Hacker News Reader

Comment by MereInterest | Hacker News Reader

> Your health data stays up to date across all your devices automatically using iCloud, where it is encrypted while in transit and at rest. Apps that access HealthKit are required to have a privacy policy, so be sure to review these policies before providing apps with access to your health and fitness data.

That it is uploaded and capable of being shared with apps implies that Apple both has access to it and is capable of decrypting it. I also have a wider definition of "health data", and would include sleep patterns, heart rate, and exercise rate under it.

View on HN

They can't decrypt the health data. They can decrypt most icloud categories, but a few are only exempt.

You can also shut off icloud backup for health.

https://support.apple.com/en-il/HT209519

-------- [forgive me, for the life of me I don't easily know how to format lists on HN or even put things on newlines without double spacing]

"These features and their data are transmitted and stored in iCloud using end-to-end encryption:

Home data Health data (requires iOS 12 or later) iCloud Keychain (includes all of your saved accounts and passwords) Payment information Quicktype Keyboard learned vocabulary (requires iOS 11 or later) Screen Time Siri information Wi-Fi passwords"

https://support.apple.com/en-us/HT202303

------

Imessages are also end to end encrypted. However, if you use icloud backup, they can be decrypted as the keys are backed up.

I think all the decryption happens on the phone, so Apple can't actually see your iCloud data.

I would be very surprised if that were true. Apple needs to be able to help users reset passwords and recover data. And it would be a complicated key management situation when adding or removing devices.

It is indeed true (and complicated). There have been well-publicized cases of users who have been permanently locked out of their account, because they lost all their trusted devices and also their recovery key.

Well, I am very surprised, thanks for the info :)

That is for iOS and not the watchOS. All health data is stored on the device and Apple does not have access to it.

It doesn't even have the means to decrypt it.

Reply on news.ycombinator.com