5 ms·

Regarding Reuters’s report that Apple dropped plan for encrypting iCloud backups

39 points by coloneltcb 7y ago

chmaynard 7y ago
> For at least the last decade, Apple has offered truly secure encrypted local backups of iOS devices, using iTunes on a Mac or PC. I don't see a citation for this claim. How do we know if this is correct? Trust but verify. > ... for most iPhone and iPad users it’s irrelevant, because they never connect their devices to a Mac or PC, and the overwhelming majority of them surely have no idea that the feature even exists. That's precisely why Reuters didn't mention iCloud in its headline. For almost all iOS device owners, backup means iCloud backup.
- codys 7y ago
  iTunes/local backup works over WiFi without connecting the iOS device via usb.
manicdee 7y ago
For the non-US folks like me, iCloud was a non-option from the start due to data sovereignty. I am already skating on thin ice by sharing calendars between devices using iCloud. The way Apple can best address the privacy issue while still providing easy backups is to build the iCloud backup functionality into macOS or Apple TV, with facilities to provide rsync-style backups of encrypted volumes to generic online storage services, of which Apple can be one provider. I want something like Western Digital’s “My Cloud” devices, but supporting Time Machine as first class citizen (eg using rsync) not via mounting a disk image.
- GeekyBear 7y ago
  The ability to make locally stored encrypted backups of your iDevice is built into MacOS. It works over your home wifi network or via a USB cable. On Windows (and older versions of MacOS), you can accomplish the same thing using iTunes.
- pfranz 7y ago
  In general, I think Apple's former ideology was "the computer was the hub" back when the iPod was popular. At least 10-15 years ago that's transitioned towards "the cloud is the hub" (I can imagine a bunch of reasons). The old behavior has stuck around, but not really added to and I wouldn't be surprised if it was soon dropped. I think the discontinuation of "Time Capsule" is an example of this. As another example, you can do backups via iTunes. Generally this was done when you plugged in your device. They did add syncing over wifi, but it's never been very rock solid and afaik you can't automate it since your never plugging in your device. Every time local backups get brought up people say, "but not everyone has a computer" which reenforces the focus on cloud backups.
  - manicdee 7y ago
    > Every time local backups get brought up people say, "but not everyone has a computer" which reenforces the focus on cloud backups. Which is why I would like to see the focus on migrating this functionality to their non-“computer” devices. Or add a separate device specifically to add this feature. Also the iTunes/Finder backup only works locally, can’t be used when I buy a new device to configure it while in the shop.
    - pfranz 7y ago
      > Which is why I would like to see the focus on migrating this functionality to their non-“computer” devices. Or add a separate device specifically to add this feature. I think that attempt was the AirPort Time Capsule (2008-2018). I'm sure it would have added standalone iPhone backup and other functionality if there was a strong audience. > Also the iTunes/Finder backup only works locally, can’t be used when I buy a new device to configure it while in the shop. Apple has had various "p2p" solutions. For awhile it was a physical device that would effectively do a backup & restore to a new device. More recently there's a wireless way to transition your phone that you can do yourself.
musicale 7y ago
If this bad publicity doesn't get Apple to offer encryption for iCloud backups, I don't know what will.
- MaysonL 7y ago
  They used to offer it, but found that more people were hurt by loss of passwords (i.e. fail-secure backups) than were hurt by hacking. People who lose all their family photos because they forgot their password get very angry and sad, and it happens more often than you might think. I believe they switched back in 2015 or so.
  - McAtNite 7y ago
    I don’t buy that defense. They could set it up to function exactly like local encryption on your Mac. When encrypting the drive it has you set your passcode. Then it tells you in plain English that you can let them store a decryption key for you in case you forget the passcode or you can store the decryption key yourself and risk losing access to your files if you lose it. It’s simple, easy to understand, and allows the user to decide what sort of security they are comfortable with.
    - GhettoMaestro 7y ago
      Doesn’t matter if you don’t buy that logic - it’s real and happens everyday. But please go ahead and pontificate more.
    - bradknowles 7y ago
      When I first enabled iTunes cloud backups years ago, it did exactly that — gave me the choice of letting them securely store a copy of my cloud encryption key, just in case. I didn’t take that option, but the option was there.
banku_brougham 7y ago
The author’s hypothesis of how the FBI discussion happened is naive, seeming almost like a straw man. Here’s what happened — Apple and FBI have been locked in combat for years over this issue. Surely they’ve been served with National Security letters, and had the full weight of the government pressing on them. Apple was forced to compromise, and iCloud is pretty much everything.
- machello13 7y ago
  I think you mistook his point. He's not arguing that Apple didn't acquiesce to the FBI, he's just pointing out how ridiculous the idea is that Apple reached out to the FBI to discuss future product plans (which is what Reuters says happened).
parliament32 7y ago
>Surely there are hundreds, maybe thousands, of people every day who need to access their iCloud backups who do not remember their password. The fact that Apple can help them is a benefit to those users. Wait, so how does this work right now? "Hey I promise I'm so-and-so, here's a totally-not-doctored scan of my passport, can you go ahead and send me literally every conversation, photo, calendar event, note and file I've downloaded since I've been in the Apple ecosystem? Thanks" That's terrifying.

39 points by coloneltcb 7y ago

> For at least the last decade, Apple has offered truly secure encrypted local backups of iOS devices, using iTunes on a Mac or PC. I don't see a citation for this claim. How do we know if this is correct? Trust but verify. > ... for most iPhone and iPad users it’s irrelevant, because they never connect their devices to a Mac or PC, and the overwhelming majority of them surely have no idea that the feature even exists. That's precisely why Reuters didn't mention iCloud in its headline. For almost all iOS device owners, backup means iCloud backup.

codys 7y ago
iTunes/local backup works over WiFi without connecting the iOS device via usb.

manicdee 7y ago

For the non-US folks like me, iCloud was a non-option from the start due to data sovereignty. I am already skating on thin ice by sharing calendars between devices using iCloud. The way Apple can best address the privacy issue while still providing easy backups is to build the iCloud backup functionality into macOS or Apple TV, with facilities to provide rsync-style backups of encrypted volumes to generic online storage services, of which Apple can be one provider. I want something like Western Digital’s “My Cloud” devices, but supporting Time Machine as first class citizen (eg using rsync) not via mounting a disk image.

GeekyBear 7y ago
The ability to make locally stored encrypted backups of your iDevice is built into MacOS. It works over your home wifi network or via a USB cable. On Windows (and older versions of MacOS), you can accomplish the same thing using iTunes.
pfranz 7y ago
In general, I think Apple's former ideology was "the computer was the hub" back when the iPod was popular. At least 10-15 years ago that's transitioned towards "the cloud is the hub" (I can imagine a bunch of reasons). The old behavior has stuck around, but not really added to and I wouldn't be surprised if it was soon dropped. I think the discontinuation of "Time Capsule" is an example of this. As another example, you can do backups via iTunes. Generally this was done when you plugged in your device. They did add syncing over wifi, but it's never been very rock solid and afaik you can't automate it since your never plugging in your device. Every time local backups get brought up people say, "but not everyone has a computer" which reenforces the focus on cloud backups.
- manicdee 7y ago
  > Every time local backups get brought up people say, "but not everyone has a computer" which reenforces the focus on cloud backups. Which is why I would like to see the focus on migrating this functionality to their non-“computer” devices. Or add a separate device specifically to add this feature. Also the iTunes/Finder backup only works locally, can’t be used when I buy a new device to configure it while in the shop.
  - pfranz 7y ago
    > Which is why I would like to see the focus on migrating this functionality to their non-“computer” devices. Or add a separate device specifically to add this feature. I think that attempt was the AirPort Time Capsule (2008-2018). I'm sure it would have added standalone iPhone backup and other functionality if there was a strong audience. > Also the iTunes/Finder backup only works locally, can’t be used when I buy a new device to configure it while in the shop. Apple has had various "p2p" solutions. For awhile it was a physical device that would effectively do a backup & restore to a new device. More recently there's a wireless way to transition your phone that you can do yourself.

musicale 7y ago

If this bad publicity doesn't get Apple to offer encryption for iCloud backups, I don't know what will.

MaysonL 7y ago
They used to offer it, but found that more people were hurt by loss of passwords (i.e. fail-secure backups) than were hurt by hacking. People who lose all their family photos because they forgot their password get very angry and sad, and it happens more often than you might think. I believe they switched back in 2015 or so.
- McAtNite 7y ago
  I don’t buy that defense. They could set it up to function exactly like local encryption on your Mac. When encrypting the drive it has you set your passcode. Then it tells you in plain English that you can let them store a decryption key for you in case you forget the passcode or you can store the decryption key yourself and risk losing access to your files if you lose it. It’s simple, easy to understand, and allows the user to decide what sort of security they are comfortable with.
  - GhettoMaestro 7y ago
    Doesn’t matter if you don’t buy that logic - it’s real and happens everyday. But please go ahead and pontificate more.
  - bradknowles 7y ago
    When I first enabled iTunes cloud backups years ago, it did exactly that — gave me the choice of letting them securely store a copy of my cloud encryption key, just in case. I didn’t take that option, but the option was there.

banku_brougham 7y ago

The author’s hypothesis of how the FBI discussion happened is naive, seeming almost like a straw man. Here’s what happened — Apple and FBI have been locked in combat for years over this issue. Surely they’ve been served with National Security letters, and had the full weight of the government pressing on them. Apple was forced to compromise, and iCloud is pretty much everything.

machello13 7y ago
I think you mistook his point. He's not arguing that Apple didn't acquiesce to the FBI, he's just pointing out how ridiculous the idea is that Apple reached out to the FBI to discuss future product plans (which is what Reuters says happened).

parliament32 7y ago

>Surely there are hundreds, maybe thousands, of people every day who need to access their iCloud backups who do not remember their password. The fact that Apple can help them is a benefit to those users. Wait, so how does this work right now? "Hey I promise I'm so-and-so, here's a totally-not-doctored scan of my passport, can you go ahead and send me literally every conversation, photo, calendar event, note and file I've downloaded since I've been in the Apple ecosystem? Thanks" That's terrifying.