In or Register to comment.