5 ms·

So iCloud Backup is not encrypted then?

by kovrik 8y ago

travbrack 8y ago
If it is, Apple has the key.
- shawnz 8y ago
  They seem to imply otherwise on this page: https://support.apple.com/en-ca/HT202303 https://support.apple.com/en-ca/HT202303 EDIT: On a second reading it looks like there's a difference between the "on server" encrypted data and the "end to end" encrypted data. Backups are covered under the former but not the latter. Shame.
  - rickycook 8y ago
    ...or the article is misleading
    - shawnz 8y ago
      I agree. I am just trying to provide evidence of Apple being misleading about this issue.
      - pvg 8y ago
        It doesn't seem misleading at all, though. The entire support article is about what kind of data they can and cannot access.
        dmix 8y ago
        It's hard to communicate this stuff TBH The fact people don't appreciate what Snowden leaked and infosec in general is as much a result of that as it is negligence or humans being 'bad'.
Crontab 8y ago
IIRC, only iCloud Keychain is encrypted in such a way that Apple's can't access it.
- eugeniub 8y ago
  There are a few more things end-to-end encrypted these days: Health app data, payment information, etc (see https://support.apple.com/en-ca/HT202303 https://support.apple.com/en-ca/HT202303). However, I am really curious about whether or not using iCloud Backup negates these protections. For iMessages, Apple specifically says that it does: "If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages." In other words, if you use iCloud Backup, Apple specifically holds a key allowing them to decrypt your messages in your iCloud backup.
- auslander 8y ago
  100% correct. iCloud data is recoverable by apple without passcode, except keychain and phone backups, if i'm not mistaken.
mygo 8y ago
it’s encrypted but they have the keys. you can access iCloud data via web, so they definitely have the capabilities to decrypt it before sending it to your browser.
- kovrik 8y ago
  'Encrypted, but _they_ have the keys' means 'not encrypted'
  - chasontherobot 8y ago
    Does the fact that my landlord has a copy of my front door key mean that my locked door is "not locked"?
    - glibgil 8y ago
      > Does the fact that my landlord has a copy of my front door key mean that my locked door is "not locked"? Yes, you can never be sure that your landlord has not let other people into your house. Your landlord could let the police into your house
      - vageli 8y ago
        What is your definition of "locked", then?
        glibgil 8y ago
        > What is your definition of "locked", then? "Did you lock the house?" "Yes" "Good because I left secrets on the kitchen table" "Oh, the landlord has a key. But it's locked" "Um, ok. It's sort of locked. It's locked, but other people can get in. All I really care about is my secrets so I guess I'll just go back and get them and find someplace else to leave them that's more 'locked'"
        jplayer01 8y ago

So iCloud Backup is not encrypted then?

by kovrik 8y ago

So iCloud Backup is not encrypted then?

travbrack 8y ago

If it is, Apple has the key.

shawnz 8y ago
They seem to imply otherwise on this page: https://support.apple.com/en-ca/HT202303 https://support.apple.com/en-ca/HT202303 EDIT: On a second reading it looks like there's a difference between the "on server" encrypted data and the "end to end" encrypted data. Backups are covered under the former but not the latter. Shame.
- rickycook 8y ago
  ...or the article is misleading
  - shawnz 8y ago
    I agree. I am just trying to provide evidence of Apple being misleading about this issue.
    - pvg 8y ago
      It doesn't seem misleading at all, though. The entire support article is about what kind of data they can and cannot access.
      - dmix 8y ago
        It's hard to communicate this stuff TBH The fact people don't appreciate what Snowden leaked and infosec in general is as much a result of that as it is negligence or humans being 'bad'.

Crontab 8y ago

IIRC, only iCloud Keychain is encrypted in such a way that Apple's can't access it.

eugeniub 8y ago
There are a few more things end-to-end encrypted these days: Health app data, payment information, etc (see https://support.apple.com/en-ca/HT202303 https://support.apple.com/en-ca/HT202303). However, I am really curious about whether or not using iCloud Backup negates these protections. For iMessages, Apple specifically says that it does: "If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages." In other words, if you use iCloud Backup, Apple specifically holds a key allowing them to decrypt your messages in your iCloud backup.
auslander 8y ago
100% correct. iCloud data is recoverable by apple without passcode, except keychain and phone backups, if i'm not mistaken.

mygo 8y ago

it’s encrypted but they have the keys. you can access iCloud data via web, so they definitely have the capabilities to decrypt it before sending it to your browser.

kovrik 8y ago
'Encrypted, but _they_ have the keys' means 'not encrypted'
- chasontherobot 8y ago
  Does the fact that my landlord has a copy of my front door key mean that my locked door is "not locked"?
  - glibgil 8y ago
    > Does the fact that my landlord has a copy of my front door key mean that my locked door is "not locked"? Yes, you can never be sure that your landlord has not let other people into your house. Your landlord could let the police into your house
    - vageli 8y ago
      What is your definition of "locked", then?
      - glibgil 8y ago
        > What is your definition of "locked", then? "Did you lock the house?" "Yes" "Good because I left secrets on the kitchen table" "Oh, the landlord has a key. But it's locked" "Um, ok. It's sort of locked. It's locked, but other people can get in. All I really care about is my secrets so I guess I'll just go back and get them and find someplace else to leave them that's more 'locked'"
        jplayer01 8y ago