Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think you just hit on exactly what the plan probably was. I suspect this was the first step in making iCloud photos (not backup) E2E encrypted.

I suppose had they not gone down this road, the headlines would have been "Apple makes it easier to share child porn online".



I said unlikely: they maintain an e2e backdoor in iCloud Backup. Technically, e2e encrypting iCloud Photos at this point would be a no-op as Apple is already escrowing the device e2e keys in the backup (eg for iMessage).

I doubt they'd bother doing e2e for iCloud Photos if they're intentionally not doing it for iCloud Backup.


> Apple is already escrowing the device e2e keys in the backup

Citation? I don't believe this is correct, or at least it's an incomplete assertion.

Assuming they do get with the iCloud backup, these keys would be inside the device's Keychain file which is encrypted at rest by the Secure Enclave. Thus even with access to a full, unencrypted backup of your iPhone, the keychain itself cannot be decrypted by Apple

(It can't be decrypted by you either, if it's restored to different hardware. This is why iCloud Keychain exists. And that is end-to-end encrypted.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: