Jeffery Paul, a Berlin security researcher has a complaint about the latest OS X version:
"Fast forward to 10.10. Presumably to support Continuity, current document state is no longer only saved locally - those in-progress (not yet explicitly “saved”) documents live in iCloud Drive, so that they can be opened on other devices without ever having to hit “save”. This is useful, however, all of my previous open files have now been synchronized to Apple servers.
Notice that all of my locally-stored, “unsaved” documents open in my text editor have now been uploaded in full to a partner in NSA’s PRISM program. This happens for all applications (think iA Writer, Pixelmator, etc.) that had saved application state. Any open and yet-unsaved document within an app is now silently and automatically uploaded to iCloud Drive, and, by extension, the government.
Apple has taken local files on my computer not stored in iCloud and silently and without my permission uploaded them to their servers - across all applications, Apple and otherwise.
(Score: 1, Insightful) by Anonymous Coward on Monday October 27 2014, @02:35AM
It is an interesting, but not surprising revelation, given that "The Cloud" is the rage and wave of the future. It is also very useful to know that this apparently is an unannounced change to the default behavior (which can apparently be disabled), much like Facebook quietly but fundamentally changing their privacy policies. However, to put in "uploaded in full to a partner in NSA’s PRISM program" is hypocritical clickbait. If he has such a problem with Apple being a partner in PRISM, then why the hell is he using Apple products to do his work? Oh, by the way, he is a "security researcher" and consultant who I'm sure profits in no way from breathless security hyperbole (and he is in Berlin; like how he threw PRISM in there?).
(Score: 2, Insightful) by Anonymous Coward on Monday October 27 2014, @03:03AM
While I don't strongly agree or disagree with many of the points you've raised I do feel the need to point out the obvious. It matters not that he is in Berlin or anywhere else for that matter when programs like PRISM are involved (right?).
(Score: 1, Interesting) by Anonymous Coward on Monday October 27 2014, @03:26AM
No, I agree with you, but don't you find it strange to pull the PRISM card? It wasn't my first reaction reading the headline that local data was being uploaded to iCloud was "OMG! The NSA is after me!!!" Berlin is relevant here because the PRISM stories played very big in Germany.
In the US there is a large home security company, ADT, who run ads showing a mother and child home alone at night, and a scary-looking burglar sporting prybar and/or weapon trying to break into their home but ultimately being thwarted by the ADT security system. The ad ends with scared but relieved woman saying and/or implying what horrible things would have happened were it not for the security system. That kind of eye-rolling, over-the-top ad is how this blog post struck me as soon has he tossed in the PRISM reference. Again, if he has such a problem with Apple and PRISM, why is it his computer of choice?
(Score: 0) by Anonymous Coward on Monday October 27 2014, @03:36AM
why is it his computer of choice?
Prior to this maybe he was OK not saving his documents to the cloud, then he ran osx update and discovered he no longer gets that choice and is now telling everyone about it.
(Score: 4, Informative) by hemocyanin on Monday October 27 2014, @04:39AM
Have you ever used a text editor to write a document, say a list of passwords -- not just to places like SN, but maybe the 80 character pass-sentence you use for whole disc encryption on a system you don't boot up frequently -- and then encrypted that document with GPG? This could be a very serious issue.
Secondly, I have a huge problem PRISM. I also very much like my Macbook Pro -- it's an excellently built machine and very nice to use. I treat it for what it is though -- a potentially infected snitch and I'm aware of what I do with it and try to be aware of the ways it could bite me. So I found this story very informative and I appreciate the PRISM reference just in case I was too sleepy, drunk, distracted, or whatever to make it myself.
I also don't really feel that comfortable with Linux at the moment either. I'm a long time user but computer systems are so complex, it is easy to misconfigure something even for the people whose sole job is computer security (which my job is not) (and of course humanity would suffer if everyone had the same job). Often, I've purposefully made my Linux systems less secure (installed Flash to watch youtube as well as many different programs because honestly, I want more than just a shell (speaking of which ....)). Anyway, I'm pretty convinced there is no way I could be certain about the privacy of my internet usage or the security of my systems. I've sort of gamed out in my head, what I would have to do have some sense of anonymity if I wanted to search for something in secret, and I've concluded I don't have the skills to actually do it:
Even then, I would think there are going to be issues I haven't even considered. After thinking all that through, I have decided to treat every computer I use as if it was infected because I just don't think that I, in my evenings after work, would be able to actually secure my devices with any great certainty.
(Score: 3, Informative) by mojo chan on Monday October 27 2014, @08:29AM
It's easier to just use a Tails live CD. Pre-build Linux environment with Tor, spoofs your MAC address, nothing saved anywhere.
const int one = 65536; (Silvermoon, Texture.cs)
(Score: 2) by hemocyanin on Monday October 27 2014, @02:42PM
That's my step 7, except I'd boot from a USB stick for performance reasons. LiveCDs sort of suck performance wise.
(Score: 0) by Anonymous Coward on Monday October 27 2014, @04:34PM
But CDs are harder to compromise than USB sticks.
(Score: 2) by hemocyanin on Monday October 27 2014, @07:47PM
I totally agree, but what about a complete reformat of the USB stick between uses? Maybe a multipass write of random data (*), then a reformat, then reload the OS from an ISO. I only cringe at the CD option because of the performance issues.
(*) is this necessary with non-magnetic media?
(Score: 3, Insightful) by mojo chan on Monday October 27 2014, @08:32AM
It's a question of control. Silently expanding what is stored without very clear, up-front warnings is extremely bad form.
const int one = 65536; (Silvermoon, Texture.cs)
(Score: 1, Interesting) by Anonymous Coward on Monday October 27 2014, @03:37AM
I didn't think this was a problem at first. I'd had to specifically upgrade to and enable iCloud Drive. It wasn't the default setting. Moreover, there's a preference pane for specifying which apps can interact with iCloud, so I can specify which applications work with iCloud. I thought I knew what was and wasn't uploading.
Then, I was dismayed to see DayOne active in the preference pane. It's a journal for recording one's private thoughts, and I'd specificlaly disabled iCloud syncing within the program prior to installing Yosemite; I'd been through a rough patch and used DayOne to get me through it, and I'd disabled iCloud syncing prior to Yosemite because I didn't want those thoughts going onto anyone's server, no matter how secure. The upgrade to iCloud Drive put the saved application state there. That's bad, because DayOne doesn't actually encrypt any of the journal entries, despite having a "password" feature on its own interface. It's these kind of third-party applications that you might not be expecting to use iCloud that are the problem.
Apple could (and probably should) fix this by defaulting all programs not to use iCloud Drive, and making the user explicitly grant permission to upload state data for each program, rather than going with an opt-out approach.
(Score: 2) by emg on Monday October 27 2014, @04:50AM
Frankly, I'm getting to the point where I'm about ready to buy another computer that's never connected to the Internet to do all my important work on. Doesn't seem like I can trust anyone not to send all my files to some remote server without permission.
(Score: 1, Insightful) by Anonymous Coward on Monday October 27 2014, @05:32AM
The problem is not the internet connection but the proprietary software abusing you.
(Score: 0) by Anonymous Coward on Monday October 27 2014, @02:22PM
Doesn't have to be proprietary software. Free software is turning to a "take it or leave it" attitude too. Suppose the authors of systemd (not a troll!) decide to put your logs on "free cloud storage"? And deciding that they know better than you, don't give you an option to turn it off? You can patch it yourself, but every security upgrade, your patches are lost. It's like tilting at windmills, but OTOH when many of us moved to Linux back in the day, we had to deal with many more little hassles.
(Score: 2) by RedBear on Monday October 27 2014, @09:54AM
I got confused about the NSA PRISM partner part. Took me three reads through the page to realize he's only referring to Apple. So he's complaining that his files and saved states and such are being uploaded to _his_ iCloud Drive. Which is encrypted. And I believe if you activate two-factor authentication Apple can't decrypt you're data, for you or the government. I could be wrong about that though.
Also, the article title here is very confusing and apparently incorrect. Not sure if that's the submitter or the editor's fault. The data is being uploaded to the user's own encrypted iCloud Drive, not "outside of iCloud Drive". Sooo... since there has never been any actual evidence that Apple has ever partnered with the US government to reveal user data beyond legitimate, warrant-based legal law enforcement requests for information from individual user accounts, I'm not exactly sure what all the excitement is about.
I would be forced to say to the author of the page at the link that telling him to simply turn off iCloud Drive is not, in fact, "missing the point," as he claims. It is the precise solution to his problem. Turning off iCloud Drive and iCloud in general will give him exactly what he seems to be looking for, and nothing will be uploaded to Apple. All his data will stay local on his machine. If he doesn't trust Apple to secure his data in iCloud, he kinda, sorta, shouldn't be using it, maybe?
Yeah. I don't get it.
¯\_ʕ◔.◔ʔ_/¯ LOL. I dunno. I'm just a bear.
... Peace out. Got bear stuff to do. 彡ʕ⌐■.■ʔ
(Score: 1) by drgibbon on Monday October 27 2014, @03:59PM
I agree that iCloud should not be used if you don't trust it. But at the same time, looked at broadly, it is a disturbing trend for the majority of people. Most people will enable these things by default, and assuming such data IS available to third parties, then we're creating this worldwide surveillance system of terrifying proportions. We know that NSA/PRISM & friends does not work like "here's a warrant, look this guy up". I mean, there have already been abuses of the system outside of that, but that hardly even matters when the system itself is a broad social abuse. Apple is a provider [washingtonpost.com], and while I have no idea of the specifics of iCloud, it is known that the NSA has been systematically weakening Internet security for some time, including SSL/TLS. I mean we're talking about guys that create secret courts and secret laws, lie/deceive repeatedly, gag companies from disclosing what is happening, etc. On the apparently infinity long coat tails of 9/11, public communication networks have become military space, and sensible social policy based on any semblance of rights, openness, and communication has been replaced en masse with deception, aggression, and military/government surveillance. Although I didn't take the time to RTFA, I don't see a problem with logically connecting PRISM and automatic uploading of everything you write/edit/do on your computer.
Certified Soylent Fresh!
(Score: 2) by RedBear on Monday October 27 2014, @06:30PM
By all means feel free to maintain your tinfoil hattery in being generally distrusting of balancing the benefits of interconnected computers with the risk of helping the surveillance state. I am just as much against the surveillance state as you are. But the direct implication of this article is that there is something horribly wrong specifically with the security of Apple's iCloud Drive, with the secondary implication that everything uploaded to your own iCloud Drive account on Apple's servers goes straight from there to the US government. Yet there is no evidence given for either of these assertions. It is therefore not logical at all to jump straight from "my own files are being uploaded to my own encrypted cloud storage account" to "NOW THE GUMMINT HAS ALL MY SEKRIT FILEZ BECAUSE PRISM!!1ONE!!".
The Continuity and Handoff features in iOS 8 and OS X 10.10 Yosemite work via local networks, Bluetooth and iCloud. The features can be easily turned off if you don't trust Apple, by simply disabling iCloud Drive or not logging into iCloud at all. But if you're so untrustful of Apple in general, it would be equally "logical" to conclude that nothing on your local Apple computer is safe from the government either, whether you've encrypted your drive or not, so why use an Apple computer at all, especially if you're going to use their operating system on it. The solution to not trusting Apple is to avoid using anything made by Apple in the first place, not to complain that having your own encrypted data uploaded to your own encrypted cloud storage account is "unacceptable".
Until evidence is presented of any specific security vulnerability or Apple's willing collusion with the surveillance state by giving unfettered government access to their servers, this is just straight-up illogical conspiracy theorist idiocy. One PRISM PowerPoint slide with an Apple logo notwithstanding.
I am disappointed that something this silly even appeared on this site when there are plenty of perfectly fact-based legitimate security issues with Apple's software and cloud offerings.
¯\_ʕ◔.◔ʔ_/¯ LOL. I dunno. I'm just a bear.
... Peace out. Got bear stuff to do. 彡ʕ⌐■.■ʔ
(Score: 1) by drgibbon on Monday October 27 2014, @07:55PM
You have got to be joking, it sounds like you beamed in your post from the year 2000. There's no "tinfoil hattery" here, and your "NOW THE GUMMINT HAS ALL MY SEKRIT FILEZ BECAUSE PRISM!!1ONE!!" pushes the same silly logic that privacy is about "secret filez" and "secret business". I would say that from the leaks, Apple & co already do give access to their servers, but we cannot prove that iCloud itself is compromised. You want some direct proof in this instance that you are not going to get, but I think we've seen enough of the depth and breadth of the intelligence communities subversion of Internet security and trust that you would be a fool to maintain this "show me evidence for each specific case or I believe nothing". And this argument, "oh ok, so don't trust Google, don't trust Apple, don't trust Microsoft blah" is utterly worthless if those corporations dominate computing in the world.
The guy's point is that things are being uploaded which people may not have wanted uploaded (and yes, there's reasonable chances that this data is accessible by third parties). Granted, this is an extremely minor aspect is the privacy battle that's going on, but it's hardly unwarranted.
Certified Soylent Fresh!
(Score: 2) by zeigerpuppy on Monday October 27 2014, @02:59PM
I tried Yosemite. It leaks data like a sieve, so many calls on apps and daemons to apple servers with all their services turned off.
But the real deal breaker for me was that it breaks local shell variable support. This screws with a whole lot of programs including LyX, SublimeText and others.
It basically broken as a unix like os, looks like mavericks is my last version of osx
(Score: 2) by kaszz on Monday October 27 2014, @06:05PM
Why not block apple.com or just plainly whitelist sites that are ok? it should give most of these kinds of opportunistic data leaks a hard time?
(Score: 0) by Anonymous Coward on Monday October 27 2014, @06:22PM
Because if that becomes common practice, they'll use apple1e100.net?
(Score: 1) by Wrong Turn Ahead on Monday October 27 2014, @10:19PM
Stop. Buying. Apple/Microsoft/Cisco/(whatever). They all suck and they don't give a damn about you. I love conspiracy bacon as much as the next guy but this article is not tinfoil-hattery; the author is correct...