Hacker News Reader

Comment by chatmasta | Hacker News Reader

What is a “UK user?” Someone with their App Store region set to the UK? (Meaning they have a UK payment method.)

What about US citizens living in the UK? Would they have standing to sue Apple in a US court for breach of contract?

I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent – by definition, won’t the user need to provide their secret key to decrypt their existing data? Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption?

View on HN

>> What about US citizens living in the UK?

Why wouldn’t they be subject to UK laws like any other person living in the UK?

>> I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent

If I remember right from when this was initially discussed there isn’t any way to do it without incurring data loss (because the users device has a key Apple can’t access). As someone using ADP the risk of this led me to manually disable it at the time.

> Why wouldn’t they [US Citizens] be subject to UK laws like any other person living in the UK?

Yes, anyone in the UK is subject to UK law. But there is no UK law criminalizing the choice of a UK resident to enable Advanced Data Protection (or, if it’s already enabled, to not disable it).

They’re threatening Apple, not its users. Sure, Apple is subject to UK law (although it’s debatable if they’re even violating it). But they’re not immune to lawsuits in the US just because another country told them to violate their implicit contract with users.

> As someone using ADP the risk of this led me to manually disable it at the time.

That’s precisely the opposite of what you should have done. I was (and am still) using ADP in the UK. If I disabled it then I would no longer have the option to enable it. Nothing is forcing me to disable it – where is the threat of data loss? It’s only a risk if I don’t disable it, which I can do at any time in the future. You surrendered your only form of leverage for no reason and made yourself less safe in the process.

From https://support.apple.com/en-gb/122234

> UK users will be given a period of time to disable the feature themselves to keep using their iCloud account.

Doesn't this mean that you will be unable to use your iCloud account in the future if you have ADP enabled ?

Maybe, but any reasonable person would expect some clear, explicit notice of when that would happen. Until they “give me that period of time,” I have no reason to disable the safety feature that I won’t be able to re-enable…

And disabling your iCloud Account doesn’t mean that they would stop you from disabling ADP. It would probably be a red icon in settings that says “iCloud sync is paused, disable Advanced Data Protection to resume.”

(But I’m not sure I’m even subject to this, which is why I asked my original question… what’s a “UK user?” I have the US App Store active right now. I can switch to the UK store but that cancels all subscriptions, presumably including Apple Care+, which I could not re-purchase without buying a new device.)

I think if your region is set to the US they’re treating you like a tourist and you basically won’t need to comply.

Additionally, how would this work for people who have sensitive information on their phones? There's plenty of people who would have information on their (work) phones that they'd not be allowed to if the backups weren't encrypted, if Apple even potentially has access to it, this is not acceptable for that use case.

> Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption?

More likely that the phone just sends the keys to Apple in that case

The phone doesn’t have (all of) the keys. That’s the point. I had to save a passphrase somewhere out of band.

But that passphrase you saved is an additional key, in case you lose all your Apple devices for example. You can tell it isn’t required for your phone to decrypt data because you don’t have to type it in to access your data, or even migrate to a new phone.

And if they allow rescue contacts in case you lose the password and you can decrypt the data through their account, there is a chance they also keep a key for themselves, just in case.

If you got sensitive data, learn to encrypt it yourself. That is the ONLY way to make sure. If you trust another company to do the encryption at rest for you, that is your own fault.

edit: s/passport/password, damn my phone.

They notified users that they would lose access to their encrypted data in the future.

The user can choose to download, delete from the server, and upload it again unencrypted, if they want.

When did this notification happen and by which channel?

It was discussed in the media when Apple announced that UK users could no longer enable ADP if they had not done so already.

> For users in the UK who have already enabled Advanced Data Protection, Apple will soon provide additional guidance. Apple cannot disable ADP automatically for these users. Instead, UK users will be given a period of time to disable the feature themselves to keep using their iCloud account.

https://support.apple.com/en-gb/122234

Right, I saw that. That’s not as explicit as what you claimed, though:

> They notified users that they would lose access to their encrypted data in the future

There is an implicit threat of data loss here but it’s far from clear.

As I mentioned, it was discussed in the media back in February.

> According to Apple’s Xcode console logs reviewed by BBC News, existing ADP subscribers will lose access through phased certificate revocation in Q2 2025.

https://cybersecuritynews.com/apple-discontinued-adp-feature...

The UK publicly backed down before that happened.

Reply on news.ycombinator.com