6 ms·

iCloud backups can be decrypted by Apple, because they have the key the data is encrypted with serverside. Are you saying this data is different?

karmelapple 9y ago
Yes. The Secure Enclave stores the data like a fingerprint, and that data - to the best of my knowledge - is not backed up to the cloud.
- comstock 9y ago
  Right, but we’re talking about medical data. Which in lieu of further information I assume would be backed up in the same way as iCloud data. Unless there are statements to the contrary?
- StevenRayOrr 9y ago
  "Health data can be stored in iCloud. When configured for iCloud storage, Health data is synced between devices and secured by encryption that protects the data both in transit and at rest. Health data is only included in encrypted iTunes Backups. It is not included in either unencrypted iTunes backups or iCloud Backup." https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf -- pg. 29 under the Health Data subsection. Edit: @bobwaycott points out the significance of this quote in the below child comment.
  - bobwaycott 9y ago
    > Health data is only included in encrypted iTunes Backups. It is not included in either unencrypted iTunes backups or iCloud Backup. Unless I’m misunderstanding you, your quote disagrees with your assertion. Health data is only included in encrypted iTunes backups. It is not included in unencrypted iTunes backups or in iCloud backups. Of course, that’s just backups. It does say it can be configured to be stored and synced between devices via iCloud, where it is encrypted in transit and at rest. That appears to indicate it is stored pre-encrypted, and does not indicate there is any way to access it outside ones devices.
    - StevenRayOrr 9y ago
      Not your misunderstanding. My misphrasing. That's what I was trying to say.
      - bobwaycott 9y ago
        Oh okay. My bad. :)
karlshea 9y ago
iCloud backups cannot be decrypted by Apple. They use hardware security modules to encrypt that data and the keys are generated on-device and can't be read.
- abalone 9y ago
  Could you point to more detail on that? I know they use HSM for keychain escrow security. But the security white paper just says backup set and key are stored in the iCloud “account”, not keychain. I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then.
  - karlshea 9y ago
    The Black Hat talk was really great: https://youtu.be/BLGFriOKz6U?t=6m55s https://youtu.be/BLGFriOKz6U?t=6m55s (link is to SEP and on-device encryption, 22:30 is iCloud stuff) > I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then. I actually think they have, the shooting was in 2015 and iOS 10 was released in 2016 and was first to have some of the features he talks about in the video.
    - comstock 9y ago
      Apple, very clearly states that only the following data is end-to-end encrypted: iCloud Keychain Payment information Wi-Fi network information Home data Siri information So everything else, pictures, notes etc. etc. part of the iCloud backup, are not. Please not spread misinformation about this. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
      - abalone 9y ago
        Chill. You’re extrapolating incorrectly from that brief support document. It doesn’t say that Apple can read the other encrypted stuff. The security whitepaper notes that things like iCloud backups are encrypted with keys that are stuffed into the keychain, which is then transmitted end to end encrypted.

karmelapple 9y ago

Yes. The Secure Enclave stores the data like a fingerprint, and that data - to the best of my knowledge - is not backed up to the cloud.

comstock 9y ago
Right, but we’re talking about medical data. Which in lieu of further information I assume would be backed up in the same way as iCloud data. Unless there are statements to the contrary?
StevenRayOrr 9y ago
"Health data can be stored in iCloud. When configured for iCloud storage, Health data is synced between devices and secured by encryption that protects the data both in transit and at rest. Health data is only included in encrypted iTunes Backups. It is not included in either unencrypted iTunes backups or iCloud Backup." https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf -- pg. 29 under the Health Data subsection. Edit: @bobwaycott points out the significance of this quote in the below child comment.
- bobwaycott 9y ago
  > Health data is only included in encrypted iTunes Backups. It is not included in either unencrypted iTunes backups or iCloud Backup. Unless I’m misunderstanding you, your quote disagrees with your assertion. Health data is only included in encrypted iTunes backups. It is not included in unencrypted iTunes backups or in iCloud backups. Of course, that’s just backups. It does say it can be configured to be stored and synced between devices via iCloud, where it is encrypted in transit and at rest. That appears to indicate it is stored pre-encrypted, and does not indicate there is any way to access it outside ones devices.
  - StevenRayOrr 9y ago
    Not your misunderstanding. My misphrasing. That's what I was trying to say.
    - bobwaycott 9y ago
      Oh okay. My bad. :)

karlshea 9y ago

iCloud backups cannot be decrypted by Apple. They use hardware security modules to encrypt that data and the keys are generated on-device and can't be read.

abalone 9y ago
Could you point to more detail on that? I know they use HSM for keychain escrow security. But the security white paper just says backup set and key are stored in the iCloud “account”, not keychain. I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then.
- karlshea 9y ago
  The Black Hat talk was really great: https://youtu.be/BLGFriOKz6U?t=6m55s https://youtu.be/BLGFriOKz6U?t=6m55s (link is to SEP and on-device encryption, 22:30 is iCloud stuff) > I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then. I actually think they have, the shooting was in 2015 and iOS 10 was released in 2016 and was first to have some of the features he talks about in the video.
  - comstock 9y ago
    Apple, very clearly states that only the following data is end-to-end encrypted: iCloud Keychain Payment information Wi-Fi network information Home data Siri information So everything else, pictures, notes etc. etc. part of the iCloud backup, are not. Please not spread misinformation about this. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - abalone 9y ago
      Chill. You’re extrapolating incorrectly from that brief support document. It doesn’t say that Apple can read the other encrypted stuff. The security whitepaper notes that things like iCloud backups are encrypted with keys that are stuffed into the keychain, which is then transmitted end to end encrypted.