Hacker News Reader

Comment by conradev | Hacker News Reader

Not if you have "Advanced Data Protection" turned on: https://support.apple.com/en-us/108756

Unlike Google's comparable backup encryption feature, ADP is off by default. And ADP protects your messages from Apple only to the extent that everyone you message also turns on this non-default option; otherwise your messages are still Apple's to read as they please with no notification to you.

To be clear, ADP default on would mean a massive influx in support requests for people that lose their data because they don't have the recovery key.

Same reason FileVault isn't on by default on macs.

On the one hand: yes. On the other hand, the ADP setting is located in the moral equivalent of the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.’

Apple could do a lot to promote this feature to more advanced users, but they don’t. I don’t believe for a second this decision is unrelated to the government pressure they’ve been receiving from the UK.

It requires two physical security keys. You can promote the hell out of it, but having to buy and set up security keys is going to stop most people.

You don't need security keys to enable ADP. You need to setup a Recovery Contact or create a Recovery Key.

This is not correct.

Is “Settings -> iCloud -> Advanced Data Protection” really the “moral equivalent of the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying Beware of the leopard”? Where else would you put it? I could see an argument for putting it in “Settings -> Privacy and Security -> Advanced Data Protection” but that to me feels like a “six if one, half dozen of the other” change.

You could suggest it during initial setup. You could advertise the feature beyond a weirdly named setting at the scroll-down portion of the iCloud page. You could call it something more descriptive like “end to end encrypted iCloud”, which would distinguish it from other security features. You could periodically ask users to do checkups, and verify that their backup contacts are still active and available — even if they’re not actively using ADP.

The best analogy I can give is the way Apple gradually raised MFA from an optional feature with 1-2% adoption to a recommended feature that had majority adoption (even if it was not required.) They did this by heavily encouraging users to turn the feature on during setup, and then bugging them about it after setup. Apple is capable of encouraging and advertising security features it cares about, even when there’s risk.

I think the requirement of having a recovery contact or key is placing too much burden and complexity on an average user. I think that's why they also keep it off the setup screens not to mention that your personal device ecosystem has to be supported (no legacy device or software). Anyone seeking improved privacy and security will discover ADP and the nuanced setup.

This is a set of engineering problems to be navigated, not really a fundamental challenge. My critique is that Apple isn't navigating those problems. Many of these problems have solutions, some of which don't require a ton of work.

1. Legacy devices are going away naturally. I doubt the number of Apple accounts with legacy (iOS/Mac) devices and routine iCloud usage is anywhere near a majority, and I assume the number drops every year. You can test for this condition whenever a user adds a new device, and encourage adoption for people who don't have this problem.

2. Apple already requires that you have backup phones and emails for MFA. They could easily enforce recovery contacts as a basic requirement for any new iOS device (even if ADP isn't turned on) and measure the stability of those relationships over time, until they're confident that these recovery relationships are viable. This would probably reduce their support costs as well.

3. Apple has a tool called "Safety Check" that's designed to help you secure your device. Last I checked, ADP isn't recommended or even mentioned by the tool as an option. This seems like an obvious place where Apple could boost understanding and knowledge about ADP, but they've chosen not to.

So yes, I do think there's quite a bit more that Apple could do. I think it's unfortunate that people believe that Apple is not currently downplaying this feature globally due to the UK mess, because that is certainly what they are doing.

Not if you live in the UK.

I’m not sure how that, specifically, is Apple’s fault. Maybe I’m missing something obvious but I think disabling that in the UK was Apple’s least abhorrent option. They also put down their foot rather firmly on not providing a backdoor.

Maybe people think that was all for show but I’m struggling to think of other examples of massive companies saying that so publicly/firmly. See also, all the times the police/FBI/etc have complained or even tried to force Apple to provide a backdoor.

All that said, I guess a, very legitimate, argument could be made that if Apple provided ways to swap out iCloud for whatever service you wanted then there might be an escape hatch of sorts even if iCloud was compromised/limited.

Do we have any guarantee that enabling ADP utilizes a new key that isn’t already in a previous non-ADP back up?

Would be a shame if they claimed they can’t decrypt but an old back up had the keys to the kingdom

You're trusting a whole lot of trust in the first place. But I imagine that they did not do that.

I can't sign into Apple Music on Android because it doesn't support security keys – small price to pay.

Reply on news.ycombinator.com