4 ms·

I can find no reference to this, and I've not heard anything about this happening in the past. Issues with iOS include: * iCloud not encrypting data securely

by new299 9y ago

I can find no reference to this, and I've not heard anything about this happening in the past. Issues with iOS include: * iCloud not encrypting data securely serverside (i.e. they can potentially get at the data). You can avoid this by not using iCloud. * They have Ads in app, and now in the Appstore directly. Potentially this changes the dynamic, between user/advertiser in a negative way. There are probably other issues... but I'm not currently aware of them. Overall it still seems like the best option from a privacy perspective.

rodorgas 9y ago
I don't think first item is true especially if you have 2-step verification enabled. They explicit say that if you lose your auth token, they can't do nothing. When I didn't used 2-step, I forgot my password, called them and they reset it for me (I had to confirm my identity providing them a code sent to my mac).
- new299 9y ago
  I think "can't" is "wont" in this case. Apple law enforcement guidelines state: "All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centers." and "iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari browsing history and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centres. iCloud content, as it exists in the subscriber’s account, may be provided in response to a search warrant issued upon a showing of probable cause." So in short, Apple retains encryption keys for much of the data (including iOS backups), and will provide decrypted data to US law enforcement on request. https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...
skierscott 9y ago
iCloud security overview: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- new299 9y ago
  Hmm that page is pretty unclear. Because while it says the data is encrypted serverside. What it doesn't say is which data is encrypted with a key that Apple has access to. Much of the data listed as encrypted on server is available to US law enforcement under warrant. It would be nice, to have an option available where data is encrypted on server, with your key. But that would mean you couldn't recover your data if you lost your key of course (and I think Apple consider that a poor user experience, or are under pressure not to do that...).

by new299 9y ago

rodorgas 9y ago

I don't think first item is true especially if you have 2-step verification enabled. They explicit say that if you lose your auth token, they can't do nothing. When I didn't used 2-step, I forgot my password, called them and they reset it for me (I had to confirm my identity providing them a code sent to my mac).

new299 9y ago
I think "can't" is "wont" in this case. Apple law enforcement guidelines state: "All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centers." and "iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari browsing history and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centres. iCloud content, as it exists in the subscriber’s account, may be provided in response to a search warrant issued upon a showing of probable cause." So in short, Apple retains encryption keys for much of the data (including iOS backups), and will provide decrypted data to US law enforcement on request. https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...

skierscott 9y ago

iCloud security overview: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

new299 9y ago
Hmm that page is pretty unclear. Because while it says the data is encrypted serverside. What it doesn't say is which data is encrypted with a key that Apple has access to. Much of the data listed as encrypted on server is available to US law enforcement under warrant. It would be nice, to have an option available where data is encrypted on server, with your key. But that would mean you couldn't recover your data if you lost your key of course (and I think Apple consider that a poor user experience, or are under pressure not to do that...).