Okay, so are you making reference to the dual elliptic curve nsa backdoor? I need to know exactly what you’re claiming Snowden called a backdoor because if you’re talking about that particular thing it’s pretty wildly different in form, execution and presentation than the topic of the article you posted.

Usually when people talk about Snowden and backdoors they’re talking about that because it’s an incredibly well known thing, so I’m trying to get a little clarification from you instead of making assumptions. I’m gonna go ahead as if you are talking about the most famous Snowden backdoor thing but right here up front is me saying it’s possible you’re talking about something else.

Anyway, it’s a real pain in the butt to copy and paste from the page you linked because it uses graphs and inline notes so liberally, but towards the end there’s a whole section about how the phones database can tell when you sleep. I’ll paste in a sentence from that section so you can search for it and read what seemed so silly to me:

Weekday against hour of day - when this person is reachable, and when they are asleep

So what’s stupid to me about this is how much of a big fat “duh, of course it can do that. Any computer can do that” moment it is. Take a look at your dmesg or journalctl -r if you partake. You’ll see login attempts, authentication, apparmor or selinux messages, network connections and disconnections, device connections and disconnections, cpu state changes and power supply changes.

If you filter for things like authentication or cpu state changes you can easily put together a picture of when the system is in use or asleep, plugged up or running on battery, actively sending and receiving data or just sitting there plugged into the wall. A long time ago when I was in college we reconstructed a class schedule like that using a semesters worth of log files. And showed that I lied to a professor about a dead aunt when I was actually out drinking.

If it were a computer that spent its time being carried around in your pocket it stands to reason that it would have all kinds of data that could be tilted, pivoted and twisted to give an accurate picture of how long and when you’re sleeping.

So when I wrote that that part “gives the lie up” I was referring to how the entire article takes a feature of the os operating as advertised and system logs existing and says “isnt that creepy and scary!”

And to be honest it was a little spooky to realize that if a computer is truly personal then it’s completely bog standard diagnostic information can tell you things that are deeply revealing… twenty years ago when that was made public in a dang boing boing link.

Which isn’t to say it’s not worthwhile to inform people that their devices give up more than they directly record. It’s important for people to understand that. What I generally take issue with is the presentation and tone, presenting the fundamental function of a modern smartphone as something that could only be malicious and surreptitious and itself as serious security research that should be treated with the gravity of something less clickbaity.

The whole thing comes across as an attempt to scare the reader. I hesitate to say they, because the formatting, language used and meandering flow without strong argumentation screams llm, but the text is very clearly meant to alarm. But what are they supposed to be alarmed about? That their computer knows which pictures have which pets in them? That the computer stores and manages that information and offers it to the user? that’s the point.

The point is that the computer comes with a canned function that disables certain types of messaging and notifications when you’re asleep and if you want will even surface that to people so they know you’re not gonna get to them till morning. The point is that you can type “pictures of Duane” into the search doodad and it’ll bring up all the pictures of your dead cat so you can look through them. It’s in the ads. It’s the product.

And even if the product as advertised is scary to you it’s telling that youd (I’m going out on a limb here as I stated in the very start of this comment, apologies if I’m in the wrong) compare that to an nsa operation to control and secretly insert weakness into a cryptographic algorithm. Because they’re the exact opposite thing! Literally the exact opposite!

And I beg your pardon for going in reverse order but one stupid thing I saw in the beginning of the page was the most classico style buried lede ever:

We stress that this goes beyond the specific Apple personal knowledge graph, but it generally applies to any such personalized ML / assistant systems (Muse, Dot, etc.)

“Uh, we said you should be scared of what the fruit company knows about you, ~but actually this is true for literally any assistant software or ai thing~ .”

Come on! It’s obvious clickbait that should be read with a skeptical eye.

I’m gonna respond to your requests that I copy and paste parts of the article you linked to me and respond directly to them in a way that’s clearer later on when I have a little more time.

But lay off the personal attacks. I haven’t said a single negative thing about you and it only makes people reading this exchange take your ideas less seriously. Which I think does them a disservice because there’s a level of ears pricked up awareness you clearly exhibit that people ought to emulate.

I generally think about a backdoor in an os as a way to bypass a device’s lock, not as a backdoor to an encryption process. It’s the same mark of age that caused me to see no problem with the articles statement that turning off telemetry only turned off crash reports and whatnot. That made sense because those are the thing the user turned off and iOS has other controls for the other stuff.

Which is why I brought up the physical security and bfu points.

I also don’t know of any examples of Apple giving up customers data that isn’t along the lines of the proton example where the user set their proton recovery email to their firstname.lastname@icloud account and the cops used that to tie datasets together with the phone the user unlocked for them (if memory serves, that was a little bit ago).

I think people have a severe misconception about the (lack of ) security of Apple devices and tend to look at how a default iphone works as some egregious violation of trust when the vast overwhelming majority of users wouldn’t accept the limitations that being secure on a phone put upon them.

Ios lockdown mode is a great example. 99% of the time it’s fine but when people try to share contacts you’re shit out of luck and they gotta copy and paste it into a message to you.

As I said before, I don’t think the majority of people would accept the knowledge that their data is unsoupoenable (sp I’m sure) in exchange for account lockouts or forgotten passwords meaning loss of all cloud data. It’s why adp isn’t the default.

Was it netbsd who used to brag about no exploits in the default install? And then you actually do a default install and there’s no services and you think “yep, it’s pretty hard to get into a server that’s not running anything”.

It’s not quite that egregious but graphene is a good relatively secure by default setup while ios is pretty wide open so you can airdrop naked pictures to everyone on the bus and link your location data to your Facebook account, which is honestly what most phone users want. But those gates are closeable and strong in ios.

I uh also want to point out that the metadata cops use against you is your push notifications and I don’t even know any other in person fellow graphene users who disable those.

Broadly, having a phone is dangerous and if everyone understood that radio, television and the internet are propaganda and military c&c networks they’d be much less likely to buy the products to use them.