4 ms·

It's important to emphasize something: iCloud will always be "backdoored", by design, and backing up to iCloud is what most users should and will be doing. The

by abalone 11y ago

It's important to emphasize something: iCloud will always be "backdoored", by design, and backing up to iCloud is what most users should and will be doing. The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments. It's so that Apple can offer customers the very important feature of accessing their own data if they forget or otherwise don't have the password. That is an essential feature, and why this aspect will never change. When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. So Apple wants and needs to provide an alternative way to recover the account. (For example, they will provide access to a deceased person's account if their spouse can obtain a court order proving the death and relationship.) Harvard recent published a paper (called "Don't Panic") that essentially states the same.[1] Governments shouldn't "panic" because in most cases, consumers will not be exclusively using unbreakable encryption, because it has tradeoffs that aren't always desirable. And the reason why most consumer should be backing up to iCloud is similar: that's how you prevent the tragedy of losing your data if you lose your phone. Just something to keep in mind when discussing the "going dark" and "unhackable" news items. It is worth noting however that people who do "have something to hide" from governments probably won't be using iCloud, if they know what they're doing. Then again if they know what they're doing, they wouldn't use anything that is backdoored anyway. So the naive criminals will still probably be hackable, and that's about all we can hope for. [1] https://cyber.law.harvard.edu/pubrelease/dont-panic/Dont_Panic_Making_Progress_on_Going_Dark_Debate.pdf https://cyber.law.harvard.edu/pubrelease/dont-panic/Dont_Pan...

surye 11y ago
> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. Would you really expect Apple to recover the data in this scenario for the next of kin? I certainly wouldn't, and I wouldn't want them to.
- IBM 11y ago
  I think they do when they get a court order authorizing it from the estate.
- abalone 11y ago
  I definitely would if it was a regular iCloud Photo Library with decades of family history, pictures of the kids growing up, etc. Imagine all that being lost. It's not what most users would want. If there was something the deceased person truly wanted hidden from their next of kin, they could use stronger encryption for that. The Notes app, for example, allows for note-level strong encryption. But it's not an ideal fit for the more typical use case. Anyway, they do it.[1] [1] http://www.cnet.com/news/widow-says-apple-told-her-to-get-court-order-to-secure-dead-husbands-password/ http://www.cnet.com/news/widow-says-apple-told-her-to-get-co...
j1vms 11y ago
>The reason iCloud data will always be accessible by Apple, and thus governments, is [...] so that Apple can offer customers the very important feature of accessing their own data if they forget or otherwise don't have the password. That is an essential feature, and why this aspect will never change. And may the era of homomorphic encryption schemes come and thus render moot the need for Apple and other companies to access unencrypted data as a plausible excuse when performing back-end processing/recovery on their client's data. edit: well, to correct myself, as you said that wouldn't obviate the need for the feature of "recover data without password, after passing some other security tests"
deleted 11y ago
[deleted]
karmelapple 11y ago
> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. So Apple wants and needs to provide an alternative way to recover the account. (For example, they will provide access to a deceased person's account if their spouse can obtain a court order proving the death and relationship.) A pretty interesting point. Photos are probably good to recover... unless they were photos of something horrible you did (beat up someone, sent photos of your anatomy, etc.). What about text messages? Again, it could express what kind of person you are. Do all iOS users have unwitting diaries that will be unlocked at our death in the form of our iMessage and SMS history? In 400 years, will our ancestors point out, "Wow, great-great-great-grandma was pretty awful, did you see this text they sent once?" in a way that removes context from the message written at the time. This is something we can't know about our ancestors... and probably for the best, since otherwise we might be disappointed in our ancestors. Or maybe that's an okay thing?
- abalone 11y ago
  That is also an interesting point. It certainly comes up often when next-of-kin go through the private physical possessions of the deceased and discover secret love letters, diaries, etc. They probably wanted those to stay private. But for bank account records, most photos, etc., you probably don't want those to disappear in the event of your death. You want those to pass on. Given the choice between the two defaults, it makes a lot of sense for Apple to make "accessible to next of kin" the default, and "dies with you" the opt-in.
- ubernostrum 11y ago
  Over the past few years services have been slowly starting to phase in a way to specify a person who can "inherit" access to your account in the event of your death. I know Facebook has it fully set up now (you can go into your security settings and specify a "Legacy Contact"), and I expect that in the near future it'll be a standard part of any service that intends to operate long enough for this to become a worry.
autoreleasepool 11y ago
I actually intend for my private data to die with me. I have gone out of my way to guarantee that it will. In my view, if I haven't published it, then it shouldn't be accessible. I have absolutely nothing to hide. I have simply always treated my privacy as something that was valuable in it of itself. Perhaps even more valuable than the photos I clearly opted to not share with others, to go off your example. I also don't understand why it's so absurd for some people to conceptualize non-malicious things you wouldn't wasn't to share with anyone but yourself. Hell, I have tons of notes and things I write to myself that I definitely do not want to be seen by anyone. They simply weren't written with the intention to be read by others. So I don't sympathize with desire to make a deceased person's private things accessible, even to family. Let it burn. It might have been the owner's intention all along.
- abalone 11y ago
  Since you're responding to me I'm assuming you mean me, but I have no problem conceptualizing non-malicious things you would want to keep private. The problem here is that a lot of the stuff stored on phones falls somewhere between "dies with me" private and "should pass on to my family" private. Or "should be recoverable if I lose my key" private. Strong encryption makes it impossible to recover in the event of a lost key or pass on to family in the event of your death. So that's not necessarily a great default for, say, decades of family photos. It would be a huge tragedy if that was lost. The good news is that Apple does provide tools to opt-in to stronger security, rather easily. For example, the Notes app was recently upgraded with note-level strong encryption. That might be a good solution for your most private notes, without endangering the survivability of your digital memories and assets.
  - autoreleasepool 11y ago
    Yes, It's different for everyone. I didn't mean to accuse of being one of those people, I was speaking generally there. I'm sorry if my phrasing was bad. My main concern is that people are scared to admit they use the best, because they will be accused of being criminals. The stigma is harmful. Imagine if somebody is writing down there dreams, writing there intimate deep thoughts, tracking symptoms of a medicine, using drugs recreationally...etc. These things might be very very private and be totally abusable outside of context.
awqrre 11y ago
I guess you could send pre-encrypted data to iCloud to try to avoid Apple's backdoor... but of course if you do that from an Apple device, there is no guarantees...
ghshephard 11y ago
One of the "knock it out of the park" features of icloud is that it lets you trivially share photostreams (It's the one service that I've found close to flawless) - so all those shared pictures are still available to the family who you shared them with should you pass away. I certainly don't know if Apple should, without a court order, share any of my data that I haven't explicitly shared with next of kin if I passed away. I'm wondering though - what happens if I stop paying my $2.99/month for 200 GB - will any of my existing photos be wiped out of shared photostreams?
- abalone 11y ago
  They do require a court order, reportedly. The problem with requiring explicit sharing is that a lot of people don't realize they need to do it to properly navigate these future events. Just look at how many people fail to write wills. You wouldn't want real-world assets to automatically get destroyed because you failed to write a will, even though there may be some things in there you didn't want to pass down. The "failsafe" mechanism there is, a court figures it out. So that's apparently what Apple is doing. But keep in mind this is not just about next-of-kin. It's also about the ability for you to recover your life if you forget your password. That is why Apple will always have a "backdoor" into iCloud.
scope 11y ago
> The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments. Q: Can't I already encrypt my iCloud data via a keychain?
- valleyer 11y ago
  Quite the opposite: your keychain is stored as part of your iCloud data.
- abalone 11y ago
  I'm not exactly sure what you mean. iCloud data is reportedly encrypted at rest. The issue is that Apple has the decryption key. And they keep it in order to recover you from a lost password event, so that is likely to always be true forever. Having said that, you can add another layer of your own encryption to certain data that is stored in iCloud, like for example the latest Notes app in iOS 9.3. Apple won't have that key.. but the app warns you the data will be lost if you lose it. You could also encrypt files you store in iCloud Drive using an encryption app. But you wouldn't be able to do this with other data that is managed by iOS like iCloud backups or photo libraries.
TaylorAlexander 11y ago
There's an easy way Apple could offer a true cryptographically secure cloud backup service - support local backups with a physical keystore. Make it an advanced option but use it as an excuse to sell users a Time Machine backup unit with RFID built in to read a security key. Apple could make truly secure systems user friendly if they wanted to. It seems they may see some value in doing so.
- abalone 11y ago
  Local backups are not cloud backups. But there's already at least one 3rd party cloud backup provider that provides zero-knowledge encrypted backup as an option, with the caveat that the data will be forever lost if you lose the key (or die, etc.) [1] It's just not an option that your average person would want for their family photos. [1] https://www.backblaze.com/business-security.html https://www.backblaze.com/business-security.html

by abalone 11y ago

surye 11y ago

> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. Would you really expect Apple to recover the data in this scenario for the next of kin? I certainly wouldn't, and I wouldn't want them to.

IBM 11y ago
I think they do when they get a court order authorizing it from the estate.
abalone 11y ago
I definitely would if it was a regular iCloud Photo Library with decades of family history, pictures of the kids growing up, etc. Imagine all that being lost. It's not what most users would want. If there was something the deceased person truly wanted hidden from their next of kin, they could use stronger encryption for that. The Notes app, for example, allows for note-level strong encryption. But it's not an ideal fit for the more typical use case. Anyway, they do it.[1] [1] http://www.cnet.com/news/widow-says-apple-told-her-to-get-court-order-to-secure-dead-husbands-password/ http://www.cnet.com/news/widow-says-apple-told-her-to-get-co...

j1vms 11y ago

>The reason iCloud data will always be accessible by Apple, and thus governments, is [...] so that Apple can offer customers the very important feature of accessing their own data if they forget or otherwise don't have the password. That is an essential feature, and why this aspect will never change. And may the era of homomorphic encryption schemes come and thus render moot the need for Apple and other companies to access unencrypted data as a plausible excuse when performing back-end processing/recovery on their client's data. edit: well, to correct myself, as you said that wouldn't obviate the need for the feature of "recover data without password, after passing some other security tests"

deleted 11y ago

[deleted]

karmelapple 11y ago

> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. So Apple wants and needs to provide an alternative way to recover the account. (For example, they will provide access to a deceased person's account if their spouse can obtain a court order proving the death and relationship.) A pretty interesting point. Photos are probably good to recover... unless they were photos of something horrible you did (beat up someone, sent photos of your anatomy, etc.). What about text messages? Again, it could express what kind of person you are. Do all iOS users have unwitting diaries that will be unlocked at our death in the form of our iMessage and SMS history? In 400 years, will our ancestors point out, "Wow, great-great-great-grandma was pretty awful, did you see this text they sent once?" in a way that removes context from the message written at the time. This is something we can't know about our ancestors... and probably for the best, since otherwise we might be disappointed in our ancestors. Or maybe that's an okay thing?

abalone 11y ago
That is also an interesting point. It certainly comes up often when next-of-kin go through the private physical possessions of the deceased and discover secret love letters, diaries, etc. They probably wanted those to stay private. But for bank account records, most photos, etc., you probably don't want those to disappear in the event of your death. You want those to pass on. Given the choice between the two defaults, it makes a lot of sense for Apple to make "accessible to next of kin" the default, and "dies with you" the opt-in.
ubernostrum 11y ago
Over the past few years services have been slowly starting to phase in a way to specify a person who can "inherit" access to your account in the event of your death. I know Facebook has it fully set up now (you can go into your security settings and specify a "Legacy Contact"), and I expect that in the near future it'll be a standard part of any service that intends to operate long enough for this to become a worry.

autoreleasepool 11y ago

I actually intend for my private data to die with me. I have gone out of my way to guarantee that it will. In my view, if I haven't published it, then it shouldn't be accessible. I have absolutely nothing to hide. I have simply always treated my privacy as something that was valuable in it of itself. Perhaps even more valuable than the photos I clearly opted to not share with others, to go off your example. I also don't understand why it's so absurd for some people to conceptualize non-malicious things you wouldn't wasn't to share with anyone but yourself. Hell, I have tons of notes and things I write to myself that I definitely do not want to be seen by anyone. They simply weren't written with the intention to be read by others. So I don't sympathize with desire to make a deceased person's private things accessible, even to family. Let it burn. It might have been the owner's intention all along.

abalone 11y ago
Since you're responding to me I'm assuming you mean me, but I have no problem conceptualizing non-malicious things you would want to keep private. The problem here is that a lot of the stuff stored on phones falls somewhere between "dies with me" private and "should pass on to my family" private. Or "should be recoverable if I lose my key" private. Strong encryption makes it impossible to recover in the event of a lost key or pass on to family in the event of your death. So that's not necessarily a great default for, say, decades of family photos. It would be a huge tragedy if that was lost. The good news is that Apple does provide tools to opt-in to stronger security, rather easily. For example, the Notes app was recently upgraded with note-level strong encryption. That might be a good solution for your most private notes, without endangering the survivability of your digital memories and assets.
- autoreleasepool 11y ago
  Yes, It's different for everyone. I didn't mean to accuse of being one of those people, I was speaking generally there. I'm sorry if my phrasing was bad. My main concern is that people are scared to admit they use the best, because they will be accused of being criminals. The stigma is harmful. Imagine if somebody is writing down there dreams, writing there intimate deep thoughts, tracking symptoms of a medicine, using drugs recreationally...etc. These things might be very very private and be totally abusable outside of context.

awqrre 11y ago

I guess you could send pre-encrypted data to iCloud to try to avoid Apple's backdoor... but of course if you do that from an Apple device, there is no guarantees...

ghshephard 11y ago

One of the "knock it out of the park" features of icloud is that it lets you trivially share photostreams (It's the one service that I've found close to flawless) - so all those shared pictures are still available to the family who you shared them with should you pass away. I certainly don't know if Apple should, without a court order, share any of my data that I haven't explicitly shared with next of kin if I passed away. I'm wondering though - what happens if I stop paying my $2.99/month for 200 GB - will any of my existing photos be wiped out of shared photostreams?

abalone 11y ago
They do require a court order, reportedly. The problem with requiring explicit sharing is that a lot of people don't realize they need to do it to properly navigate these future events. Just look at how many people fail to write wills. You wouldn't want real-world assets to automatically get destroyed because you failed to write a will, even though there may be some things in there you didn't want to pass down. The "failsafe" mechanism there is, a court figures it out. So that's apparently what Apple is doing. But keep in mind this is not just about next-of-kin. It's also about the ability for you to recover your life if you forget your password. That is why Apple will always have a "backdoor" into iCloud.

scope 11y ago

> The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments. Q: Can't I already encrypt my iCloud data via a keychain?

valleyer 11y ago
Quite the opposite: your keychain is stored as part of your iCloud data.
abalone 11y ago
I'm not exactly sure what you mean. iCloud data is reportedly encrypted at rest. The issue is that Apple has the decryption key. And they keep it in order to recover you from a lost password event, so that is likely to always be true forever. Having said that, you can add another layer of your own encryption to certain data that is stored in iCloud, like for example the latest Notes app in iOS 9.3. Apple won't have that key.. but the app warns you the data will be lost if you lose it. You could also encrypt files you store in iCloud Drive using an encryption app. But you wouldn't be able to do this with other data that is managed by iOS like iCloud backups or photo libraries.

TaylorAlexander 11y ago

There's an easy way Apple could offer a true cryptographically secure cloud backup service - support local backups with a physical keystore. Make it an advanced option but use it as an excuse to sell users a Time Machine backup unit with RFID built in to read a security key. Apple could make truly secure systems user friendly if they wanted to. It seems they may see some value in doing so.

abalone 11y ago
Local backups are not cloud backups. But there's already at least one 3rd party cloud backup provider that provides zero-knowledge encrypted backup as an option, with the caveat that the data will be forever lost if you lose the key (or die, etc.) [1] It's just not an option that your average person would want for their family photos. [1] https://www.backblaze.com/business-security.html https://www.backblaze.com/business-security.html