4 ms·

iCloud backups cannot be decrypted by Apple. They use hardware security modules to encrypt that data and the keys are generated on-device and can't be read.

abalone 9y ago
Could you point to more detail on that? I know they use HSM for keychain escrow security. But the security white paper just says backup set and key are stored in the iCloud “account”, not keychain. I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then.
- karlshea 9y ago
  The Black Hat talk was really great: https://youtu.be/BLGFriOKz6U?t=6m55s https://youtu.be/BLGFriOKz6U?t=6m55s (link is to SEP and on-device encryption, 22:30 is iCloud stuff) > I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then. I actually think they have, the shooting was in 2015 and iOS 10 was released in 2016 and was first to have some of the features he talks about in the video.
  - comstock 9y ago
    Apple, very clearly states that only the following data is end-to-end encrypted: iCloud Keychain Payment information Wi-Fi network information Home data Siri information So everything else, pictures, notes etc. etc. part of the iCloud backup, are not. Please not spread misinformation about this. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - abalone 9y ago
      Chill. You’re extrapolating incorrectly from that brief support document. It doesn’t say that Apple can read the other encrypted stuff. The security whitepaper notes that things like iCloud backups are encrypted with keys that are stuffed into the keychain, which is then transmitted end to end encrypted.
      - comstock 9y ago
        Would you care to link to the section of the security white paper that says that? There’s a small subset of data that is encrypted end-to-end. Your photos, notes, most and most other information is not include in that. It’s pretty obvious really, they need to know the key for encrypted at rest data in order to be able to reset your password if you desire. They absolutely do don’t currently offset end-to-end encryption on the majority of data in iCloud backups.
        abalone 9y ago
        Not obvious. p55: “changing the iCloud password won’t invalidate existing backups.“ But you’re right, the paper doesn’t say they do encrypted iCloud backups yet. The infrastructure is there to store encrypted backup keys in the keychain and escrow them so they’re recoverable yet Apple never has access. It’s probably the same foundation for iMessages in iCloud which they are just rolling out. That lets them store your very sensitive messages in the cloud and restore them to new devices and reset your password, all without them ever having access to your keys. See the section on keychain escrow and recovery for more detail. It’s a game changer and makes storing data in adversarial clouds feasible.
        garmaine 9y ago
        If that were the case you wouldn’t be able to restore from an iCloud backup to a fresh new device. But you can.
        abalone 9y ago
        In a simpler system yes. But they’ve developed a sophisticated system for syncing secrets called iCloud Keychain. Apple never knows your keychain. Once a new device joins your keychain circle it would in theory be able to sync backup keys and then restore, all without Apple ever knowing. They’re about to roll this out for iMessages which are also not readable by Apple. Backups are probably in the pipeline if they’re not doing it already.
comstock 9y ago
You’re just wrong, and spreading misinformation, please read the statements by Apple here: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 In particular a limited subset of data uses end-to-end encryption, none of which is super interesting: These features and their data are transmitted and stored in iCloud using end-to-end encryption: iCloud Keychain (Includes all of your saved accounts and passwords) Payment information Wi-Fi network information Home data Siri information
- comstock 9y ago
  If I’m going to be downvotes, could someone at least link to a document that shows how these statements are incorrect?
  - sbuk 9y ago
    Downvotes are likely for “You’re just wrong, and spreading misinformation...”
    - comstock 9y ago
      I probably could have been more tactful. However the substance of my comment is correct, and while I believe Apple do great things in security and promoting privacy rights, they don’t provide end-to-end backups for most data via iCloud. They don’t claim to, but the same misinformation gets spread every time this topic comes up on HN. If you want end-to-end encrypted cloud based backups of photos and other data on iOS you presently need to use a third party app.

abalone 9y ago

Could you point to more detail on that? I know they use HSM for keychain escrow security. But the security white paper just says backup set and key are stored in the iCloud “account”, not keychain. I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then.

karlshea 9y ago
The Black Hat talk was really great: https://youtu.be/BLGFriOKz6U?t=6m55s https://youtu.be/BLGFriOKz6U?t=6m55s (link is to SEP and on-device encryption, 22:30 is iCloud stuff) > I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then. I actually think they have, the shooting was in 2015 and iOS 10 was released in 2016 and was first to have some of the features he talks about in the video.
- comstock 9y ago
  Apple, very clearly states that only the following data is end-to-end encrypted: iCloud Keychain Payment information Wi-Fi network information Home data Siri information So everything else, pictures, notes etc. etc. part of the iCloud backup, are not. Please not spread misinformation about this. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - abalone 9y ago
    Chill. You’re extrapolating incorrectly from that brief support document. It doesn’t say that Apple can read the other encrypted stuff. The security whitepaper notes that things like iCloud backups are encrypted with keys that are stuffed into the keychain, which is then transmitted end to end encrypted.
    - comstock 9y ago
      Would you care to link to the section of the security white paper that says that? There’s a small subset of data that is encrypted end-to-end. Your photos, notes, most and most other information is not include in that. It’s pretty obvious really, they need to know the key for encrypted at rest data in order to be able to reset your password if you desire. They absolutely do don’t currently offset end-to-end encryption on the majority of data in iCloud backups.
      - abalone 9y ago
        Not obvious. p55: “changing the iCloud password won’t invalidate existing backups.“ But you’re right, the paper doesn’t say they do encrypted iCloud backups yet. The infrastructure is there to store encrypted backup keys in the keychain and escrow them so they’re recoverable yet Apple never has access. It’s probably the same foundation for iMessages in iCloud which they are just rolling out. That lets them store your very sensitive messages in the cloud and restore them to new devices and reset your password, all without them ever having access to your keys. See the section on keychain escrow and recovery for more detail. It’s a game changer and makes storing data in adversarial clouds feasible.
        garmaine 9y ago
        If that were the case you wouldn’t be able to restore from an iCloud backup to a fresh new device. But you can.
        abalone 9y ago
        In a simpler system yes. But they’ve developed a sophisticated system for syncing secrets called iCloud Keychain. Apple never knows your keychain. Once a new device joins your keychain circle it would in theory be able to sync backup keys and then restore, all without Apple ever knowing. They’re about to roll this out for iMessages which are also not readable by Apple. Backups are probably in the pipeline if they’re not doing it already.

comstock 9y ago

You’re just wrong, and spreading misinformation, please read the statements by Apple here: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 In particular a limited subset of data uses end-to-end encryption, none of which is super interesting: These features and their data are transmitted and stored in iCloud using end-to-end encryption: iCloud Keychain (Includes all of your saved accounts and passwords) Payment information Wi-Fi network information Home data Siri information

comstock 9y ago
If I’m going to be downvotes, could someone at least link to a document that shows how these statements are incorrect?
- sbuk 9y ago
  Downvotes are likely for “You’re just wrong, and spreading misinformation...”
  - comstock 9y ago
    I probably could have been more tactful. However the substance of my comment is correct, and while I believe Apple do great things in security and promoting privacy rights, they don’t provide end-to-end backups for most data via iCloud. They don’t claim to, but the same misinformation gets spread every time this topic comes up on HN. If you want end-to-end encrypted cloud based backups of photos and other data on iOS you presently need to use a third party app.