Hacker News Reader

Comment by sneak | Hacker News Reader

A much better reason to not use iCloud Drive is due to the fact that it's not end to end encrypted. Everything you store in it is readable by Apple sysadmins, support reps, and anyone who can compel them (like the US government can, without a warrant now).

Don't use non-e2ee services.

(Yes, there is an opt-in e2ee for iCloud now. No, nobody is using it because it is off by default and buried in settings.)

I use syncthing (e2ee, free software) to keep my files on all my machines. It has sane conflict handling and nice versioning backups. It even supports untrusted sync-only devices that never see plaintext so you can run a node on a vps or somewhere offsite safely.

View on HN

>Don't use non-e2ee services.

>(Yes, there is an opt-in e2ee for iCloud now. No, nobody is using it because it is off by default and buried in settings.)

These are contradictory statements. It IS e2ee. I can easily convince friends and family to click through two menus to enable it. I can't easily convince my friends and family to go through the effort of installing syncthing on multiple devices and then go through with the configuration of them.

It's great you're a syncthing advocate, but telling people that icloud drive is bad just because they don't enable a setting that could cause an average user to lose all of their data if they lose the key is a little ridiculous. I GUARANTEE YOU that your grandmother would MUCH rather be able to call Apple to get her pictures of little johnny back when she forgets her password than have it "more secure by default".

And for many people, a paper that enables they recover their account feels (and likely is) much more assuring than the possibility of never getting in because you forgot things like when you created the account or any number of years-old purchases. The paper will live in a safe right next to other important documents like their Social Security Card or Passport.

What good is e2ee if Apple employees can just VNC into your phone like another commenter said?

You have to give them permission. No different to any RDP session

>What good is e2ee if Apple employees can just VNC into your phone like another commenter said?

That would be the same regardless of whether you were using icloud or syncthing...

The commenter hasn't actually linked any sort of proof or citation (at the time I'm writing this), and assuming it exists at all, it requires you to accept the inbound connection in the first place. My guess is they're extremely confused about the new switch control function that allows remote access, not some nefarious Apple backdoor like you're insinuating.

https://support.apple.com/en-us/HT205644

> Requires you to accept the inbound connection in the first place

It's all too simple to click "OK" in an inattentive moment.

It's purely a video feed similar, it doesn't give the support employee direct access to the device. It's similar to screen sharing with FaceTime: https://support.apple.com/en-us/HT212734

> “It IS e2ee.“

Well, not really…:

” Encryption of certain metadata and usage information: Some metadata and usage information stored in iCloud remains under standard data protection, even when Advanced Data Protection is enabled. For example, dates and times when a file or object was modified are used to sort your information, and checksums of file and photo data are used to help Apple de-duplicate and optimize your iCloud and device storage — all without having access to the files and photos themselves. Representative examples are provided in the table below. ……”

https://support.apple.com/en-us/HT202303

For example, file names in iCloud are not e2e, etc. etc.

According to your own link file names in iCloud Drive are E2EE.

Ignore my previous comment, the wording on the website was a bit ambiguous and I misinterpreted it.

Oh, so even when you think your files are private, Apple uploads content checksums unencrypted that allows Apple to know what files you have, and networks of other users that also have those same unique files.

This is a huge privacy issue.

Worth noting a practical counter argument against e2ee: the vast majority of people are much more susceptible to losing all of their data because they forget or lose their encryption key compared to having their data compromised by admin staff or governments.

While I'd love to turn on e2ee, I don't trust myself enough to not lose the encryption key.

Then give the encryption key to a few people, there is at least 1 person you trust not to lose it?

Indeed, just print multiple copies on paper. The digital attack vector and physical one almost never intersect.

I think it’s less about protecting yourself against targeted attack, and more as a defence gains snooping and physhing and some gathering dirt.

> I don't trust myself enough to not lose the encryption key

If you're using a password manager, you can put the key in there. In effect this backs up the key (encrypted) to every device you install the password manager on, plus a cloud backup depending on what manager you're using.

I enabled Advanced Data Protection and put the recovery key in an encrypted 7zip file, then uploaded that file to Onedrive and Backblaze also picked it up. Every now and then I have a reminder on my phone to test-decrypt the recovery key locally to make sure I don't forget the encryption key.

Do you think “the vast majority of people” know (or even want to know) how to create an encrypted 7zip file, let alone do a dry run of decryption at some regular cadence?

You can barely convince the average user to set up their own backups, and of the users that do, how many do you think test their backup recovery procedures?

I do not know your threat model, but maybe keep a physical backup of the key?

I’m not sure what that would solve? I’m fairly confident in my backup system it follows 3-2-1 so a paper printout seems unnecessary and would possibly weaken security?

It would eliminate that fear of forgetting the key.

Again, it comes down to your threat model. Key stored in more locations is potentially compromising security, but is a trade-off everyone has to consider. It still prevents disinterested drag-net style data leakage.

If you are targeted by the big bad, I doubt my operational security would be sufficient to protect me from a motivated attacker. I suspect that there are vulnerabilities in my TPM/random number generators/encryption software that are exploitable. An evil maid or even just a camera positioned over my keyboard would probably be sufficient to grab my data. Plus those $5 wrenches.

Yeah my threat model is that nobody cares about surveilling me in particular right now, and I’m not in a jurisdiction where rubber hose cryptography is very realistic. ADP will protect me easily from most attacks short of someone blowing a zero day on me.

There is a recovery method for this too: a recovery contact:

” If you enable Advanced Data Protection and then lose access to your account, Apple will not have the encryption keys to help you recover it — you’ll need to use your device passcode or password, a recovery contact, or a personal recovery key. Because the majority of your iCloud data will be protected by end-to-end encryption, you’ll be guided to set up at least one recovery contact or recovery key before you turn on Advanced Data Protection. ”

https://support.apple.com/en-us/HT202303

How is manually turning on iCloud E2EE different to manually searching a provider that supports E2EE by default? This isn't like messaging where the other person also needs E2EE enabled.

The difference is that you know the provider is willing to ship surveillance-enabling footguns. They don't regard e2ee as core and necessary functionality.

Safe and secure providers will never touch the plaintext of any user ever, regardless of the user's configuration (or lack of it).

An example (although not in the e2ee sense) is that time Dropbox allowed logins to any account with any password provided. It illustrates that having a basic test suite over authentication systems wasn't important to them.

surely it’s easier to just click a button and turn on e2ee in icloud than change your entire cloud storage provider…

You are able to turn on end-to-end encryption on your iCloud account by going to the setting ‘advanced data protection’.

https://support.apple.com/en-ca/HT212520

> No, nobody is using it because it is off by default and buried in settings.

I’m using it. And I’m perfectly okay with this being the default behaviour.

If you’re reading this comment, you can also find out that you can turn on e2ee. (Maybe you should lead with that :P)

iCloud Drive is like, one of the only providers that has e2ee.

On iOS:

Settings > AppleID > iCloud > Advanced Data Protection

You'll see 'Add Recovery Contact' and underneath it you'll see 'Recovery Key' 'Off>'

Tap into it, agree to the notice, you'll get a 28 alphanumeric key and then re-enter that same key to finish the set-up.

They really should have it use a pass phrase. Much easier to remember

If you care about that, no provider is really safe (not everyone will copy LavaBit and close the business in response to being ordered to secretly reveal keys or otherwise allow snooping); however you can still make sure the thing being synchronised is an encrypted disk image or whatever.

But doesn’t that conflict with this articles complaint: version conflicts?

Much easier to handle version conflicts if the file isn’t a black box.

Reply on news.ycombinator.com