Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

From that page: "By default, the iCloud Backup service key is securely backed up to iCloud Hardware Security Modules in Apple data centers, and is part of the available-after-authentication data category." It is handled in the same way as the keychain, but the page I linked has a better technical description.

Let me put this issue to rest with a pair of quotes from Apple's guide for law enforcement:

   Q: Can Apple intercept customers’ communications pursuant to a Wiretap Order?  
   A: Apple can intercept customers’ email communications, upon receipt of a valid Wiretap Order. Apple cannot intercept customers’ iMessage or FaceTime communications as these communications are end-to-end encrypted.
and

   Apple does not receive or retain encryption keys for customer’s end-to-end encrypted data.
Remember this is in response to law enforcement (and by proxy the courts) and they don't get to rely on technicalities or word games about backups to not comply with a warrant. It just isn't possible.


The reality distortion field has got you good, man. I won't be responding further after this, but in one last vain attempt to get through to you let me point out that the part you quoted means the opposite of what you seem to be implying. The "available-after-authentication data category" is not end-to-end encrypted and Apple can read it without needing your password or your device. (This obviously must be true because much of the data in this category is available in the iCloud web interface from any web browser, and is not lost even if you use the password reset function in the web interface to regain access to the account without entering any previous password or using any Apple device). Just because HSMs are used in some way, that doesn't automatically make it end-to-end encrypted and doesn't mean Apple has no way to read it. In that sentence Apple is literally telling you that the iCloud backup key is not end-to-end encrypted.

As for the "guide for law enforcement", let me quote a different part that you conveniently ignored. Emphasis mine.

> I. The following information may be available from iCloud:

> [...]

> c. Email Content and Other iCloud Content, My Photo Stream, iCloud Photo Library, iCloud Drive, Contacts, Calendars, Bookmarks, Safari Browsing History, Maps Search History, Messages, iOS Device Backups

> [...] iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari Browsing History, Maps Search History, Messages and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, Business Chat, SMS, and MMS messages and voicemail. For data Apple can decrypt, Apple retains the encryption keys in its U.S. data centers. Apple does not receive or retain encryption keys for customer’s end-to-end encrypted data. iCloud content, as it exists in the customer’s account, may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent.

Yes, Apple can and frequently does respond to warrants with decrypted iMessage data obtained from iCloud backups. This is well known, corroborated all over the internet, and not a secret. https://www.forbes.com/sites/thomasbrewster/2021/02/15/when-...

I'll bet you'll be confused by this sentence in the part that I just quoted: "Apple does not receive or retain encryption keys for customer’s end-to-end encrypted data." This is true! But iCloud backups are not end-to-end encrypted without ADP, nor are Messages in iCloud keys when stored in iCloud backups, as I have already conclusively shown. So it's irrelevant.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: