▲ 1587 points
back
1043 comments
this announcement is huge in multiple ways:
1) they just ate every other 3rd party "secure" backup services lunch just like they did to the Hi-Res music industry.
2) details of what they backup securely, besides photos (which is top priority for me): iCloud Drive: Includes Pages, Keynote, and Numbers documents, PDFs, Safari downloads, or any other files manually or automatically saved to iCloud Drive.
3)BUT, perhaps the BIGGEST news here is that Apple is making a backup statement to what they've been saying for years and what they've recently gotten negative attention on: They don't want your data. They're not Goodle/FB/Amazon. They're giving you 2TB+ of space and you can encrypt it to the point that you'll lose your data and they don't care -- they don't want to mine your data, they don't want to know what you store on there, the don't care to scan your pictures with AI 20 different ways, they don't want to monetize it, etc, etc., just pay them money for their service and transactionally they give you only thing that you want in return -- reliable, secure, private service.
seriously, anyone at this point advocating for any other phone/os/service out there besides apple is really going out of their way to swim up river.
It's good to be passionate, but blind devotion is dangerous, especially since we already know by now Apple is positioning itself to become a major player in the advertising space and - with a dwindling economy and an increased pressure to sustained growth from shareholders - that's going to continuously encroach on our privacy guarantees for monetization purposes.
I'm advocating for an open and interoperable ecosystem of operating systems, services and applications, which is the only way to ensure sustainable customer freedom. Unfortunately that ecosystem doesn't exist yet so we're stuck with the duopoly of evil-doers (and while Google openly admits it is their business model to monetize you and your data, Apple has been caught with their hands in the cookie jar a bunch of times already and they're just developing a sweet tooth, so...).
Full disclosure: I've been using only iPhones for 12 years and am still using one today.
> seriously, anyone at this point advocating for any other phone/os/service out there besides apple is really going out of their way to swim up river.
Their software is not open source. Before this announcement you had to trust Apple not to look into the files you store in the cloud, now you have to trust that they're actually going to encrypt your files and not save the decryption key. Ultimately you still have to trust Apple. A combination of any open source OS, any cloud provider and Cryptomator or Veracrypt wouldn't require as much trust in one company.
> 1) they just ate every other 3rd party "secure" backup services lunch just like they did to the Hi-Res music industry.
This is an excellent point as to why you shouldn't even bother trying to develop software for apple machines. If it's anywhere near successful apple will just destroy you, after having taken a 30% cut from your revenue for years.
> They're giving you 2TB+ of space
I think you and I have vastly different ideas about what "giving" means.
I get 5GB of iCloud storage, unless I pay them £6.99/month for 2TB. No idea what the rate is over 2TB.
Have I missed a trick to getting this 2TB+?
(I have 7 Apple devices in my possession and have owned a further 2 that I've passed on to my kids; given the premium I paid for those I almost expect that I should get 5GB PER DEVICE, but of course that's fairly unreasonable in reality)
> anyone at this point advocating for any other phone/os/service out there besides apple is really going out of their way to swim up river
Ok, come on. What apple’s done here is great, and I personally use an iPhone, but you couldn’t think of a good reason to use anything else? An open-source OS?
Apple has a lot of things going for it, but let's not pretend they're perfect and anyone who doesn't use their products is unreasonable.
iOS still doesn't allow you to sideload without shenanigans (requiring your to not only have a Mac, but also have it resign any custom apps every week is beyond unreasonable). Some people don't care about that, but I do and not being able to do so is 100% a dealbreaker for me.
Not using Apple because you disagree with their decisions does not make one intentionally "going out of their way to swim up river." It just makes one a normal person who doesn't want to use, what it to them, an inferior product.
> the don't care to scan your pictures with AI 20 different ways
This is especially ironic as another post on the HN front-page today is about Apple giving up on their plan to scan iCloud photos for CSAN after months of pushback.
> seriously, anyone at this point advocating for any other phone/os/service out there besides apple is really going out of their way to swim up river.
This is a little hyperbolic. E2EE backups are fantastic; Apple seriously deserves a ton of praise for this. And iPhones have been getting a ton of security/privacy features that I really love, I am not going to dismiss their contributions to privacy. And while I wish some of their services like the Apple VPN/masked emails were better done, they are still fantastic features that I encourage iPhone users to enable, and that I am thrilled to see rolled out to a mass audience.
Alongside that praise, I am though going to point out that the adblocking on the iPhone is sub-par[0] because mobile Safari lacks Firefox's extension APIs, and I'll point out that their app store model blocks some privacy apps like Newpipe, which forces people into using more invasive alternatives that require stricter privacy controls. I'll point out that it is harder in some ways to get away from the default tracking that happens in Apple's apps than it is to root an Android phone and disable/swap Google services.
Threat model and personal expertise matters here; I like a lot of what iPhone do, but I also dislike a lot of what they do. Personally, I feel more confident in my ability to secure a rooted Android device than I do to secure an iPhone against the majority of privacy attacks I'm worried about. That doesn't mean that iPhones aren't the correct choice for a lot of people. I feel much less confident in a family member's ability to secure an Android phone if I can't give them advice or help them through the process.
And all of this is ignoring that privacy is one aspect of consumer freedom and rights. I think we can praise Apple for what is objectively a great move for privacy without being this over-the-top.
----
[0] Before someone complains, I'm not saying that iPhones don't have adblocking. They do have adblocking and I encourage you to use it, it's great. But that adblocking is objectively not as powerful or comprehensive as it would be to use a tool like Ublock Origin.
They mine your data as long as it can be converted into a marketable product for them. The most recent example was this: https://9to5mac.com/2022/11/21/ios-privacy-concerns-deepen/
Maybe images/photos isn't something they want to expand at this moment in time but let's not get ahead of ourselves.
* They have tons of your data anyway, lots of which is more valuable for advertising than backup of your photos.
* They are more and more into advertising business https://news.ycombinator.com/item?id=32520894
* Their executives admit that they want you and your family locked into their ecosystem (leaked emails).
Sorry, but advocating for them seems like very bad idea. Google was cool, pro-customer company once too. Until they had position to not be anymore. Open standards, without any vendor lock are only reasonable way.
"Some metadata and usage information stored in iCloud remains under standard data protection, even when Advanced Data Protection is enabled. For example, dates and times when a file or object was modified are used to sort your information, and checksums of file and photo data are used to help Apple de-duplicate and optimize your iCloud and device storage..."
Photo checksums can't be e2e encrypted huh? They reported today they abandoned their plans to do CSAM scanning on people's devices[1] and connecting the dots it seems like they wont need to since they can just do it in the cloud.
[1] https://www.wired.com/story/apple-photo-scanning-csam-commun...
One must understand that E2EE is used when you don't trust your service provider to handle your data. In other words, the adversary in your threat model is the service provider - and in this case, Apple. And what good is that encryption, if Apple obviously can do almost anything with your device?
They can remotely wipe apps. They can force-install apps and force updates. It is not too far-fetched to think that they can just remotely copy anything stored on your device to their servers. So, with an adversary that capable, I'm not sure encrypted backups provide a meaningful improvement to security and privacy.
It is becoming increasingly difficult to not just recommend an iPhone to the average person with privacy/security concerns. Sure, you can tell them to go the GrapheneOS route, but I don't think you can trust the average user not to just go and install Google Maps/Google Photos/etc as soon as the alternative FOSS option inconveniences them. I've certainly struggled with this. Then they're arguably worse off than if they'd just stuck with the Apple equivalents.
We changed the URL from https://www.apple.com/newsroom/2022/12/apple-advances-user-s... to the link that several users pointed out has the meatier details.
A small number of comments here are not about E2EE backups but rather the security key announcement. If there's a more detailed URL for that part of the story, we can factor it into its own thread.
> Some metadata and usage information stored in iCloud remains under standard data protection, even when Advanced Data Protection is enabled. For example, dates and times when a file or object was modified are used to sort your information, and checksums of file and photo data are used to help Apple de-duplicate and optimize your iCloud and device storage — all without having access to the files and photos themselves.
> • iCloud Drive The raw byte checksums of the file content and the file name
> • Photos The raw byte checksum of the photo or video
A more thorough (or less PR-ish) explanation of the Advanced Data Protection and how it works can be found here: https://support.apple.com/en-ca/guide/security/sec973254c5f/...
This is a great step, but I really hope Apple also change their position on no longer allowing users to provide a high-entropy passphrase to unlock all of this end-to-end encrypted data.
As it is, my iPhone unlock PIN is everything that's needed to decrypt the data server-side [1], and I'm not changing to an alphanumeric password on my phone only because of that.
[1] https://support.apple.com/en-us/HT204915 ("You might also be asked to enter the passcode of one of your devices to access any end-to-end encrypted content stored in iCloud.")
For everyone else who was hoping to enable E2EE for backups right away:
> Advanced Data Protection for iCloud is available in the US today for members of the Apple Beta Software Program, and will be available to US users by the end of the year. The feature will start rolling out to the rest of the world in early 2023.
Unfortunately, it seems that this requires all connected devices to be on the latest OS versions (iOS 16.2, macOS 13.1, etc.), which means you can’t use it as long as you have older devices connected to your Apple ID.
It also doesn’t work for Shared Albums, and for other “Shared” features it requires all participants to have ADP enabled.
I have been waiting a long time for backups and photos to support this, and I am glad we are finally getting it.
I don't feel like updating to a beta to get this feature (especially for the risks associated with it). But I am curious how the migration will work. Will this basically re-encrpt everything locally and then upload it or will what is already there stay unencrypted.
Also does anyone know, how do features like this work for someone with a single apple device? I don't worry about loosing access to anything because if my phone dies I have... several other devices with keys. But what about someone who doesn't?
I have often criticized Apple for marketing iMessage as end-to-end encrypted while the vast majority of encryption keys still reside on their servers and are routinely used to decrypt messages for law enforcement on demand. This is a long overdue step forward.
However, for most people their messages will still not be end-to-end encrypted because their contacts will mostly not have this optional feature enabled. To be truly effective, this feature would have to ensure that Apple does not strip the end-to-end encryption from your messages when they are sent to other people using iMessage. In my opinion it is still fraudulent to market iMessage as an end-to-end encrypted system until this is fixed.
Isn't Android backup end-to-end encrypted since 2018 or something? Why are so many people commenting like something revolutionary is happening?
If they're still hashing files, its not end to end.
An anecdote, an activist had a document in their Google Drive. It was not something people high up wanted being distributed. It was deleted not just from their account, but platform wide. Guess how they did that? Its hash.
But Apple must be able to still access all your encrypted data using your stored icloud password somehow right? Otherwise how are they able to show all your files in a web browser, from an arbitrary computer, after you've logged in
The press release is a bit sparse, there is a bit more detail on “Advanced Data Protection for iCloud” in the support article https://support.apple.com/en-us/HT202303#advanced
WOW.
I can’t help but feel this dovetails with the CSAM-scanning work that Apple canned last year.
I was always under the impression that ultimately they were doing that work because they needed some mitigations for the fact that iPhoto backups meant people were storing CSAM on Apple’s servers. If they were serious about privacy, that would be a big big problem for them —- hard to say no when the government comes knocking with a legitimate warrant, so they needed a solution that would let them preempt that scenario.
This is a much better solution.
This is major news. Companies such as Apple and Dropbox are implementing end to end encryption, at least as an option.
Was client side scanning implemented finally? Perhaps E2E paves the way to client side scanning?
For the hardware key, Apple is a bit late though. All other cloud companies have that 2FA.
Fun anectdote. Many years ago, I had all my photos and other personal documents encrypted in a PGP Disk on a RW-DVD, and did not store the password in any digital form, because that was the most secure thing to do. Some time later I forgot the password, could not find where I had written it down, and to this day have never recovered them. (Don't have a DVD reader anymore either, though I could still get one of those.) Lesson: don't forget your encryption key.
> Starting with iOS 16.2, iPadOS 16.2 and macOS 13.1, you can choose to enable Advanced Data Protection to protect the vast majority of your iCloud data, even in the case of a data breach in the cloud.
Interesting, so this is an opt-in (not default secure).
To be honest, end to end encrypted cloud backups and the upcoming forced-by-EU opening of the platform to third party developers without going through the App Store are the two killer features I was hoping to see on iOS.
This is pretty big news. I wonder will there be an immediate push back by law enforcement and governments?
Please don't be fooled. If you look at the table in the article, you'll see that there are several categories of data that are not end-to-end encrypted, like Contants, and the reason for that is probably because US government and courts want to have them, even for non-US citizens. Otherwise why not encrypt them too?
It would be fair if Apple gave a warning about US governments and courts before enabling sync to iCloud, but I guess they don't want users to know about it.
Also this is a closed source system, so we can't know whether Apple can remotely extract encryption keys or not.
Also as I understand, Apple now demands a phone number to sign up for Apple ID, so it means that now all users and their contacts are non-anonymous for Apple.
Anyone else noticed that they mentioned MacOS for iCloud backups?
As of now, there is no backing up your Mac to iCloud. There is iCloud Drive and all the individual services but TimeMachine is local storage only (shared drive or the legacy TimeCapsule).
Does this mean we’re finally getting TM backups to cloud?
Well, for the Apple fans celebrating this "win" - pay attention: all of the metadata is still visible to Apple and that can reveal a lot more information than you'd think. You can build advertising off this data. Mail/Contact/Calendar is also still not secured, and that can contain a lot of information (as Google can attest).
I think, on top of all that, it's still an overall "win" for consumers. But don't treat Apple like the white knight it purports to be. Beware the 'nice guys'.
Remember, they say nothing of what happens when they receive the data for the first time. It may be enough that they scan and store this information upon the initial ingestion, then leave you with the keys.
>> ...For users who opt in, Security Keys strengthens Apple’s two-factor authentication by requiring a hardware security key...
I hope they will support existing Yubi-Keys etc and not force users to get the dedicated Apple hardware key.
Encrypted iCloud! Never thought I’d see the day- figured intelligence agencies wouldn’t be a big fan- I guess it’s only optional though. Still won’t be using iCloud on my iPhone, but I could at least consider it.
This is trash and Apple is trash.
1) They explicitly state that they're going to keep an eye on the hashes of your files, allowing them to nuke anything they don't like from orbit system-wide. They still know what you have in cases where someone else has it and they know the plaintext. They're definitely going to scan what you keep in their cloud. It will start with kiddie porn, but then it'll be that plus terrorist documents (and who decides what that is???), and then illegal music and movies, and then...
2) It's all implemented with closed-source mysteryware. Who the fuck knows what it's doing? You've got to trust their pinky-swear, and you shouldn't. It probably works as it is described until it receives the special wink from Apple's servers, and then it sends along your private keys (possibly using an exploit they put there on purpose). If it's not verifiable (open-source and reproducible builds), it's a pinky swear.
3) This is your reminder that your iMessage isn't actually E2EE, they have a lot of the keys on their own servers.
These are all things they could fix, but don't. And they won't fix them because they don't actually give a damn about your privacy and security. We should all demand open-source, reproducibly-built encryption software.
Excellent, I’ll be adding hardware keys right away. Their existing iCloud-connected-device 2FA is better than SMS but it’s always bugged me that I wasn’t able to use a hardware key.
Now if we could just get banks on board… they’re probably the single biggest glaring hole in non-SMS 2FA. To my knowledge there’s only 2-3 US banks that even support TOTP, let alone hardware keys, which is insane given how important they are.
Wow, Apple enabling E2EE for backup is huge, since before they would bypass iMessage security by including your iMessage keys in the unencrypted cloud backup (so governments could request that copy then watch your messages in real time).
I’m sure they’ll get pushback for closing this loophole
The physical security key is interesting as it shows a lightning port in the image. Maybe a sign that a portless iPhone isn't necessarily in the immediate future? I also wonder if there's another copy of the image showing a USB-C port, since it's assumed the iPhone 15 will be USB-C to comply with the EU's standard port requirements.
This opt-in, because of sneak's law ("users can not and will not securely manage{generate, backup, authenticate} key material")[1]. Apple knows that enabling this by default would be a disaster. This means most people will not ever even know the feature exists, and few will turn it on.
This means that iMessage as a platform is still backdoored, because most people you iMessage with will be escrowing their endpoint iMessage keys to Apple in their effectively unencrypted iCloud Backups.
Apple (and the FBI/DHS/CIA/NSA soup bois without a warrant) will still be able to read everyone's iMessages in real-time.
Everyone wins. Spies keep spying, Apple gets to trot out the e2ee marketing flag.
Meanwhile, there is nothing to indicate that they don't intend to continue the rollout of their clientside photo scanning software that they previously announced.
I wonder if they will push for client side scanning for CSAM material again, since photos are covered under end to end encryption based on this announcement. As a consumer, it feels like two different teams with two different ideas of what kind of consumer privacy should be protected are trying to guide Apple in opposite directions.
Apple, the client side scan pushing and ad platform expanding company is now the same company that is releasing strengthened cloud data protection. Deduplication becomes impossible at any sort of scale and for safety Apple even turns off web access to iCloud when E2E cloud protection is turned on for the first time.
Apple has stated it will cache thumbnails using standard protections when sharing files, using "anyone with a link" will expose the unencrypted data to Apple servers. I wonder if CSAM scanning can take place for those files only.
What is the chance that there is a law-enforcement backdoor? Honest question! Could be anything from "no chance" to "pretty likely" and I don't know enough to hazard a guess. But I believe the answer is important and I'd love to hear what the HN crew has to say about it.
It seemed clear they were making moves in this direction back when their announcement about on device hash checking for CSAM prior to iCloud photos backup was made. That announcement only made sense in a world where they wanted to enable end to end encryption for photos. It's cool to see them do this, and see them also extend it to Messages too (surprising imo).
--
> The apple policy was likely about coming up with a way to enable encrypted photos on iCloud while still having some privacy preserving form of CSAM detection. Since it was only enabled when iCloud photos was enabled it was better for privacy on net than the status quo (unencrypted iCloud photos that are accessible to apple and scanned anyway).
As someone who uses SpiderOak One for e2ee backups on my gaming/media/windows box, this is really cool of them.
This should be a default, basic feature of any service today offering storage of personal information. It's not like we haven't had the technology for decades. It's win-win, too: The company can't be held responsible for the contents because they can't read them, and the user gets privacy. Which in America is legally protected from the government. That means that if the company can't peer into the data, there's no point in even wasting their time with a warrant.
If the keys on the device are generated at the user's behest with some input of theirs, it's out of Apple (e2ee vendor)'s hands, logically, logistically, legally, and ethically.
Even better security would be to allow users into their own devices. This would mean that critical data just wouldn't leave the device via the network.
(letting users into their own devices means the ability to access the entire device, examine what their device is doing, and firewall it if wanted)
Except in China and alike
> You must also update all your Apple devices to a software version that supports this feature.
Didn’t want to upgrade my perfectly functioning MBP 15 2015 for Shared Photo Library alone. They found out another way to force the upgrade.
Android has had encrypted backups for years.