Some key quotes from the article:
It’s perfectly reasonable for a consumer cloud storage provider to design a system that emphasizes recoverability over security. Apple’s customers are far more likely to lose their password/iPhone than they are to be the subject of a National Security Letter or data breach (hopefully, anyway).
I wish that companies like Apple could just come right out and warn their users: ‘We have access to all your data, we do bulk-encrypt it, but it’s still available to us and to law enforcement whenever necessary’.
So what is the alternative?
Well, for a consumer-focused system, maybe there really isn’t one. Ultimately people back up their data because they’re afraid of losing their devices, which cuts against the idea of storing encryption keys inside of devices.
You could take the PGP approach and back up your decryption keys to some other location (your PC, for example, or a USB stick). But this hasn’t proven extremely popular with the general public, because it’s awkward — and sometimes insecure.
Alternatively, you could use a password to derive the encryption/decryption keys. This approach works fine if your users pick decent passwords (although they mostly won’t), and if they promise not to forget them. But of course, the convenience of Apple’s “iForgot” service indicates that Apple isn’t banking on users remembering their passwords. So that’s probably out too.
If you enable “Advanced Data Protection” (E2EE for your entire iCloud) Apple tells you they will not have the keys and you’re on your own if you lose access to all devices that hold them (or forget their passwords, respectively). This feature was introduced last year.
That’s a nice addition for those that want security over convince. I wonder why it took them 11 years after this was written to add it.
I mean, in 2012 they didn’t even have 2FA yet. Also IIRC they haven’t started really leaning into the privacy angle until maybe around 2019-20 publicly, and from there it probably wasn’t the highest priority item for the security team. Not excusing how long it took, but they are a business after all and with how scary the warnings around ADP are I doubt it’s a very marketable feature with a lot of reach.
Apple
This is not new to me. While this is about iCloud and not the iPhone device itself, wasn’t there news in the past where Apple didn’t want cooperate and give the FBI the master key to unlock iPhone device? According to Apple, they have a master key and won’t give it to anyone, other than unlocking devices for repair.
If that ever happens, we don’t know. Apple is an US company, so who knows. My point is, this is not new news (to me), because that is known and Apples strategy.
That’s not true. Apple does not have a master key for iPhones. IIRC the FBI wanted Apple to help by providing custom firmware that allowed them to do unlimited attempts on the passcode.
https://www.apple.com/customer-letter/
This is a letter from Tim Cook himself in 2016, regarding this topic. I might be wrong, but remember those articles talking about this subject and the master key for the iPhone. I’ve not read this document yet (just found it when researching to refresh memories).
The government suggests this tool could only be used once, on one phone. But that’s simply not true. Once created, the technique could be used over and over again, on any number of devices. In the physical world, it would be the equivalent of a master key, capable of opening hundreds of millions of locks — from restaurants and banks to stores and homes. No reasonable person would find that acceptable.
So without having full understanding whats going on, it looks like Tim was talking about an equivalent effect of a master key, when using such a tool (the firmware?). Maybe there comes this misconception in the media?
This article is very outdated and nowadays you can actually encrypt your entire iCloud and be the only key holder. You will get multiple strong warnings in the UI about the possibility of losing access to your account.
