Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

iCloud Backup is effectively unencrypted and on by default, and sends the end device keys to Apple. Apple knows this, and went about encrypting iCloud Backups (like Google does on Android) but then stopped to preserve this vulnerability to avoid antagonizing the FBI, leaving Apple in possession of cleartext endpoint keys of all of their customers. Approximately nobody uses local iOS backups because iCloud Backup is enabled by default (even if you don't want to use iCloud and only log in with your Apple ID to install apps in the App Store).

If the middle relay service has the keys, it's not end to end encrypted.

The non-e2ee iCloud Backup does include your photos, includes your messages (if you have Messages in iCloud disabled) or includes your message sync keys (which are equivalent to your messages) if you have Messages in iCloud enabled. Your photos, contacts, calendars, notes, etc are never end to end encrypted and don't even pretend to be.

Even if you disable iCloud Backup and do only local backups: everyone you iMessage with will have iCloud Backup still enabled, sending either the sync keys (Messages in iCloud on) or the messages themselves (Messages in iCloud off) to Apple in plaintext in the backup that is done automatically each night.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: