3 ms·

The data wasn’t transmitted, communicated or delivered to Apple. It’s E2E encrypted, so Apple can’t receive it. The service isn’t capable of delivering the ke

by grok25 3y ago

The data wasn’t transmitted, communicated or delivered to Apple. It’s E2E encrypted, so Apple can’t receive it. The service isn’t capable of delivering the keychain to anything other than the user’s own devices.

ratg13 3y ago
Who do you think the other end is? It’s Apple. They are the other end where the traffic is decrypted. And yes they can see your stuff. We know this because law enforcement gets access to it all the time. The keychain is just another keystore.
- kalleboo 3y ago
  Please don't spread lies. > They are the other end where the traffic is decrypted Only for certain types of data, with certain settings. That does not include the keychain. https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 > And yes they can see your stuff. We know this because law enforcement gets access to it all the time. What law enforcement typically gets access to is iCloud Backups, which is not end-to-end encrypted by default (but can be) and is not a mandatory feature. iCloud backups do not contain your keychain. > The keychain is just another keystore Nobody has said anything else? But Apple does not hold the key to decrypt it.
  - hedora 3y ago
    Your link (Dec 14, 2023) says they E2E encrypt it and do not store escrow keys, but this link (May 13, 2022) says they store escrow keys for keychain: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych... Did they announce this change? It's a pretty major UI departure. In particular, if you have one Apple device and loose it, the 2022 article implies you can recover your keychain, but the 2023 article says you're completely screwed. A lot of people rely on iCloud backup. It seems like there should be a device-wide toggle that lets you choose between the two behaviors for things like passwords, health data, and all the other E2E apps.
    - kalleboo 3y ago
      The platform security guide PDF (May 2022) on the page you linked is a lot more detailed and explains it better https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... The escrow is only an additional layer of security - your device still has to decrypt the downloaded keychain contents using your password AFTER proving to escrow that you're allowed to download the encrypted keychain using device or SMS 2FA or an iCloud security code.

by grok25 3y ago

ratg13 3y ago

Who do you think the other end is? It’s Apple. They are the other end where the traffic is decrypted. And yes they can see your stuff. We know this because law enforcement gets access to it all the time. The keychain is just another keystore.

kalleboo 3y ago
Please don't spread lies. > They are the other end where the traffic is decrypted Only for certain types of data, with certain settings. That does not include the keychain. https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 > And yes they can see your stuff. We know this because law enforcement gets access to it all the time. What law enforcement typically gets access to is iCloud Backups, which is not end-to-end encrypted by default (but can be) and is not a mandatory feature. iCloud backups do not contain your keychain. > The keychain is just another keystore Nobody has said anything else? But Apple does not hold the key to decrypt it.
- hedora 3y ago
  Your link (Dec 14, 2023) says they E2E encrypt it and do not store escrow keys, but this link (May 13, 2022) says they store escrow keys for keychain: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych... Did they announce this change? It's a pretty major UI departure. In particular, if you have one Apple device and loose it, the 2022 article implies you can recover your keychain, but the 2023 article says you're completely screwed. A lot of people rely on iCloud backup. It seems like there should be a device-wide toggle that lets you choose between the two behaviors for things like passwords, health data, and all the other E2E apps.
  - kalleboo 3y ago
    The platform security guide PDF (May 2022) on the page you linked is a lot more detailed and explains it better https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... The escrow is only an additional layer of security - your device still has to decrypt the downloaded keychain contents using your password AFTER proving to escrow that you're allowed to download the encrypted keychain using device or SMS 2FA or an iCloud security code.