iCloud: Who holds the key? (2012)
iCloud: Who holds the key? (2012)
Ars Technica brings us today’s shocking privacy news: ‘Apple holds the master decryption key when it comes to iCloud security, privacy’. Oh my. The story is definitely worth a rea…
You're viewing a single thread.
Some key quotes from the article:
It’s perfectly reasonable for a consumer cloud storage provider to design a system that emphasizes recoverability over security. Apple’s customers are far more likely to lose their password/iPhone than they are to be the subject of a National Security Letter or data breach (hopefully, anyway).
I wish that companies like Apple could just come right out and warn their users: ‘We have access to all your data, we do bulk-encrypt it, but it’s still available to us and to law enforcement whenever necessary’.
So what is the alternative?
Well, for a consumer-focused system, maybe there really isn’t one. Ultimately people back up their data because they’re afraid of losing their devices, which cuts against the idea of storing encryption keys inside of devices.
You could take the PGP approach and back up your decryption keys to some other location (your PC, for example, or a USB stick). But this hasn’t proven extremely popular with the general public, because it’s awkward — and sometimes insecure.
Alternatively, you could use a password to derive the encryption/decryption keys. This approach works fine if your users pick decent passwords (although they mostly won’t), and if they promise not to forget them. But of course, the convenience of Apple’s “iForgot” service indicates that Apple isn’t banking on users remembering their passwords. So that’s probably out too.
If you enable "Advanced Data Protection" (E2EE for your entire iCloud) Apple tells you they will not have the keys and you're on your own if you lose access to all devices that hold them (or forget their passwords, respectively). This feature was introduced last year.
That's a nice addition for those that want security over convenience. I wonder why it took them 11 years after this was written to add it.
I mean, in 2012 they didn't even have 2FA yet. Also IIRC they haven't started really leaning into the privacy angle until maybe around 2019-20 publicly, and from there it probably wasn't the highest priority item for the security team. Not excusing how long it took, but they are a business after all and with how scary the warnings around ADP are I doubt it's a very marketable feature with a lot of reach.