Hacker News Reader

Comment by new299 | Hacker News Reader

I can find no reference to this, and I've not heard anything about this happening in the past.

Issues with iOS include:

* iCloud not encrypting data securely serverside (i.e. they can potentially get at the data). You can avoid this by not using iCloud. * They have Ads in app, and now in the Appstore directly. Potentially this changes the dynamic, between user/advertiser in a negative way.

There are probably other issues... but I'm not currently aware of them. Overall it still seems like the best option from a privacy perspective.

View on HN

I don't think first item is true especially if you have 2-step verification enabled. They explicit say that if you lose your auth token, they can't do nothing.

When I didn't used 2-step, I forgot my password, called them and they reset it for me (I had to confirm my identity providing them a code sent to my mac).

I think "can't" is "wont" in this case. Apple law enforcement guidelines state:

"All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centers."

and

"iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari browsing history and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the keys. Apple retains the encryption keys in its U.S. data centres. iCloud content, as it exists in the subscriber’s account, may be provided in response to a search warrant issued upon a showing of probable cause."

So in short, Apple retains encryption keys for much of the data (including iOS backups), and will provide decrypted data to US law enforcement on request.

https://www.apple.com/legal/privacy/law-enforcement-guidelin...

iCloud security overview: https://support.apple.com/en-us/HT202303

Hmm that page is pretty unclear. Because while it says the data is encrypted serverside. What it doesn't say is which data is encrypted with a key that Apple has access to.

Much of the data listed as encrypted on server is available to US law enforcement under warrant.

It would be nice, to have an option available where data is encrypted on server, with your key. But that would mean you couldn't recover your data if you lost your key of course (and I think Apple consider that a poor user experience, or are under pressure not to do that...).

Reply on news.ycombinator.com