4 ms·

"... of the data in iCloud is not end-to-end encrypted, giving Apple (and the FBI and US military intelligence by extension) full access to a lot of your data,

"... of the data in iCloud is not end-to-end encrypted, giving Apple (and the FBI and US military intelligence by extension) full access to a lot of your data, such as photos or notes. I don’t use iCloud at all for this reason..." Is all of this true? Apple claim it is not accessible.

sneak 6y ago
No, they do not. They claim it is encrypted, but nowhere do they claim those types of files are end-to-end encrypted. Some iCloud data is e2e (keychain, health) but not most of it. Critically, device backups, containing all of your chat history for all time, are not e2e. Cryptographically, you would not be incorrect in describing this as a backdoor in iMessage’s end to end encryption. It’s encrypted in transit with Apple keys and it’s encrypted at rest with Apple keys. Apple can always decrypt it without you, and you would have no way of knowing if they had done so. They are vulnerable to subpoena or search warrant, but due to Apple’s participation in PRISM, they often turn over the data to military intelligence without a warrant at all. https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ Apparently they were going to fix it, but decided to leave it the way it is because the FBI was complaining. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- IndySun 6y ago
  So when there are public spats between law and Apple about unlocking Apple devices, and talk of universal rule changes on how big tech must add backdoors in the U.S. political arena, and Apple vocally saying 'Never', it's all (bare faced lies) theatre - because there already is virtually, or as I'm reading here, easy, access to any Apple service when requested by U.S. law?
encom 6y ago
>Apple claim it is not accessible. It doesn't matter what Apple claim. All their software and hardware is proprietary, including of course their "cloud" computers. You have no way of verifying anything they say.
- sneak 6y ago
  We can take them at their word: they tell us what is end-to-end encrypted, plainly. Everything not on that list is not, and thus readable by Apple. The critical items not end-to-end encrypted being device backups, photos, notes, email. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - encom 6y ago
    Trust but verify. Apples word is worth nothing.
    - IndySun 6y ago
      How do us lesser technically minded verify? Probably a question for a post all of its own. Care to start it?? You will? Yes! Awesome!! A winking icon.... But, seriously, how...?
  - ta89764894 6y ago
    In practice the end-to-end encryption of Apple products isn't better than regular encryption (in transit and at rest) with Apple holding the key. In what I assume is an effort to make the services more user friendly they have done away with key verification (something you see in Signal and Matrix-based chat services) that means the user has no way of verifying the parties of the chat and users have no say in how session keys are shared to parties. This makes it trivial for Apple to participate in all E2E sessions. It's no more work that just decrypting your non-E2E data.

sneak 6y ago

No, they do not. They claim it is encrypted, but nowhere do they claim those types of files are end-to-end encrypted. Some iCloud data is e2e (keychain, health) but not most of it. Critically, device backups, containing all of your chat history for all time, are not e2e. Cryptographically, you would not be incorrect in describing this as a backdoor in iMessage’s end to end encryption. It’s encrypted in transit with Apple keys and it’s encrypted at rest with Apple keys. Apple can always decrypt it without you, and you would have no way of knowing if they had done so. They are vulnerable to subpoena or search warrant, but due to Apple’s participation in PRISM, they often turn over the data to military intelligence without a warrant at all. https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ Apparently they were going to fix it, but decided to leave it the way it is because the FBI was complaining. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

IndySun 6y ago
So when there are public spats between law and Apple about unlocking Apple devices, and talk of universal rule changes on how big tech must add backdoors in the U.S. political arena, and Apple vocally saying 'Never', it's all (bare faced lies) theatre - because there already is virtually, or as I'm reading here, easy, access to any Apple service when requested by U.S. law?

encom 6y ago

>Apple claim it is not accessible. It doesn't matter what Apple claim. All their software and hardware is proprietary, including of course their "cloud" computers. You have no way of verifying anything they say.

sneak 6y ago
We can take them at their word: they tell us what is end-to-end encrypted, plainly. Everything not on that list is not, and thus readable by Apple. The critical items not end-to-end encrypted being device backups, photos, notes, email. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- encom 6y ago
  Trust but verify. Apples word is worth nothing.
  - IndySun 6y ago
    How do us lesser technically minded verify? Probably a question for a post all of its own. Care to start it?? You will? Yes! Awesome!! A winking icon.... But, seriously, how...?
- ta89764894 6y ago
  In practice the end-to-end encryption of Apple products isn't better than regular encryption (in transit and at rest) with Apple holding the key. In what I assume is an effort to make the services more user friendly they have done away with key verification (something you see in Signal and Matrix-based chat services) that means the user has no way of verifying the parties of the chat and users have no say in how session keys are shared to parties. This makes it trivial for Apple to participate in all E2E sessions. It's no more work that just decrypting your non-E2E data.