Apple Expands iCloud Encryption - ThreatWire (Patreon)

By Shannon Morse 

Just this month Apple announced plans for Advanced Data Protection in iCloud, which basically means users will now have the option to enable end to end encryption for data they store in iCloud such as backups, Notes, and Photos. This unveiling by Apple is intended to limit attacks on accounts by third party malicious actors, but will also limit the data that law enforcement will have access to. It’ll also prevent Apple itself from accessing user data.

Apple has already encrypted 14 data categories so far, including health data, maps, safari browser history and more, but this news brings the encrypted data up to 23 categories. Now, only trusted devices that a user has allowed will have access to the new categories as well.

The EFF has campaigned for better encryption and privacy for iCloud users for years, and while this is a great step, it still remains opt in. Users will need to go into their settings and opt into encryption as it is not the default. It also still doesn’t include iCloud Mail, Contacts, or Calendar, reason being? Apple says this is due to interoperability required by those features.

Of course, the FBI and other law enforcement agencies aren’t happy about this change. These agencies worry E2EE hinders their ability to gain access to information needed for court action against criminals.

For iCloud users, Advanced Data Protection will be available by the end of the year in the US, and will roll out worldwide in early 2023, in iOS 16.2, iPadOS 16.2 and macOS 13.1. Apple does warn that if you turn on Advanced Data Protection and lose access to your account, Apple won’t have the encryption keys to help you recover it - you’ll need your device passcode or password, a recovery contact, or a personal recovery key - so make sure you have a backup way of gaining access to your account. Users who opt into encryption will be prompted to choose a backup during initial setup.

Apple is also adding the ability to use hardware keys for 2 factor authentication for Apple IDs and iMessage Contact Key Verification for secure communications. While this is great to secure communications between Apple users, messaging still defaults to unencrypted SMS when communicating with Android users, which could be mitigated if all manufacturers chose a shared protocol like RCS.

LINKS:

https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/

https://www.zdnet.com/article/apple-is-bringing-end-to-end-encryption-to-icloud-backups-heres-what-it-means/

https://arstechnica.com/gadgets/2022/12/apple-adds-end-to-end-encryption-to-icloud-device-backups-and-more/

https://www.bleepingcomputer.com/news/apple/apple-rolls-out-end-to-end-encryption-for-icloud-backups/

https://thehackernews.com/2022/12/apple-boosts-security-with-new-imessage.html