Ah, here we go again with the “eco” phone nonsense.

[Fixed_Until_Broken]

Yes, People moan and complain about apple because they make repair harder in the name of "security". An example of such would be locking you out of the bootloader. But this amazing "security" has been defeated by tools like checkm8. They also serialize parts in the name of "security" but this is the same type of "security" that the TSA offers. It's known as a security circus or security theatre. basically, no real security is added by serializing the screen, battery, or camera. If I can make a device that can spy on you I can make a device that can spoof a serial number. serializing parts is not securing anything at all. BTW don't believe me there are tools on the market for cloning apple serial numbers right now.

You are yet to make a valid point. keep reaching.

Please do not bash 3rd party repair when you clearly do not understand one bit of what you are talking about. You are slandering the hard work of many businesses with more baseless claims. It is outright egregious to claim 3rd party repair will compromise your device.
"Any fool can speculate, most of them do"... The quote is actually "Any fool can criticize, condemn and complain-and most fools do" by the way

I don’t think the hardware and firmware security is even distantly pointless, as you suggest it is. No, it’s not perfect. But it has served to keep iOS FAR more secure as a platform for a typical user. It’s impossible to know exactly how much it’s prevented, but I don’t think it’s farfetched to believe that without it, there would be a lot more malware, ransomware, etc. Not to mention that I think it’s a good thing that law enforcement doesn’t have ready access. Yeah, it eventually gets broken, but rarely right away.

And some things, like biometric security, really, really need to be done on secure hardware. Doing those on unsecured hardware is reckless.

What I do believe, however, is that Apple should become more open about providing original parts to whoever needs them.

I did not say hardware and firmware security is pointless I said serialization is pointless because it's easily spoofed. It is a security circus. If you're just going to say send a message across a normal protocol like SPI  and just respond back an unencrypted string of numbers that is not security. It's a joke to defeat that but it's ruining 3rd party repair. Plenty of word-class security firms and government agencies agree that giving 3rd party repair access to parts and tools does not compromise security.

The argument against what I just said is also the argument against the serialization of parts. " But you would have to physical access to the device to sniff the datalines..." Yeah, and you need physical access to the device to swap the part out with this hypothetical spy chip. If you want to end-to-end encrypt the communication from the battery to the CPU then I will believe you it's about security but just adding a serial number is a joke. This fear-mongering is insane.

let's take a hypothetical that I am making something malicious. I want to make a battery that will catch on fire every time the user leaves it plugged overnight. So a remove the BMS in this battery and make my own bms, program it with the phone serial number that I got from the old BMS and now with the phone asks for the charge state just 98%-0% and then when they charge it to let it keep charging past 100% until it starts a fire.... your serial number did nothing to stop this. obviously glossed over a lot to make this happen but serialization won't stop someone who actually wants to attack you.

Edit: encrypting the thumbprint scanner and serializing the screen, battery and microphone are two completely different things. I am talking about unencrypted serial numbers. do not try to put words in my mouth about biometric security.

[Halcyon]

That may be so for their paid hosted services, but you can’t pay your way out of Google tracking you around the internet to show ads.

You absolutely can.

If you think Apple is somewhat more "trustworthy" than Google, you're sadly mistaken.

[james_s]

I trust Apple more than Google simply because Apple is not an advertising company and does not depend on harvesting marketable data. That is not to say I particularly trust either one though, or any other company. The primary reason I chose an iPhone is it was the only decent small smartphone I could find. Also I like imessage better than SMS because I can text my friends in Canada for free.

[daqq]

I trust Apple - they have a vibe of decency about them

[tooki]

That may be so for their paid hosted services, but you can’t pay your way out of Google tracking you around the internet to show ads.

You absolutely can.

If you think Apple is somewhat more "trustworthy" than Google, you're sadly mistaken.

Sorry, but you’re dead wrong.

[rsjsouza]

I trust Apple more than Google simply because Apple is not an advertising company and does not depend on harvesting marketable data. That is not to say I particularly trust either one though, or any other company. The primary reason I chose an iPhone is it was the only decent small smartphone I could find. Also I like imessage better than SMS because I can text my friends in Canada for free.

Going for Android are the de-googled phones.
https://centipedenation.com/second-column/the-privacy-guy-rob-braxman-on-using-de-googled-phones/

Not ideal, but not bad either.

[thinkfat]

I trust Apple more than Google simply because Apple is not an advertising company and does not depend on harvesting marketable data. That is not to say I particularly trust either one though, or any other company. The primary reason I chose an iPhone is it was the only decent small smartphone I could find. Also I like imessage better than SMS because I can text my friends in Canada for free.

Going for Android are the de-googled phones.
https://centipedenation.com/second-column/the-privacy-guy-rob-braxman-on-using-de-googled-phones/

Not ideal, but not bad either.

You'd have to be really hardcore about privacy if you accepted the near-complete loss of functionality that de-googling an Android phone brings along.

[thinkfat]

That may be so for their paid hosted services, but you can’t pay your way out of Google tracking you around the internet to show ads.

You absolutely can.

If you think Apple is somewhat more "trustworthy" than Google, you're sadly mistaken.

Sorry, but you’re dead wrong.

How can a multi-billion operation like Apple be anything but entirely without morals?

[tooki]

That may be so for their paid hosted services, but you can’t pay your way out of Google tracking you around the internet to show ads.

You absolutely can.

If you think Apple is somewhat more "trustworthy" than Google, you're sadly mistaken.

Sorry, but you’re dead wrong.

How can a multi-billion operation like Apple be anything but entirely without morals?

Well, it depends on the company leadership. User-centricity is demonstrated by things like the CEO telling a major investor to pound sand when they complained about the expense of putting in accessibility features that go well beyond what the law requires, or the fact that their store employees are trained to give the customer the right product for them, not the most expensive product (they don’t work on commission, and the metrics don’t care whether they sell a customer a $999 MacBook or a $9999 Mac Pro: each counts simply as 1 Mac sale).

Additionally, it’s no secret that Apple’s business model revolves around selling hardware and services. What they aren’t reliant on at all is ad revenue, so they don’t need the user data. Contrast this with Google, whose entire business is built upon a foundation of ad revenue (80%), and that in turn relies on user data in order to target the ads.

In a nutshell: Apple’s product is goods and services, and its customers are end users. Google’s customers are advertisers, and its product is you. This is why Apple cares about end users, and Google doesn’t.


But as I stated in an earlier reply: even if Apple’s motivation to protect user privacy is simply a way to set itself apart from the competition in order to sell more product, so what? The end result is nonetheless a company acting to protect its users. The motivation doesn’t change the effectiveness of the end result.

[Halcyon]

That may be so for their paid hosted services, but you can’t pay your way out of Google tracking you around the internet to show ads.

You absolutely can.

If you think Apple is somewhat more "trustworthy" than Google, you're sadly mistaken.

Sorry, but you’re dead wrong.

Gee, all this time I must have been imagining it then.

[Ed.Kloonk]

In a nutshell: Apple’s product is goods and services, and its customers are end users. Google’s customers are advertisers, and its product is you. This is why Apple cares about end users, and Google doesn’t.

Sure, but Halcyon is saying that paying google makes instead your cash the product and not you. It's just very hard for some of us to believe they will honour that part of the deal. Even if they do, what isn't explained is to what extent.

When you email and converse with another person with a ordinary Gmail acct, Google would read the emails. But when does the payment for privacy take effect? Email aside, with all the tracking, how do they separate your random browsing from the enclave of privacy you've paid for?

[tooki]

That may be so for their paid hosted services, but you can’t pay your way out of Google tracking you around the internet to show ads.

You absolutely can.

If you think Apple is somewhat more "trustworthy" than Google, you're sadly mistaken.

Sorry, but you’re dead wrong.

Gee, all this time I must have been imagining it then.

Probably. Or more likely, believing what people say without actually verifying the facts of the situation.

Much of the reporting about Apple is very inaccurate. (A perfect example: all the recent articles about how old Apple devices will start having trouble connecting to some websites due to some root certificate expiring. Yes, it’s technically true. But the lie-by-omission is that countless non-Apple devices of the same era are equally affected. Any device that hasn’t gotten an update in many years will have the issue. But badmouthing Apple gets more clicks…)

[tooki]

In a nutshell: Apple’s product is goods and services, and its customers are end users. Google’s customers are advertisers, and its product is you. This is why Apple cares about end users, and Google doesn’t.

Sure, but Halcyon is saying that paying google makes instead your cash the product and not you. It's just very hard for some of us to believe they will honour that part of the deal. Even if they do, what isn't explained is to what extent.

When you email and converse with another person with a ordinary Gmail acct, Google would read the emails. But when does the payment for privacy take effect? Email aside, with all the tracking, how do they separate your random browsing from the enclave of privacy you've paid for?

But you can’t do that. You can pay for extra Google services, but outside of YouTube, you cannot pay to turn off ads and tracking. The Google Contributor program (which let you pay per-site to disable Google ads) was discontinued years ago, revived briefly, and then left to wither again. But there’s never been a program where you could, say, pay $20 a month and disable all Google ads and tracking across all websites.

[Halcyon]

In a nutshell: Apple’s product is goods and services, and its customers are end users. Google’s customers are advertisers, and its product is you. This is why Apple cares about end users, and Google doesn’t.

Sure, but Halcyon is saying that paying google makes instead your cash the product and not you. It's just very hard for some of us to believe they will honour that part of the deal. Even if they do, what isn't explained is to what extent.

When you email and converse with another person with a ordinary Gmail acct, Google would read the emails. But when does the payment for privacy take effect? Email aside, with all the tracking, how do they separate your random browsing from the enclave of privacy you've paid for?

In a nutshell, yes. But don't just take my word for it, I encourage everyone to do some independent research. I know a Google engineer personally and he explained some of the inner workings to me. Although the familiar GUI is almost the same between free Google and Google Workspace, how it works under the hood is entirely different. Could you imagine if a company or government entity was using Google's services for confidential or sensitive things only to have it scanned or processed by something external? Google would lose all credibility in that market. It might be of interest to some, but Google actually passed the Australian Signals Directorate IRAP compliance for protected information and was listed listed on the Australian Cyber Security Centre's Certified Cloud Services List for government use (until the CCSL was discontinued last year).

Want to take a guess which company didn't make the list?

But you can’t do that. You can pay for extra Google services, but outside of YouTube, you cannot pay to turn off ads and tracking.

Yes, you absolutely can. I do that right now even on my personal domain (and no, I don't use Google Workspace for Youtube at all). The granularity of the settings in Google Workspace is pretty awesome, but even with free Google, you have control over just about everything. There are some things that you can't disable which come with the product. I do have to ask though Tooki, are you a Google user?

[tooki]

In a nutshell: Apple’s product is goods and services, and its customers are end users. Google’s customers are advertisers, and its product is you. This is why Apple cares about end users, and Google doesn’t.

Sure, but Halcyon is saying that paying google makes instead your cash the product and not you. It's just very hard for some of us to believe they will honour that part of the deal. Even if they do, what isn't explained is to what extent.

When you email and converse with another person with a ordinary Gmail acct, Google would read the emails. But when does the payment for privacy take effect? Email aside, with all the tracking, how do they separate your random browsing from the enclave of privacy you've paid for?

In a nutshell, yes. But don't just take my word for it, I encourage everyone to do some independent research. I know a Google engineer personally and he explained some of the inner workings to me. Although the familiar GUI is almost the same between free Google and Google Workspace, how it works under the hood is entirely different. Could you imagine if a company or government entity was using Google's services for confidential or sensitive things only to have it scanned or processed by something external? Google would lose all credibility in that market. It might be of interest to some, but Google actually passed the Australian Signals Directorate IRAP compliance for protected information and was listed listed on the Australian Cyber Security Centre's Certified Cloud Services List for government use (until the CCSL was discontinued last year).

Want to take a guess which company didn't make the list?

But you can’t do that. You can pay for extra Google services, but outside of YouTube, you cannot pay to turn off ads and tracking.

Yes, you absolutely can. I do that right now even on my personal domain (and no, I don't use Google Workspace for Youtube at all). The granularity of the settings in Google Workspace is pretty awesome, but even with free Google, you have control over just about everything. There are some things that you can't disable which come with the product. I do have to ask though Tooki, are you a Google user?

I think we are talking about completely different things.

You’re talking about things within a paid Google service. Of course it’s not going to show ads there. But having a Google workspace account isn’t going to stop Google ads elsewhere.

Yes, I use some Google services, where no alternative exists (or is massively inferior). Nothing paid.

Yes, Google lets you set many things granularly. But “don’t show me ads” and “don’t track me across the web” aren’t among them.


How one can think Apple is worse when it comes to data collection simply boggles the mind. (I’m not saying that Google is the worst, they’re absolutely not.)

[NiHaoMike]

You'd have to be really hardcore about privacy if you accepted the near-complete loss of functionality that de-googling an Android phone brings along.

What do you lose other than the Google apps and services you never wanted to use to begin with? Then there's microG as a replacement.
https://microg.org/

The Google Contributor program (which let you pay per-site to disable Google ads) was discontinued years ago, revived briefly, and then left to wither again. But there’s never been a program where you could, say, pay $20 a month and disable all Google ads and tracking across all websites.

It was trying to compete with free adblockers, an obvious losing battle.

[Halcyon]

You’re talking about things within a paid Google service. Of course it’s not going to show ads there. But having a Google workspace account isn’t going to stop Google ads elsewhere.

Even with free Google services, it's not hard to either disable tracking(in some circumstances), block them, manipulate them or essentially anonymise them. It just depends on you, the user and what details you provide and how things are configured on your end. For example, logging into non-Google websites using your Facebook/Google/Apple/Whatever account is a terrible idea. If you have any care about privacy at all, you would never do this.

[tooki]

You’re talking about things within a paid Google service. Of course it’s not going to show ads there. But having a Google workspace account isn’t going to stop Google ads elsewhere.

Even with free Google services, it's not hard to either disable tracking(in some circumstances), block them, manipulate them or essentially anonymise them. It just depends on you, the user and what details you provide and how things are configured on your end. For example, logging into non-Google websites using your Facebook/Google/Apple/Whatever account is a terrible idea. If you have any care about privacy at all, you would never do this.

I still fail to see how any of that makes Apple less trustworthy with regards to privacy.

Nor does it support your claim that one can pay Google to get rid of ads and tracking.

And Apple’s login system is designed for privacy, heck, it includes an anonymizer option. Read up on it before you bash it.

[Halcyon]

You’re talking about things within a paid Google service. Of course it’s not going to show ads there. But having a Google workspace account isn’t going to stop Google ads elsewhere.

Even with free Google services, it's not hard to either disable tracking(in some circumstances), block them, manipulate them or essentially anonymise them. It just depends on you, the user and what details you provide and how things are configured on your end. For example, logging into non-Google websites using your Facebook/Google/Apple/Whatever account is a terrible idea. If you have any care about privacy at all, you would never do this.

I still fail to see how any of that makes Apple less trustworthy with regards to privacy.

It doesn't. I also never claimed it did. I was just refuting some of your claims as an actual security researcher and someone who has worked in the field for years.

All I am saying is they all use the same tactics and play all the same tricks. Being an Apple user doesn't make you immune to any of it, just like you aren't immune to malware or phishing scams etc.... If you want to be in 100% complete control of all of your data and the infrastructure it sits on, then pay someone the big bucks or host your own services and hope that you don't accidentally misconfigure something.

As for everything else I've mentioned, it's all easily verifiable in the public domain. Feel free to read up on it, or better yet, test it out for yourself.

[thinkfat]

You'd have to be really hardcore about privacy if you accepted the near-complete loss of functionality that de-googling an Android phone brings along.

What do you lose other than the Google apps and services you never wanted to use to begin with? Then there's microG as a replacement.
https://microg.org/

You lose the "Play Store" and with it you lose all other apps, too. Apps are the single, most important feature that "make" a smartphone. Selling Android phones without Google stuff has been tried and everyone failed, and each time the reason was "no apps available".

If you want to keep using all the popular apps, you need to download them from sketchy servers, trading privacy for security (and you cannot have privacy without security).

As for Google services, they are valuable to many. Ad revenue is an important driver for content creators. YouTube is the best example. MicroG does not give you that.

So, you effectively get an expensive phone that does nothing a Nokia 6310 could not also do.

[Just_another_Dave]

You'd have to be really hardcore about privacy if you accepted the near-complete loss of functionality that de-googling an Android phone brings along.

What do you lose other than the Google apps and services you never wanted to use to begin with? Then there's microG as a replacement.
https://microg.org/

You lose the "Play Store" and with it you lose all other apps, too. Apps are the single, most important feature that "make" a smartphone. Selling Android phones without Google stuff has been tried and everyone failed, and each time the reason was "no apps available".

If you want to keep using all the popular apps, you need to download them from sketchy servers, trading privacy for security (and you cannot have privacy without security).

As for Google services, they are valuable to many. Ad revenue is an important driver for content creators. YouTube is the best example. MicroG does not give you that.

So, you effectively get an expensive phone that does nothing a Nokia 6310 could not also do.

In order to allow the average user to use an android phone without android services, at least developers would need to provide installers for their apps that could be downloaded from their websites (as it happens with software developed for windows)

[tooki]

You’re talking about things within a paid Google service. Of course it’s not going to show ads there. But having a Google workspace account isn’t going to stop Google ads elsewhere.

Even with free Google services, it's not hard to either disable tracking(in some circumstances), block them, manipulate them or essentially anonymise them. It just depends on you, the user and what details you provide and how things are configured on your end. For example, logging into non-Google websites using your Facebook/Google/Apple/Whatever account is a terrible idea. If you have any care about privacy at all, you would never do this.

I still fail to see how any of that makes Apple less trustworthy with regards to privacy.

It doesn't. I also never claimed it did.

You strongly suggested it multiple times.

I was just refuting some of your claims as an actual security researcher and someone who has worked in the field for years.

I don't think you did, because I don't think we are talking about the same thing at all. See below.

All I am saying is they all use the same tactics and play all the same tricks.

But that's clearly not the case.

Being an Apple user doesn't make you immune to any of it, just like you aren't immune to malware or phishing scams etc.... If you want to be in 100% complete control of all of your data and the infrastructure it sits on, then pay someone the big bucks or host your own services and hope that you don't accidentally misconfigure something.

Right, but the services are just a minor part of it. Apple actively fights against user tracking online. Google actively participates in said tracking. I don't think you've grasped that I am not particularly concerned with what happens within a Google service (like gmail) nor within an Apple service (like iCloud), but what happens outside of them.

As for everything else I've mentioned, it's all easily verifiable in the public domain. Feel free to read up on it, or better yet, test it out for yourself.

Yes, but it's not relevant to what I've been talking about.

[Halcyon]

 

Look, tooki, you do you. I really don't care if I change your views on things or manage to educate you even a little bit. I'm just discussing what I know. I refuse to enter into a pissing contest with anyone.

If you like your fruity phone, then you keep using it. No one, including myself is going to try to stop you.

[tooki]

Look, tooki, you do you. I really don't care if I change your views on things or manage to educate you even a little bit. I'm just discussing what I know. I refuse to enter into a pissing contest with anyone.

If you like your fruity phone, then you keep using it. No one, including myself is going to try to stop you.

You couldn't educate me because you haven't told me anything I didn't already know!

Your argument began with claiming that Apple collects a lot more data. Even if we accept that as true (which is uncertain but unknowable), it's data used for on-device learning. It's not used for advertising, it doesn't get sent to Apple or anyone else. As a user, you can opt-in to send crash reports and certain usage data to Apple and/or third-party app developers, but even that is anonymized.

You said it'd be a treasure trove if it fell into the wrong hands. Yes, absolutely! But to get to that database as a baddie, you have to defeat numerous layers of security. Key word here: security.

Privacy, which is what was being discussed prior to your comment, is not the same as security.

Google collects data from your online activities and uses it to sell ads. They actively work to de-anonymize you on the internet.


Yet you keep arguing about how personal data stored in a paid Google service is, in fact, secure, while refusing to address the privacy issues being discussed.


This is why I keep saying: it's apples and oranges.

So you don't get to condescendingly suggest I'm wrong and in need of education, when you keep discussing an entirely different topic.

[NiHaoMike]

You lose the "Play Store" and with it you lose all other apps, too. Apps are the single, most important feature that "make" a smartphone. Selling Android phones without Google stuff has been tried and everyone failed, and each time the reason was "no apps available".

If you want to keep using all the popular apps, you need to download them from sketchy servers, trading privacy for security (and you cannot have privacy without security).

Look up "APK downloader" on Github and you'll find quite a few of those. Then there's F-Droid, the app store that specializes in open source apps.

As for Google services, they are valuable to many. Ad revenue is an important driver for content creators. YouTube is the best example. MicroG does not give you that.

There are better Youtube viewer apps like Youtube Vanced and Newpipe. Those who do want the ads to support creators but don't want the ads disrupting their enjoyment of the content (or getting creeped out by ads that track too closely) can leave the video playing with ads on a cheap or old device while watching without ads on their "good" device.