3 ms·
> From what I read, iCloud backups are finally getting e2e encryption. Yes, but only as secure as the passphrase you use to unlock your phone. Except actuall
by LarryMullins 4y ago
> From what I read, iCloud backups are finally getting e2e encryption.
Yes, but only as secure as the passphrase you use to unlock your phone. Except actually less secure than that; your phone will rate limit attempts to guess your passphrase, but encrypted iCloud backups turned over to a government won't and can't rate limit attempts.
For the average user with a relatively short passphrase, iCloud backups will be trivial to crack. Still, it's an improvement.
- DCKing 4y agoYou seem to think that your phone's pin is used directly as some sort of encryption key for cloud backups, but that's not how these systems work. Your pin or face or fingerprint unlocks your phone's secure element, and the secure element contains a randomly generated high entropy encryption key for your data. This is why you can casually change your pin code in your phone's settings without it chewing through your battery and data plan reencrypting and reuploading gigabytes of cloud data.
- everfree 4y agoIn addition to what DCKing said, you can effectively rate-limit password attempts on encrypted data by deriving the key using a cryptographic hashing function such as bcrypt with a high amount of iterations.