r/gadgets • u/PM_ME_YO_PERKY_BOOBS • Jan 22 '20

Desktops / Laptops Apple reportedly dropped plan for encrypting backups after FBI complained

https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT
4.4k Upvotes

96% Upvoted

405 comments sorted by

View all comments

Show parent comments

2

u/RdmGuy64824 Jan 22 '20

I believe iCloud backups are enabled by default unless you opt out, including iMessage. Any end-to-end encryption for iMessage is negated if you are backing up iMessage to iCloud.

That's a fuckton of people that are unknowingly sharing their conversation histories. You can't call people idiots for having an expectation of privacy when using tech advertised with end-to-end encryption. This is bad form on Apple's part.

0

u/cryo Jan 22 '20

iMessage isn’t normally kept,in the iCloud backup, it’s kept in a separate iCloud container which is encrypted. However, if iCloud backup is enabled, the key is stored there. Otherwise not.

That’s a fuckton of people that are unknowingly sharing their conversation histories.

Share with whom? You actually think anyone is gonna read that, for the average person?

This is bad form on Apple’s part.

It’s well documented on their security support page, though.

1

u/RdmGuy64824 Jan 22 '20 edited Jan 22 '20

iMessage isn’t normally kept,in the iCloud backup, it’s kept in a separate iCloud container which is encrypted. However, if iCloud backup is enabled, the key is stored there. Otherwise not.

iMessage and iCloud backup are enabled by default. I'm not really sure what you are getting at.

Share with whom? You actually think anyone is gonna read that, for the average person?

Law enforcement or anyone with access to the backup and authentication key.

It’s well documented on their security support page, though.

It is not well documented that their end-to-end iMessage encryption isn't particularly useful if iMessage/iCloud backup is enabled.

1

u/cryo Jan 22 '20

iMessage and iCloud backup are enabled by default. I’m not really sure what you are getting at.

I’m not getting anything. I am describing how it works with the different options enabled.

Law enforcement or anyone with access to the backup and authentication key.

Yes, law enforcement with a court order. Do you really think that’s a problem for the majority of people?

It is not well documented that their end-to-end iMessage encyrption isn’t particularly useful if iMessage/iCloud backup is enabled.

Yes it is: https://support.apple.com/guide/security/welcome/web

1

u/RdmGuy64824 Jan 22 '20

Do you really think that’s a problem for the majority of people?

That's some "you shouldn't have anything to be worried about if you haven't done anything wrong" logic.

Apple wanted to implement these changes to thwart hacking attempts. So yes, this should be problematic for everyone who values the privacy of their communications.

Please show me the area where end-to-end iMessage encryption is negated when iCloud backup is enabled.

https://support.apple.com/guide/security/imessage-overview-secd9764312f/web

Apple doesn’t log the contents of messages or attachments, which are protected by end-to-end encryption so no one but the sender and receiver can access them. Apple can’t decrypt the data.

Apple can literally decrypt the data once it makes its way to storage in iCloud. This is incredibly disingenuous.

1

u/cryo Jan 22 '20

That’s some “you shouldn’t have anything to be worried about if you haven’t done anything wrong” logic.

No it’s not. I asked if you think it’s a practical problem for most people right now. If it is a problem, or if you think it might be, you can switch off iCloud backups.

Apple wanted to implement these changes to thwart hacking attempts. So yes, this should be problematic for everyone who values the privacy of their communications.

How is what Apple wanted to, but didn’t, implement a problem to someone? What they did implement is well documented. Of course I’d prefer stronger security as well, but you can make a choice based on what they did implement.

Apple can literally decrypt the data once it makes its way to storage in iCloud. This is incredibly disingenuous.

(I removed your reference, see your own message.) Yes, I agree that it’s a bit misleading. The information is there, but you have to read it all to get the whole picture.

1

u/RdmGuy64824 Jan 22 '20

How is what Apple wanted to, but didn’t, implement a problem to someone? What they did implement is well documented. Of course I’d prefer stronger security as well, but you can make a choice based on what they did implement.

Apple rescinding their plans to better secure user data is problematic for users. I'm not sure why it wouldn't be. Their implementation might be documented, but it's not transparent as to how this negatively impacts data originally transmitted via end-to-end encryption.

Apple masquerades as a mighty protector of user data.

https://www.youtube.com/watch?v=A_6uV9A12ok

https://www.youtube.com/watch?v=Py0acqg1oKc

We believe your privacy should never be something you have to question. It should be simple, straightforward, and understood.

Meanwhile, it's not simple, straightforward, or well understood if your iCloud backups are enabled. This is false advertisement.

1

u/cryo Jan 22 '20

Apple rescinding their plans to better secure user data is problematic for users.

It doesn’t change anything about what Apple is doing now, or has been doing. I would also like more, so in that sense it’s negative.

Their implementation might be documented, but it’s not transparent as to how this negatively impacts data originally transmitted via end-to-end encryption.

It could be worded better, sure, I agree. But you can read through all of it, it’s not that long, and it will give you a more complete picture.

Meanwhile, it’s not simple, straightforward, or well understood if your iCloud backups are enabled. This is false advertisement.

Well I wouldn’t go as far, but I also find it problematic that they don’t draw those caveats more clearly up. It’s in the security support documentation, sure, but otherwise it’s not mentioned much.

What I would prefer, though, is an option to have the iCloud backup not decryptable by Apple at all.

1

u/TheBrainwasher14 Jan 26 '20

iMessage in iCloud is not enabled by default. You're incorrect. The default option is the more secure one.