6 ms·
>Most people, including technically knowledgable users here on HN, were unaware iCloud backups have always been unencrypted. iCloud backups are definitely encr
by Despegar 7y ago
>Most people, including technically knowledgable users here on HN, were unaware iCloud backups have always been unencrypted.
iCloud backups are definitely encrypted. They just aren't end-to-end encrypted.
That should have been plainly obvious to any technically knowledgeable user because you don't lose your data forever when you forget your Apple ID password. Or the fact that you can see your photos through a web browser on icloud.com
- pingyong 7y ago>That should have been plainly obvious to any technically knowledgeable user because you don't lose your data forever when you forget your Apple ID password. Or the fact that you can see your photos through a web browser on icloud.com You could build a system where there's a key stored on each of your devices, and your password also acts like a key. In that case, you could - Lose all your devices, but unlock with password - Forget your password, but unlock with any device - Lose one device, but unlock with your password or any other device Of course, most people's passwords would probably be way to weak, no matter how much time Apple spends stretching it into a key, but for people who use a decent password this would be fairly secure.
- hiram112 7y agoCan you explain how this works? I'm assuming my IPhone itself is encrypted with my own password (or thumbprint) and that Apple could absolutely not get into it without that thumbprint. But when you send a backup, it's decrypted, sent to Apple, and then re-encrypted with a key that Apple controls, and has nothing to do with any of the "things I personally know"? IOW, I couldn't myself decrypt my Apple backup stored on their servers?
- Despegar 7y agoApple can't comply with a law enforcement request to get into your iPhone. They can comply with anything in your iCloud Backup except for the things under End-to-end encrypted data on this page [1]. Backups are encrypted "in transit" and "at rest", but Apple retains a key. That's how they can comply with legal requests and how you can restore your data if you forget your password. [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- qrbLPHiKpiux 7y agoMy computer, or theirs. My phone, my data. Back up my data to their computer, their control. This is perfect plausible deniability for them. "Hey, we gave them a secure device. But they chose to upload their data to us, and we made it clear how we handle it in our terms of service." Which it is.
- commoner 7y ago> That should have been plainly obvious to any technically knowledgeable user As you can see from this discussion, there are a lot of technically knowledgeable people who did not find this "plainly obvious". It's disingenuous to blame users for Apple's misleading marketing.