Hacker News Reader

Comment by abalone | Hacker News Reader

Totally false. It is a technology problem. Apple is at the forefront of engineering technical ways to make it impossible for them to decipher your data.

Specifically HealthKit data "is stored in Data Protection class Complete Protection, which means it is accessible only after a user enters their passcode or uses Touch ID or Face ID to unlock the device." Furthermore, "When configured for iCloud storage, Health data is synced between devices and secured by encryption that protects the data both in transit and at rest. Health data is only included in encrypted iTunes Backups. It is not included in either unencrypted iTunes backups or iCloud Backup."[1]

You also provide zero evidence that "Apple will sell your data" even if they could get it. Nothing in that citation about using China-based servers supports it.

[1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf

View on HN

So, do users in China get this feature or not?

That will give a clue about whether it is possible for Apple to decrypt the data or not...

It is impossible to trust a closed source system that cannot be audited independently. If Apple caved to the Chinese government, perhaps they will in the future cave to your local government too? Or some insurance company too? They're a business after all!

I'm playing devils advocate now. It may be securely stored today, but we cannot audit the system, and we cannot audit the updates to the system. If Apple wanted they could change this overnight without telling anyone.

That’s a very fair argument for what is considered a blackbox.

However i’m pretty sure my data stored by doctors and hospitals is less secure than my pictures in my iPhone.

Encrypted in transit and at rest doesn’t mean they don’t have the keys.

They don't have the SEP key (that is generated in and never leaves the Secure Enclave) which it's presumably encrypted with.

When the data is in transit between devices, what encryption is being used? I mean I could speculate a manner in which it’s possible to restrict this between two devices and their respective secure enclaves, but is Apple doing that?

This would mean that when backed up in Apple’s servers l, they’d have to backup per device... maybe they do?

The white paper goes into some detail on the encryption and key exchange mechanisms. Basically devices exchange public keys so their private keys never have to (and physically can’t) leave the SEP.

Backups are different. Those are not encrypted with device keys because obviously you want to recover from loss of device and restore to a brand new one. But if you’re not comfortable with that, you can do local encrypted backups with your own password via iTunes. And as noted the most sensitive data like HealthKit is only included in encrypted backups. White paper also discusses a special escrow service for backing up your keychain, incidentally.

> White paper also discusses a special escrow service for backing up your keychain, incidentally.

My foggy understanding is that iCloud backups are encrypted with a key stored in iCloud Keychain, which is encrypted within the hardware security module escrow service they run, so after iOS 10 they can't actually decrypt your backup.

Edit: oh, I replied to you below as well. That video has the details but it's been awhile since I watched it.

This contradicts statements made by Apple, most information in iCloud backups is not encrypted end-to-end.

https://support.apple.com/en-us/HT202303

See the iOS Security Guide page 55: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

It sounds like (although I'm not an expert) that it would still be impossible for them to encrypt files in higher data protection classes, since the iCloud backup keys are stored within iCloud Keychain, which is end-to-end encrypted.

Edit: and honestly if I'm misinterpreting that and it's an issue for a specific person, they should just use iTunes encrypted backups and not rely on iCloud.

The statements only refer to:

“When files are created in Data Protection classes that aren’t accessible when the device is locked”

So not photos, most data.

They do all sorts of device key exchange, if you haven't watched the talk at Black Hat I'd highly recommend it: https://youtu.be/BLGFriOKz6U?t=6m55s (link goes to beginning of Secure Enclave content, and later on in the talk he discusses iCloud which uses the SEP keys)

Excellent. I’ll take a look at that, thanks for the post.

iCloud backups can be decrypted by Apple, because they have the key the data is encrypted with serverside. Are you saying this data is different?

iCloud backups cannot be decrypted by Apple. They use hardware security modules to encrypt that data and the keys are generated on-device and can't be read.

You’re just wrong, and spreading misinformation, please read the statements by Apple here:

https://support.apple.com/en-us/HT202303

In particular a limited subset of data uses end-to-end encryption, none of which is super interesting:

These features and their data are transmitted and stored in iCloud using end-to-end encryption: iCloud Keychain (Includes all of your saved accounts and passwords) Payment information Wi-Fi network information Home data Siri information

If I’m going to be downvotes, could someone at least link to a document that shows how these statements are incorrect?

Downvotes are likely for “You’re just wrong, and spreading misinformation...”

I probably could have been more tactful. However the substance of my comment is correct, and while I believe Apple do great things in security and promoting privacy rights, they don’t provide end-to-end backups for most data via iCloud.

They don’t claim to, but the same misinformation gets spread every time this topic comes up on HN. If you want end-to-end encrypted cloud based backups of photos and other data on iOS you presently need to use a third party app.

Could you point to more detail on that? I know they use HSM for keychain escrow security. But the security white paper just says backup set and key are stored in the iCloud “account”, not keychain.

I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then.

The Black Hat talk was really great: https://youtu.be/BLGFriOKz6U?t=6m55s (link is to SEP and on-device encryption, 22:30 is iCloud stuff)

> I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then.

I actually think they have, the shooting was in 2015 and iOS 10 was released in 2016 and was first to have some of the features he talks about in the video.

Apple, very clearly states that only the following data is end-to-end encrypted:

iCloud Keychain Payment information Wi-Fi network information Home data Siri information

So everything else, pictures, notes etc. etc. part of the iCloud backup, are not. Please not spread misinformation about this.

https://support.apple.com/en-us/HT202303

Chill. You’re extrapolating incorrectly from that brief support document. It doesn’t say that Apple can read the other encrypted stuff. The security whitepaper notes that things like iCloud backups are encrypted with keys that are stuffed into the keychain, which is then transmitted end to end encrypted.

Would you care to link to the section of the security white paper that says that? There’s a small subset of data that is encrypted end-to-end. Your photos, notes, most and most other information is not include in that.

It’s pretty obvious really, they need to know the key for encrypted at rest data in order to be able to reset your password if you desire. They absolutely do don’t currently offset end-to-end encryption on the majority of data in iCloud backups.

Not obvious. p55: “changing the iCloud password won’t invalidate existing backups.“

But you’re right, the paper doesn’t say they do encrypted iCloud backups yet. The infrastructure is there to store encrypted backup keys in the keychain and escrow them so they’re recoverable yet Apple never has access. It’s probably the same foundation for iMessages in iCloud which they are just rolling out. That lets them store your very sensitive messages in the cloud and restore them to new devices and reset your password, all without them ever having access to your keys.

See the section on keychain escrow and recovery for more detail. It’s a game changer and makes storing data in adversarial clouds feasible.

Yes, they obviously have the infrastructure to do it. However, they don’t even optionally.

Part of the reason is that people sometimes forget their passwords and that would lock them out of their backups. So they want to allow email/other methods of resetting the password and giving access to data.

But it would be nice to have it as an option. It’s worrying though that even technical people seem to believe it is end-to-end encrypted. When it very obviously isn’t.

No, Apple doesn’t need to know your backup key to reset your password and retain backups. I explained why in my previous comment. If they’re not stuffing it in iCloud Keychain (yet) it’s not because the infrastructure can’t support it in principle. See: iCloud Keychain recovery. It’s probably just a matter of maturity; they still haven’t rolled out iMessages in iCloud which is a similar case.

I think they want to support the scenario of lost device, lost password, but still allow restoring data to a new device.

If that were the case you wouldn’t be able to restore from an iCloud backup to a fresh new device. But you can.

In a simpler system yes. But they’ve developed a sophisticated system for syncing secrets called iCloud Keychain. Apple never knows your keychain. Once a new device joins your keychain circle it would in theory be able to sync backup keys and then restore, all without Apple ever knowing. They’re about to roll this out for iMessages which are also not readable by Apple. Backups are probably in the pipeline if they’re not doing it already.

Only if you have multiple devices... it would be nice if they supported this optionally (it would be nice if they supported any kind of end-to-end backup optionally).

Yes. The Secure Enclave stores the data like a fingerprint, and that data - to the best of my knowledge - is not backed up to the cloud.

"Health data can be stored in iCloud. When configured for iCloud storage, Health data is synced between devices and secured by encryption that protects the data both in transit and at rest. Health data is only included in encrypted iTunes Backups. It is not included in either unencrypted iTunes backups or iCloud Backup."

https://www.apple.com/business/docs/iOS_Security_Guide.pdf -- pg. 29 under the Health Data subsection.

Edit: @bobwaycott points out the significance of this quote in the below child comment.

> Health data is only included in encrypted iTunes Backups. It is not included in either unencrypted iTunes backups or iCloud Backup.

Unless I’m misunderstanding you, your quote disagrees with your assertion. Health data is only included in encrypted iTunes backups. It is not included in unencrypted iTunes backups or in iCloud backups.

Of course, that’s just backups. It does say it can be configured to be stored and synced between devices via iCloud, where it is encrypted in transit and at rest. That appears to indicate it is stored pre-encrypted, and does not indicate there is any way to access it outside ones devices.

Not your misunderstanding. My misphrasing. That's what I was trying to say.

Oh okay. My bad. :)

Right, but we’re talking about medical data. Which in lieu of further information I assume would be backed up in the same way as iCloud data. Unless there are statements to the contrary?

I don't know if you're naive or not aware of Chinese law. The government of China will block any service whose data they cannot read. Apple is FULLY compliant with Chinese law. They even bent over backwards to enable payments via WeChat, which they'd never allow outside China.

You’re throwing words like “naive” around but you don’t cite a shred of evidence. Apple’s encryption is at the device level, i.e. before it ever leaves the device. If they turned it off for China it would be easily observable and instantly reported everywhere.

By all account iMessage is one of the few end to end encrypted messaging systems that works in China. You are almost right about China’s general stance but, if you actually did some research, you’d see so far they have tolerated Apple.

iCloud users in China must agree to this: “understand and agree that Apple and G.C.B.D. will have access to all data that you store on this service, including the right to share, exchange and disclose all user data, including content, to and between each other under applicable law.”

There is Apple-accessible iCloud data, like anything accessible via iCloud.com. The “all” part of that is probably just over broad.

Like I said, technical people would be able to observe if Apple secretly changed their security architecture for China. Apple would also get sued if they didn’t disclose that your iMessages are no longer end to end encrypted when messaging someone in China. China just hasn’t cracked down on it because it’s not that popular.

Your mental gymnastics trying to mask the obvious regarding China and Apple is astounding. What about Apple makes you put so much faith in them, so as to taint the most logical explanation as "unlikely" especially whilst dealing with China?

China doesn't give two fucks about Apple or privacy. If you are in doubt, please travel there and experience the total blackout of services that refuse the share data with China. China DOESN'T need Apple, Apple needs China. And Apple needs to comply with their rules regardless of your delusions about Apple's piety. Be it health or selfies, the Chinese government shall have ALL data (on Chinese resents) accessible to them. Or Apple can get the fuck out of China - which Apple won't do because of it's fiduciary responsibilities colloquially called "greed". Welcome to reality

Has Apple ever publicly disclosed that they don't follow this aspect of Chinese law?

Since apple hasn't been banned in China, I think that's all the evidence you need to deduce they are following all local laws.

What device level do you speak of? How does one get medical records onto the device? Where does one backup the said data off the device, as is normal with all devices today.

I repeat - your argument is based on cherry picking Apple propaganda. It's like saying "emails stored on Apple devices are encrypted". Which they most certainly are, but if subject to Chinese law, even if Apple's email service were end-to-end encrypted, they'd have to provide encryption keys to the government. So all this "email is encrypted on the iPhone" is marketing fluff

> What device level do you speak of?

iOS devices literally have a hardware security module called the SEP that controls access to sensitive information such as Health data.

> Where does one backup the said data off the device, as is normal with all devices today.

You set a password for this data when you back it up, and the data is encrypted with that password.

But we do not know if it works, do we?

Previous implementations have been crippled in ways that suggests that it could have been done on purpose. Limit the password to few characters and permit unlimited tries on the "secure" hardware. Data recovered in subseconds.

I suggest it was either done on purpose or they are incredibly incompetent. Which alternative do you believe to be true? Either way, why trust them?

Reply on news.ycombinator.com