Unmasking the Privacy Risks of Apple Intelligence

frida is extra sick, before it there was cycript. both are excellent tools though.

If apple can figure out how to carve out a privacy/individual-focused ai model that avoids the classic centralized data-harvest/training they could runaway with a large portion of the market.

So many people understand the benefits ai can bring to our lives with automations, search, etc but so many are also aware of the dangers lurking beneath the surface and causes anti-ai sentiment (for good reason).

They can be mutually exclusive but aren't generally.

> they just can't seem to figure out what to do with it.

That's the funny thing about Siri. It has since Day 1 insisted on being exclusively online-only, processing on the server - even for commands that the pre-Siri Voice Control could do fully locally on an iPhone 3Gs such as "Call Steve" or "Turn Wi-Fi on"

That decision always surprised me, and it's surprising that Siri's never improved given that unlike Apple Intelligence it is not limited to on-device nor to PCC.

For all the scorn directed lately at the "Apple Intelligence" team for not shipping anything they promised, I have to hand it to JG's team for at least building a local processing capability plus having PCC instead of just one server-side thing and a "Trust Me Bro" like Siri.

If we're lucky, they'll build new Siri stuff from scratch using local + PCC, and finally push the old Siri stuff into the scrapyard where it belongs.

It's unclear what you're referring to. Their DNS (outside of Safari private browsing) and Private Relay aren't enabled by default. The latter is set up using blind signatures and oblivious DNS, so they can't figure out what it is (much less what to do with it). You're free to disable both and let your ISP do whatever they want with your browsing habits.

If you're talking about apple private relay, they're only proxying your packets, not intercepting any TLS connections. Therefore it's a bit misleading to characterize that as "Apple already slurps everything you do".

They are arguing in bad faith. They clearly know how to disable the relevant subset of these features. They don't do this upfront because they would have nothing to write about otherwise.

As a user, you can configure these settings in the UI. You can use the defaults command. They can be configured using a configuration profile/MDM. You could block the domains based on their associated feature, which are publicly documented by Apple. [1]

It's like complaining about Windows telemetry without bothering to configure the registry (or even open the settings menu).

[1] https://support.apple.com/en-us/101555

I think people are unaware of the difference between Apple Intelligence and Siri - they even have the same colour glow now. Also, can you always tell if it's Siri or Apple Intelligence handling a request?

The only privacy screen on macOS and iOS is during oob or after OS updates, and it does not make a distinction. As the OP post highlights, there is no way to avoid said telemetry from being sent or configure it in Settings. So all this is not only shady but quite illegal.

They also end it with trying to sell their service around AI which further devalues it, and even trying to give it a name like "AppleStorm".

I think some of the points are valid, but I think the over emphasis on Siri vs Private Cloud is massively overblown. That to me is just the nature of a transition like this and eventually more if Siri will likely fall under "Apple Intelligence" since it makes sense that they would have a single platform on the backend.

Then there is this header:

> "End-to-End Encryption? I’m Not Sure"

Well.. it is still end to end encrypted. Nothing about using Siri to dictate it changes that since you know... your on one of the ends. It is like saying that me taking a screenshot of the conversation somehow broke E2E.

That isn't to say that the concern here is not valid, but there are so many examples of things being twisted and manipulated to get you to use their product that I have a hard time really understanding what is an issue and what isn't.

Like ok you made an app using SiriKit using Apple's recommended settings (which may be recommended for a reason). But do you have the ability to have them not go to apple's servers if you configure it a certain way... it seems the author just ended with "Well it happens when I made this app" and never looked further.

PCC uses 3rd party ohttp relays also.