3 ms·

What is a “UK user?” Someone with their App Store region set to the UK? (Meaning they have a UK payment method.) What about US citizens living in the UK? Would

What is a “UK user?” Someone with their App Store region set to the UK? (Meaning they have a UK payment method.) What about US citizens living in the UK? Would they have standing to sue Apple in a US court for breach of contract? I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent – by definition, won’t the user need to provide their secret key to decrypt their existing data? Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption?

Infernal 1y ago
> Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption? More likely that the phone just sends the keys to Apple in that case
- chatmasta 1y ago
  The phone doesn’t have (all of) the keys. That’s the point. I had to save a passphrase somewhere out of band.
  - Infernal 1y ago
    But that passphrase you saved is an additional key, in case you lose all your Apple devices for example. You can tell it isn’t required for your phone to decrypt data because you don’t have to type it in to access your data, or even migrate to a new phone.
    - rootnod3 1y ago
      And if they allow rescue contacts in case you lose the password and you can decrypt the data through their account, there is a chance they also keep a key for themselves, just in case. If you got sensitive data, learn to encrypt it yourself. That is the ONLY way to make sure. If you trust another company to do the encryption at rest for you, that is your own fault. edit: s/passport/password, damn my phone.
basisword 1y ago
>> What about US citizens living in the UK? Why wouldn’t they be subject to UK laws like any other person living in the UK? >> I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent If I remember right from when this was initially discussed there isn’t any way to do it without incurring data loss (because the users device has a key Apple can’t access). As someone using ADP the risk of this led me to manually disable it at the time.
- chatmasta 1y ago
  > Why wouldn’t they [US Citizens] be subject to UK laws like any other person living in the UK? Yes, anyone in the UK is subject to UK law. But there is no UK law criminalizing the choice of a UK resident to enable Advanced Data Protection (or, if it’s already enabled, to not disable it). They’re threatening Apple, not its users. Sure, Apple is subject to UK law (although it’s debatable if they’re even violating it). But they’re not immune to lawsuits in the US just because another country told them to violate their implicit contract with users. > As someone using ADP the risk of this led me to manually disable it at the time. That’s precisely the opposite of what you should have done. I was (and am still) using ADP in the UK. If I disabled it then I would no longer have the option to enable it. Nothing is forcing me to disable it – where is the threat of data loss? It’s only a risk if I don’t disable it, which I can do at any time in the future. You surrendered your only form of leverage for no reason and made yourself less safe in the process.
  - lenkite 1y ago
    From https://support.apple.com/en-gb/122234 https://support.apple.com/en-gb/122234 > UK users will be given a period of time to disable the feature themselves to keep using their iCloud account. Doesn't this mean that you will be unable to use your iCloud account in the future if you have ADP enabled ?
    - chatmasta 1y ago
      Maybe, but any reasonable person would expect some clear, explicit notice of when that would happen. Until they “give me that period of time,” I have no reason to disable the safety feature that I won’t be able to re-enable… And disabling your iCloud Account doesn’t mean that they would stop you from disabling ADP. It would probably be a red icon in settings that says “iCloud sync is paused, disable Advanced Data Protection to resume.” (But I’m not sure I’m even subject to this, which is why I asked my original question… what’s a “UK user?” I have the US App Store active right now. I can switch to the UK store but that cancels all subscriptions, presumably including Apple Care+, which I could not re-purchase without buying a new device.)
GeekyBear 1y ago
They notified users that they would lose access to their encrypted data in the future. The user can choose to download, delete from the server, and upload it again unencrypted, if they want.
- chatmasta 1y ago
  When did this notification happen and by which channel?
  - GeekyBear 1y ago
    It was discussed in the media when Apple announced that UK users could no longer enable ADP if they had not done so already. > For users in the UK who have already enabled Advanced Data Protection, Apple will soon provide additional guidance. Apple cannot disable ADP automatically for these users. Instead, UK users will be given a period of time to disable the feature themselves to keep using their iCloud account. https://support.apple.com/en-gb/122234 https://support.apple.com/en-gb/122234
    - chatmasta 1y ago
      Right, I saw that. That’s not as explicit as what you claimed, though: > They notified users that they would lose access to their encrypted data in the future There is an implicit threat of data loss here but it’s far from clear.
      - GeekyBear 1y ago
        As I mentioned, it was discussed in the media back in February. > According to Apple’s Xcode console logs reviewed by BBC News, existing ADP subscribers will lose access through phased certificate revocation in Q2 2025. https://cybersecuritynews.com/apple-discontinued-adp-feature/ https://cybersecuritynews.com/apple-discontinued-adp-feature... The UK publicly backed down before that happened.
reorder9695 1y ago
Additionally, how would this work for people who have sensitive information on their phones? There's plenty of people who would have information on their (work) phones that they'd not be allowed to if the backups weren't encrypted, if Apple even potentially has access to it, this is not acceptable for that use case.

Infernal 1y ago

> Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption? More likely that the phone just sends the keys to Apple in that case

chatmasta 1y ago
The phone doesn’t have (all of) the keys. That’s the point. I had to save a passphrase somewhere out of band.
- Infernal 1y ago
  But that passphrase you saved is an additional key, in case you lose all your Apple devices for example. You can tell it isn’t required for your phone to decrypt data because you don’t have to type it in to access your data, or even migrate to a new phone.
  - rootnod3 1y ago
    And if they allow rescue contacts in case you lose the password and you can decrypt the data through their account, there is a chance they also keep a key for themselves, just in case. If you got sensitive data, learn to encrypt it yourself. That is the ONLY way to make sure. If you trust another company to do the encryption at rest for you, that is your own fault. edit: s/passport/password, damn my phone.

basisword 1y ago

>> What about US citizens living in the UK? Why wouldn’t they be subject to UK laws like any other person living in the UK? >> I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent If I remember right from when this was initially discussed there isn’t any way to do it without incurring data loss (because the users device has a key Apple can’t access). As someone using ADP the risk of this led me to manually disable it at the time.

chatmasta 1y ago
> Why wouldn’t they [US Citizens] be subject to UK laws like any other person living in the UK? Yes, anyone in the UK is subject to UK law. But there is no UK law criminalizing the choice of a UK resident to enable Advanced Data Protection (or, if it’s already enabled, to not disable it). They’re threatening Apple, not its users. Sure, Apple is subject to UK law (although it’s debatable if they’re even violating it). But they’re not immune to lawsuits in the US just because another country told them to violate their implicit contract with users. > As someone using ADP the risk of this led me to manually disable it at the time. That’s precisely the opposite of what you should have done. I was (and am still) using ADP in the UK. If I disabled it then I would no longer have the option to enable it. Nothing is forcing me to disable it – where is the threat of data loss? It’s only a risk if I don’t disable it, which I can do at any time in the future. You surrendered your only form of leverage for no reason and made yourself less safe in the process.
- lenkite 1y ago
  From https://support.apple.com/en-gb/122234 https://support.apple.com/en-gb/122234 > UK users will be given a period of time to disable the feature themselves to keep using their iCloud account. Doesn't this mean that you will be unable to use your iCloud account in the future if you have ADP enabled ?
  - chatmasta 1y ago
    Maybe, but any reasonable person would expect some clear, explicit notice of when that would happen. Until they “give me that period of time,” I have no reason to disable the safety feature that I won’t be able to re-enable… And disabling your iCloud Account doesn’t mean that they would stop you from disabling ADP. It would probably be a red icon in settings that says “iCloud sync is paused, disable Advanced Data Protection to resume.” (But I’m not sure I’m even subject to this, which is why I asked my original question… what’s a “UK user?” I have the US App Store active right now. I can switch to the UK store but that cancels all subscriptions, presumably including Apple Care+, which I could not re-purchase without buying a new device.)

GeekyBear 1y ago

They notified users that they would lose access to their encrypted data in the future. The user can choose to download, delete from the server, and upload it again unencrypted, if they want.

chatmasta 1y ago
When did this notification happen and by which channel?
- GeekyBear 1y ago
  It was discussed in the media when Apple announced that UK users could no longer enable ADP if they had not done so already. > For users in the UK who have already enabled Advanced Data Protection, Apple will soon provide additional guidance. Apple cannot disable ADP automatically for these users. Instead, UK users will be given a period of time to disable the feature themselves to keep using their iCloud account. https://support.apple.com/en-gb/122234 https://support.apple.com/en-gb/122234
  - chatmasta 1y ago
    Right, I saw that. That’s not as explicit as what you claimed, though: > They notified users that they would lose access to their encrypted data in the future There is an implicit threat of data loss here but it’s far from clear.
    - GeekyBear 1y ago
      As I mentioned, it was discussed in the media back in February. > According to Apple’s Xcode console logs reviewed by BBC News, existing ADP subscribers will lose access through phased certificate revocation in Q2 2025. https://cybersecuritynews.com/apple-discontinued-adp-feature/ https://cybersecuritynews.com/apple-discontinued-adp-feature... The UK publicly backed down before that happened.

reorder9695 1y ago

Additionally, how would this work for people who have sensitive information on their phones? There's plenty of people who would have information on their (work) phones that they'd not be allowed to if the backups weren't encrypted, if Apple even potentially has access to it, this is not acceptable for that use case.