Hacker News Reader

> White paper also discusses a special escrow service for backing up your keychain, incidentally.

My foggy understanding is that iCloud backups are encrypted with a key stored in iCloud Keychain, which is encrypted within the hardware security module escrow service they run, so after iOS 10 they can't actually decrypt your backup.

Edit: oh, I replied to you below as well. That video has the details but it's been awhile since I watched it.

View on HN

This contradicts statements made by Apple, most information in iCloud backups is not encrypted end-to-end.

https://support.apple.com/en-us/HT202303

See the iOS Security Guide page 55: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

It sounds like (although I'm not an expert) that it would still be impossible for them to encrypt files in higher data protection classes, since the iCloud backup keys are stored within iCloud Keychain, which is end-to-end encrypted.

Edit: and honestly if I'm misinterpreting that and it's an issue for a specific person, they should just use iTunes encrypted backups and not rely on iCloud.

The statements only refer to:

“When files are created in Data Protection classes that aren’t accessible when the device is locked”

So not photos, most data.

Reply on news.ycombinator.com