Apple's Tim Cook attacks Google and Facebook over privacy flaws
|
Version 0 of 1. Apple chief executive Tim Cook has fired a new salvo against Google and Facebook, emphasising in an open letter to customers that Apple doesn’t build profiles of its users from their email content or web browsing habits “to sell to advertisers”. While not mentioning either of its two main rivals, Cook’s letter marks a clear effort by Apple to play on rising concerns around privacy and the use made of peoples’ personal data. “Our business model is very straightforward: we sell great products,” Cook writes. “We don’t build a profile based on your email content or web browsing habits to sell to advertisers. We don’t ‘monetise’ the information you store on your iPhone or in iCloud. And we don’t read your email or your messages to get information to market to you.” He says Apple’s iAd system, used by some developers to monetise ads, and to provide adverts in the free US-based iTunes Radio service, “sticks to the same privacy policy that applies to every other Apple product. It doesn’t get data from Health and HomeKit, Maps, Siri, iMessage, your call history, or any iCloud service like Contacts or Mail, and you can always just opt out altogether.” Cook’s letter comes as Facebook has launched a low-key campaign to reassure users about privacy, following controversy about the access demanded to users’ phones by its Facebook Messenger app, which the social network’s users employ to send private messages. The social network has also had to fend off criticism after it revealed that it had tweaked some users’ news feeds as part of an experiment to see if their emotions were affected. Google must match Apple for user privacy, says Soghoian Google meanwhile is still being investigated in Europe by privacy commissioners from a number of countries over the changes that it made in 2012 to its privacy policy, in which it unified information about how individuals used its different products, such as search, mail and the YouTube video service. Security experts meanwhile welcomed a statement from Apple in which it said that it will no longer hold encryption keys for customers’ devices running its new iOS 8 software, meaning that it will be unable to decrypt them for governments or law enforcement - even if demanded to. Chris Soghoian, principal technologist at the American Civil Liberties Union (ACLU), commented that “The public has said they want companies to put their privacy first, and Apple has listened.” He called on Google to match Apple’s lead in end-to-end security for user messages in its built-in messaging product iMessage and FaceTime video calling service. “Google has 300+ people on their security team, some of the best in the industry. Google could make amazing, surveillance-resistant products,” he commented. “Google should be called out for failing to deliver secure IM [instant messaging]. It isn’t that hard.” Responding to Heather Adkins, a Google security team member who replied that “I chat securely on Google’s [Android] platform every day”, Soghoian responded: “I carry two smartphones. My iPhone sends end-to-end encrypted IMs by default. My Android device doesn’t.” The Android platform, Soghoian said, has no device encryption by default, “rarely” gets security updates, and has no end-to-end encrypted IM or video chat facility. Are encrypted features delaying iPhone 6 approval in China? Apple’s declaration that it will be unable to help government agencies in any country decrypt devices applies only to those running iOS 8. There are an estimated 500m iOS devices in use worldwide, and iOS 8 is available as a free update for every device since the iPad 2, released in April 2011. Some analysts have wondered whether the delay in sales approval for the iPhone 6 and iPhone 6 Plus in China is due to this element of the operating system, which comes as part of the phones. Apple was previously required to move some servers to China to conform to government regulations there about the storage of nationals’ data - though Apple says it encrypts data on its servers and does not hold a key for them. The extra encryption protection measures on iOS 8 will also apply to iCloud backups - which are believed to have been the source of intimate pictures of celebrities that were spread online earlier this month from the 4chan and reddit discussion boards. Normally, Apple devices and iCloud backups are encrypted by default using a four-digit passcode on setup, though the user can subsequently change that for a longer one. Apple says that attempts at a brute-force cracking of the passcode are resisted by an “iteration count” to slow down repeated attempts. However even with those measures a four-digit passcode can be cracked in less than seven minutes, according to one security researcher’s calculations. A six-character passcode with letters and numbers would take more than five years to crack through brute force methods, Apple says. Security advisers suggest changing from the four-digit passcode to a more complex one to guard against brute force attacks, and Apple says users should turn on “two-factor authentication”, which would provide notification when a backup was downloaded. Cook says that “I want to be absolutely clear that we have never worked with any government agency from any country to create a backdoor in any of our products or services. We have also never allowed access to our servers. And we never will.” That does not however preclude the possibility that Apple hands over specific account data under the US’s secret FISA court orders. Google has repeatedly and vehemently denied that any government has had access to its servers. |