Apple will release its long-awaited new iCloud enhanced data protection feature in Germany next week, after the feature first became available in the US in December. The mirror reports. Accordingly, Apple will apparently use the update to iOS 16.3, which the group has announced for the coming week, in order to offer the so-called Advanced Data Protection (ADP) in new regions of the world.
End-to-end encryption in iCloud
At the end of 2022, Apple surprisingly announced that it would finally fully secure most iCloud services with end-to-end encryption (end-to-end encryption, E2EE). This had been demanded by privacy activists and security researchers for years. Previously, Apple had a duplicate key for numerous categories in the iCloud, the use of which government authorities regularly request, for example to access the extremely sensitive iCloud backup.
In the future it is optionally possible to activate ADP, by default only the “Standard data protection” remains active. Once ADP has started, Apple’s duplicate key is deleted and responsibility for their own data is transferred to the users. There are a few catches, however. All devices – whether Macs, iPhones, iPads, Apple TV, Apple Watch or HomePod – must be on the current operating system. If only one device in the personal collection fails, the activation will not work. In addition, users then have to manage the keys themselves; if they are lost, Apple can no longer help.
FBI deeply concerned
Apple had promised to offer ADP worldwide – allegedly even in China, where a Communist Party-controlled company hosts the iCloud data. At the same time, there was pressure from the US federal police, the FBI, which was deeply concerned that it would not be able to gain access as part of investigations. It remains to be seen how Apple will deal with this political pressure – the group seems at least ready to fight for data protection here.
However, the extended iCloud data protection is not implemented perfectly. Critics complain that Apple does not secure all metadata such as file names and checksums with E2EE and keeps the duplicate key. This is justified by the need to be able to better compress data on the servers. “A lot of this metadata can provide information about the content of files, the checksums say, for example, whether a file or photo known (to the police) is stored in a person’s iCloud,” writes Der Spiegel in its report.
Mac & i will deal in detail with Advanced Data Protection and Apple’s other new security functions in the upcoming issue 1/2023.
(bsc)
