Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Cloud Communications Encryption Privacy Apple

Tim Cook Says Apple Can't Read Users' Emails, That iCloud Wasn't Hacked 191

Apple CEO Tim Cook insists that Apple doesn't read -- in fact, says Cook, cannot read -- user's emails, and that the company's iCloud service wasn't hacked. ZDNet presents highlights from Cook's lengthy, two-part interview with Charlie Rose. One selection of particular interest: Apple previously said that even it can't access iMessage and FaceTime communications, stating that such messages and calls are not held in an "identifiable form." [Cook] claimed if the government "laid a subpoena," then Apple "can't provide it." He said, bluntly: "We don't have a key... the door is closed." He reiterated previous comments, whereby Apple has said it is not in the business of collecting people's data. He said: "When we design a new service, we try not to collect data. We're not reading your email." Cook went on to talk about PRISM in more detail, following the lead from every other technology company implicated by those now-infamous PowerPoint slides.
This discussion has been archived. No new comments can be posted.

Tim Cook Says Apple Can't Read Users' Emails, That iCloud Wasn't Hacked

Comments Filter:
  • by queazocotal ( 915608 ) on Tuesday September 16, 2014 @12:23PM (#47918377)

    Is it legally possible... Not everywhere certainly.
    http://www.cnet.com/uk/news/in... [cnet.com]
    Is he required to lie about this?

    • by Pieroxy ( 222434 ) on Tuesday September 16, 2014 @12:32PM (#47918481) Homepage

      He makes a fair point. The data stored at Apple does not generate revenue for Apple, at the contrary of Google - where your emails are scanned for content to target ads at your eyeballs.

      Now, jumping from that to "We cannot do it even if we wanted to" is quite a leap forward. I'm not sure I trust that part of the statement.

      • by AmiMoJo ( 196126 ) *

        Data stored by Apple certainly does generate revenue them. It's a service that requires or at least strongly encourages you to buy expensive Apple hardware. They don't provide it out of generosity.

        • by rioki ( 1328185 )

          Semantics, but... the data "itself" does not generate revenue; it is an auxiliary to the expensive device. Contrast that to Google, the data is the central bit about the targeted adverting. That is the distinction done here.

    • by fustakrakich ( 1673220 ) on Tuesday September 16, 2014 @12:33PM (#47918487) Journal

      Is he required to lie about this?

      Very likely, if I can read my mail, so can he. It's only logical.

      • by Anubis IV ( 1279820 ) on Tuesday September 16, 2014 @01:09PM (#47918925)

        Very likely, if I can read my mail, so can he. It's only logical.

        The fact that an organization acts as a conduit for delivering messages does not necessitate that they have the ability to read the contents of those messages. The one does not follow from the other. It may be likely that the two go hand-in-hand, but by no means is it logical that they would do so.

        The various white papers [apple.com] and other security documents Apple has released over the last year or two make it clear that they claim they do not hold the private keys necessary to decrypt their users' data. Those private keys reside on the devices of the users, with unique keys being generated for each device and unique copies of the data being maintained separately for each device. For instance, in the case of iMessages, here's how Apple claims they work:
        1) I type up an iMessage to send to another Apple user and press Send.

        2) My device queries Apple's servers for the public key(s) of the recipient, which could be numerous if they've configured iMessages to arrive on multiple devices.

        3) My device creates and encrypts one copy of the message for each device, using the public key that is specific to each device for the copy going to it.

        4) My device signs the copies using its private key.

        5) The iMessage is sent to Apple, who then forwards it and immediately deletes it, unless they can't deliver it, in which case it'll stay queued for up to 7 days.

        6) The recipient's device verifies the signature against my public key and then decrypts the message using its own private key.

        Assuming the system works as described, Apple shouldn't have access to the content of the messages. Whether or not you believe that it works as described is a matter of how much faith you put in corporations and/or the governments that might be compelling them to insert backdoors. For instance, there are trivial ways that they can circumvent their own systems to gain access to messages, without having to compromise the private keys at all. The easiest way I can imagine would be to simply provide the public key of a wiretapping device in addition to the other keys in step #2 above. Unless you're sniffing your own traffic to ensure that you're sending EXACTLY what you're expecting to send, you'd never notice that you've sent out an extra copy of the message, and would be entirely unaware that it had landed on a government agent's device as well.

        But again, it isn't logical that they would have that sort of access. "Likely", given the state of things? Sure. But logical? By no means. Again, the one does not follow from the other. Particularly so in the case of Apple, since their money comes from hardware sales, not from monetizing the user's information, so it's in their best interests to make those devices as secure to use as possible.

        • I'm not sure whether to follow your logic, or the guy who said Tim Cook is a big fat liar.

        • by Trailer Trash ( 60756 ) on Tuesday September 16, 2014 @02:06PM (#47919649) Homepage

          People are conflating the "iMessage & Facetime" part of the quote with the "email" part. He says that they cannot (that is to say "do not have the ability") to read iMessage & Facetime. He then states that they do not read your email. People are pulling the "cannot" along with them when they read that sentence, but it doesn't say that they cannot read email, only that they choose to not read your email.

          Your description of the iMessage encryption is good, but what the original poster said was true given a few constraints. So let me restate it in a logically consistent manner: if I can read my icloud email on any browser then apple also has the ability to read it.

          But, but, maybe they encrypt it using your password on their server! If they did, "change password" would always require the old password and if you forgot your password your email would be lost forever. So, no, they're not doing that.

          The bottom line is that if they can show me my email in any browser (which they can) then they can also read it trivially.

          This isn't inconsistent with Cook's statement - he merely says that they choose to not do that.

          • by AmiMoJo ( 196126 ) *

            Apple say that the data is encrypted with a key derived from your password. Okay, that says they could be telling the truth, in so far as they don't store the key.

            However, in practice it's meaningless. They could easily make the client send the password to them in plaintext for target accounts (weren't Hushmail suspected of doing that years ago?) For most users they could just brute force the password. We have to take their word for it that the password storage is properly secured, e.g. hashed with a unique

      • by Alarash ( 746254 )
        There is a way that you can read the email but Apple can't : encrypting using a private key generated on your user account (much like what the TextSecure Android and iOS application does). If Apple does this, that would be an interesting undocumented feature. (spoiler: they don't do this).
    • Is he required to lie about this?

      Yes, a National Security Letter may do so. We have no way of knowing, so have to assume the worst.

      This will continue until there is independent oversight of the security apparatus. And by apparatus I mean all three branches of government.

      • A National Security Letter means the recipient must hand over information without notifying anybody else about it. It can probably force somebody to lie if they're using a "canary" approach (such as a message on accessing mail that it's definitely not going to the authorities). I don't see that it can force lying under any other circumstances.

      • Yes, a National Security Letter may do so. We have no way of knowing, so have to assume the worst.

        You are wrong. There is no way to legally force Tim Cook to lie. There are ways to legally force him to be quiet about a subject, and not to give us information, but there is nothing that can force him to lie.

    • Of course they can read it. They may not make a habit of it, but they do have the capability. If they didn't they would be worthless.

  • Lie. (Score:2, Insightful)

    by jddj ( 1085169 )

    Since when is anyone's SMTP email secure in transit, when is anyone running a mailserver unable to read the mail?

    Since when is any company immune from subpoena or contempt of court?

    • Re:Lie. (Score:5, Informative)

      by Sockatume ( 732728 ) on Tuesday September 16, 2014 @12:33PM (#47918497)

      ...because that's not what he actually said. He has previously stated that iMessage and Facetime, by design, can't be intercepted (it's all encrypted client-side); in this new interview he stated that they don't read your email, and that as a general principle they try to design systems so that they can't capture data, or at the very least aren't capturing anything they don't need to do what they're supposed to be doing.

      • Re:Lie. (Score:4, Insightful)

        by jddj ( 1085169 ) on Tuesday September 16, 2014 @12:58PM (#47918787) Journal

        Look, where would ./ be if posters read TFA?

        Looks to me like the ./ summary is claiming something that the ZDNet article does not. So yeah, not a lie on Cook's part, or not one the ZDNet article demonstrates anyway.

        I still wouldn't trust any company not to hand over my information to the government. Lavabit was one hell of an exception, and one geeks the world over should be proud of.

        Neither would I trust that email content I didn't personally encrypt with my own keys couldn't be seen by others.

        Apple doesn't have to be relaying email for others in order for Apple to be able to see the contents of all SMTP traffic that transits or terminates at their mail servers. SSL for SMTP means nothing if the mail server is pwned or intentionally logging stuff due to a business mandate or government subpoena or pressure.

        So Tim Cook didn't tell that particular lie. Good. But "We don't read your email" is an assertion, and one generally impossible to prove true (though more easily possible to prove false, given a certain amount of evidence).

        • Re: (Score:3, Insightful)

          by gnasher719 ( 869701 )

          I still wouldn't trust any company not to hand over my information to the government. Lavabit was one hell of an exception, and one geeks the world over should be proud of.

          But then Lavabit made the big mistake of being _capable_ of decrypting your data. Once they were _capable_ of decrypting it, that was it, and they started a fight with the government that they couldn't win.

          With Apple's iMessage system, they _can't_ read your data. And since they _can't_ read your data, Tim Cook can refuse to give them your data (actually, he can't give them your data anyway because he just can't) without fear of having to go to jail for this refusal. So no heroics needed for Apple. Much

    • It is this. EMAIL IS NOT SECURE. No matter who starts it or finishes it.

      If you are using email to do anything but send words of affection to your legally bound, opposite sex, partner (or recipes to anyone), you're doing it wrong.

      Remember the bit about email being a postcard?

      • It is this. EMAIL IS NOT SECURE. No matter who starts it or finishes it.

        Well, exactly. If you send me an unencrypted email, and it is stored on Apple's servers somehow, and my computer asks Apple's email server for the mail, then Apple has to send the unencrypted email to my computer. In other words, Apple _must_ be able to produce the unencrypted email.

        (Hmmh. I wonder if this is right. I wonder if there would be a way with https to store an encrypted mail, which would be decrypted when my computer decrypts the https? But then the NSA could just request my email through http

        • by Qzukk ( 229616 )

          I wonder if there would be a way with https to store an encrypted mail

          Short answer: No.
          Long answer: SSL makes use of a temporary session key that is calculated between the client and the server at the time of the connection. Once the connection is over that key is (ideally) destroyed. If the email was encrypted with my session key when I sent it to the server (and somehow not decrypted by the server at this point) your session key that you create when you connect to the server won't do the job.

          This is wha

          • Not saying it would be simple. https means: Data is encrypted with a key K and decrypted with the key K', and somehow both sides agree about the key. First, Apple could store your email encrypted with a key A so it can be decrypted with key A'. If they combine A' and K, it could be possible to send the https message to you without ever producing the decrypted message at Apple. Now if Apple didn't store the key A', but some means to combine A' with a (yet unknown) key K, then they couldn't decrypt your messa
    • by gl4ss ( 559668 )

      better than that the system allows for password reset by using email(among other methods). so with the data they posses, they can generate access to all the data. that means that any encryption or access blocks or whatever there are, are meaningless from the logical point of "can they read it?"

      so they can reset the password without having anything from you - that means they can read everything is in there and can be coerced to do so by legal means.

      on some other site it might be worth mentioning that they do

    • by swb ( 14022 )

      You can secure SMTP with TLS, can't you?

      • You can, and I'd guesstimate that about 50% of legit SMTP connections to our server are encrypted with TLS. But that number could also be as low as 10-20% (the 90% of all connections being spam zombies makes it harder to estimate).

        I have not tracked the value over time to see if it is going up/down. And our site is not particularly large, so we don't have a good sample to pull from.
  • Whoops (Score:2, Insightful)

    by Anonymous Coward

    The partial quote distorts what he said. The "Apple cannot read" part is specifically about iMessage, not email.

  • Not Hacked? (Score:2, Informative)

    by rainwater ( 530678 )
    Technically it wasn't hacked but Apple's poor security practices for password resets is what led to user's accounts to be compromised.
    • Right, it's not iCloud that was hacked, it was individual user accounts. It's the distinction between "the rotary club has been murdered" and "the members of the rotary club have been murdered".

      • Re:Not Hacked? (Score:5, Insightful)

        by jratcliffe ( 208809 ) on Tuesday September 16, 2014 @12:48PM (#47918665)

        Actually, it's more the distinction between "they broke into the bank vault and went through your safety deposit box" and "they pickpocketed you, and used your key and a fake ID to get into your safety deposit box."

      • Right, it's not iCloud that was hacked, it was individual user accounts. It's the distinction between "the rotary club has been murdered" and "the members of the rotary club have been murdered".

        No, some members of the rotary club have been murdered. (And also some members of the local droid knitting club.)

        There is no indication that every iCloud account was hacked, or even that a disproportional number of iCloud accounts were hacked.

  • Poor Apple (Score:5, Interesting)

    by obarthelemy ( 160321 ) on Tuesday September 16, 2014 @12:33PM (#47918495)

    It seems they've picked "privacy" as a fighting point vs Google. They don't seem to realize that people either
    1- don't care anyway
    or
    2- care, and know Apple is bullshitting.

    • by Cloud K ( 125581 )

      Call me gullible if you wish (given the PRISM leak it'd be fair) but I do actually relatively trust them, and believe that they were probably just as horrified to discover that the NSA had manipulated whoever they managed to manipulate (some engineers most likely) and tightened things up accordingly.
      There's always this idea that the more successful a company is, the more Pure Evil they are and basically out to be as scummy as they possibly can. But short of the PRISM thing (which again I personally suspect

      • Google's C-levels say things like "privacy is dead" and "if you have something to hide you shouldn't be doing it".

        Sigh. This has to go down as one of the most commonly manipulated misquotes in history.

        Schmidt was saying something along the lines of "privacy is dead" in response to a question about the PATRIOT Act. He was telling it like it is, giving as much of a warning of what was going on as he could without actually doing a Snowden. He wasn't expressing happyness about that state of affairs, just pointi

    • The part that gets me is that Apple thinks that it's a Google or Apple choice. That by tearing down Google they can raise themselves up.

      I choose neither.

      But Apple has historically promoted the idea of a competitor to their fandom. They utilize an 'Immanual Goldstein is the enemy' model, with regular five minute hate sessions.

      I don't think they can maintain their marketing culture without something out there for their fans to feel superior to.

      But we can stop caring. We don't have to pick a flag to wave in

  • by nimbius ( 983462 ) on Tuesday September 16, 2014 @12:40PM (#47918557) Homepage
    Tim cook, talking head who has only ever held managerial roles in various fortune 100 companies, expels platitudes about the sanctity of the iGalaxy for users who slept through FISA and NSA backdoors and only recently began giving a shit when selfies and nudes were leaked from the magical cloud by notorious hacker 4chan.
  • I do not believe him when he says Apple cannot access iMessage and FaceTime communications.
  • by tuppe666 ( 904118 ) on Tuesday September 16, 2014 @12:49PM (#47918689)

    "With iAD you can get your message out to millions of people worldwide who use Apple products every day. Connect with users as they listen to music on iTunes Radio or while they use their favourite App Network. Find your audience using targeted tools built upon a foundation of registration and media consumption datahttp://www.youtube.com/watch?v... start at 44 Min The idea is you spy on people in Apps not in search, because people spens 97% of their time in apps

  • And Charlie Rose isn't a techie. But if you want to really convince the Slashdot audience, it'd be better to have a high-level engineer answering these questions than a guy who's skill is managing the inventory supply chain.

    • If you wouldn't believe Tim Cook, why would you believe anyone else from Apple? They might be able to provide a better technical description of precisely why Apple can't access your information, but does that really matter as to whether or not what they're claiming is true?
  • by superwiz ( 655733 ) on Tuesday September 16, 2014 @01:00PM (#47918805) Journal

    Reagan was happy, he was always smiling

    They asked him, "what about the defiicit?"

    He said, "there is no deficit!"

    They told him, "but there is!"

    So he said, "so there is."

    ...

    30 years later

    There is is no emal theft! But there is!.... waaaait for it.

  • A thousand angels, parsing the fuck out of every word on the head of a pin.
  • False Headline (Score:5, Insightful)

    by Bob9113 ( 14996 ) on Tuesday September 16, 2014 @01:59PM (#47919563) Homepage

    Tim Cook Says Apple Can't Read Users' Emails,

    No he didn't.

    Apple previously said that even it can't access iMessage and FaceTime communications, stating that such messages and calls are not held in an "identifiable form." [Cook] claimed if the government "laid a subpoena," then Apple "can't provide it." He said, bluntly: "We don't have a key... the door is closed." He reiterated previous comments, whereby Apple has said it is not in the business of collecting people's data. He said: "When we design a new service, we try not to collect data. We're not reading your email."

    He said they cannot read iMessage and FaceTime, and they are not reading your email. That is a very important distinction. It might be one he was hoping you would miss, and you did miss it, but he did not say they can't access your email.

    And I'm not blowing sunshine up his skirt. I came here intending to kick him in the balls (metaphorically, of course) for lying, but he didn't.

    Pro-tip: If any system includes a password recovery mechanism that allows you to get back messages, then the administrator of the password recovery system can read your back messages.

    • by tlhIngan ( 30335 )

      He said they cannot read iMessage and FaceTime, and they are not reading your email. That is a very important distinction. It might be one he was hoping you would miss, and you did miss it, but he did not say they can't access your email.

      It makes sense really because he'd be lying if he said he can't access your email.

      Because using me.com or icloud.com email? Well damn, that's standard email and I'm fairly certain even if Apple uses SSL, it's standard IMAP or POP protocols, and it's delivered to Apple in pl

    • by praxis ( 19962 )

      iMessage and FaceTime are technologies Apple designed and implemented, and they chose to do it in a different way than e-mail. E-mail uses a plain text protocol and is stored in plain text. While the transport can be encrypted, if one were to encrypt the data on the server it was stored on, one would use a symmetric key, and one would have access to that key. iMessage and FaceTime can be implemented using asymmetric keys and one would not need access to those keys. It makes sense if you as a company want to

  • by Aaden42 ( 198257 ) on Tuesday September 16, 2014 @02:15PM (#47919751) Homepage

    Article subject says, “email,” but TFS says, “iMessages.” Those are different things, and the security of them is handled very differently because the mechanism of access is very different.

    Apple being unable to access emails is impossible since they must deliver them in plain text to plain-old IMAP clients that don’t support decryption or key storage.

    Apple being unable to access iMessage contents is plausible. My understanding of the protocol is something like this:

    Alice starts texting Bob’s phone number. Alice’s iDevice contacts Apple’s servers to see if Bob’s phone number is registered with iMessage. If not, Alice’s device sends a plain-old SMS. If it is, Alice’s device receives a list of public keys for each of Bob’s registered iDevices. Alice’s iDevice encrypts the message with a session key, then encrypts that session key to each of Bob’s public keys. Her device transmits the encrypted message to Apple’s servers which then transmit it to each of Bob’s devices as they become accessible. Each of Bob’s registered devices can use its private key to decrypt one of the encrypted session key blocks, then use that to decrypt the message.

    The private key to decrypt session keys never leaves Bob’s device. The session key never travels in the clear outside Alice’s or Bob’s devices. Apple can retrieve sender/recipient info (ye olde metadata), but no message contents.

    The one gotcha to all of that is that since Apple controls all SSL certs involved in the process, they could MitM attack the process if they so-choose (or were so-ordered). There’s no certificate pinning or checking implemented, so Alice’s iDevice has no way of knowing if the public keys it retrieved for Bob’s iDevices might also include an extra key held by Apple or LEO.

    Assuming Apple is compelled to intercept messages from Alice starting at a particular date, messages sent before that date at rest on their server should remain secure (unless they’re lying and are currently MitM or escrowing keys). New messages sent while the MitM was active could be decrypted and provided to LEO. Whether or not they’re performing an MitM at present should be detectable by analyzing the traffic during new device registration or sending messages — IE if Alice checks the keys received and confirms them all with Bob manually (jailbreak most likely required). If they don’t match or there’s an extra key, something’s wrong.

    There’s an in-depth protocol analysis of iMessage here: http://blog.quarkslab.com/imes... [quarkslab.com]

    Scroll to the bottom for the tl;dr on that analysis. That post also includes proof of concept software to check for an active MitM attack, at least on iMessage for Mac.

    tl;dr: Apple is in a trusted position where they could intercept message on a per-user basis if compelled to do so, but the general case of iMessage working as intended leaves messages encrypted on their server with keys they don’t have. I’m not aware of any way that Apple could perform that attack in an undetectable fashion, though performing that detection is well beyond the ability of most users.

  • Hi everyone, maybe someone more clever than me can figure this out: Could it be possible for Apple (or any other company) to store emails in an encrypted form so they can be delivered to me, but cannot be read by the company?

    Let's say my email address is gnasher@icloud.com and my password is "Password" You are sending me an unencrypted email (no S/MIME) and it is received by Apple's email server. No matter how encrypted Apple stores the data, when I request my email, Apple has to send me the unencrypted
    • by praxis ( 19962 )

      Even better would be a system such as:

      You generate a key pair, give Apple the public key. You manage your own private key.

      Then, for each email:

      Apple receives the email as plain text from another server (likely via SSL), encrypts it with your public key and stores it on their servers. When you connect to retrieve your mail they send you the encrypted blob that you decrypt via your private key.

      Problems are this: first, Apple has a plain text copy of each email you receive and could be asked (nicely or forcefu

      • Your suggestion is a protocol change, so that cannot be implemented without a change in the email client. But if we make such a change, then email senders could also implement the same change:

        The sender could ask Apple for your public key. If Apple has your public key, it gives the public key to the sender, the sender encrypts the message with your public key, sends it to Apple who cannot read it, which sends it to you. Oh well, that's called S/Mime :-(
        • by praxis ( 19962 )

          Yes, but it's between your MUA and your server. S/MIME, as far as I know, does not do server-to-sender public key exchange. If I send a signed message to you, then you have my public key and can encrypt messages to me, yes, but you can't get my public key from the server.

          Frankly, S/MIME is really the best solution available today. It works with gmail (not web-mail but using a MUA). Most MUAs support it. It's easy to get a free personal S/MIME keypair from a CA. Google, Apple or whoever you use for mail neve

    • by Aaden42 ( 198257 )

      This is essentially what Lavabit implemented. The NSA’s response was to compel Lavabit to hand over their SSL private keys so that all traffic to & from their web server could be intercepted. The key material that protects the private key must at some point pass over the wire, and if you can decrypt all traffic in & out, you can compromise the system.

      Lavabit chose to go out of business rather than comply.

      Land of the Free indeed...

  • What did Cook not say? Did he bluntly say "we cannot read your mail"? Or did he just say "we don't have a key"? A general statement like "There is no way for us to read your mail or provide your mail to anyone else" would have more meaning. Reporters could ignore such statements, or at least every time they print one, point out how it could be misleading.
  • Think just for a second about how web email works, especially web e-mail that provides fast full content search. Or SMTP from outside systems. Can't read user's e-mail. Riiiight! Maybe with all open source client stack using public keys exchanged out of band.

The moon is a planet just like the Earth, only it is even deader.

Working...