The guy doesn't really understand how encryption and cryptography and infosec work, making the whole article very laborious to read and quite misguided.
Weep for the future of our world governments, which will be shaped by people like this.
Weep for the future of our world governments, which will be shaped by people like this.
1. The author is Orin Kerr, a nationally recognized Law professor, and co-blogger at the single most influential Law blog - the Volokh conspiracy.
2. His highest cited academic paper (421 cites, which is a lot in law world) is titled "The fourth amendment and new technologies: constitutional myths and the case for caution", so this is literally his domain of expertise, so maybe you might want to acknowledge the possibility that he knows what he is talking about.
3. He actually changed his mind based on additional evidence that was presented to him in the form of counterarguments. Given how rarely this happens, anybody capable of doing this in a public forum automatically gets +10 Respect points from me.
4. He has a technical background, as timsally pointed out, including mechanical engineering degrees. Now if he has such trouble grappling with the subtleties of cryptography and security threat models, maybe that is also partially our fault as security practitioners. We should acknowledge that.
5. I am aware that this all sounds like an elaborate appeal to authority, but given the cavalier way people are criticizing the author (as opposed to his arguments), I thought these facts should be stated.
I will agree fully with you on 3), and partially on 5) (only partially, because on one hand I agree with the premise, but otoh if you're in a position of authority your job is precisely to understand despite potentially poor communication from other experts).
(I'm also not sure what my "accusations" are.)
I disagree with your sentiment that we should weep for the future of our world governments. I think things are slowly changing around in the right direction, and a lot of that is thanks to people like Orin Kerr who are capable of changing their minds when presented with hard evidence.
Seems like the kind of person we need more of. Not going to weep!
Apple possesses the key for most data synced with iCloud, or a huge number of iCloud features would not work. According to [1] Apple can still turn over iCloud data.
[1]: http://www.washingtonpost.com/business/technology/2014/09/17...
iOS backups are/could essentially be encrypted zip archives (poor example, but you get the idea) - this doesn't require apple to have the key for it.
Is it possible to (en/de)crypt something using a password, if that password changes?
"This means that your data is protected from unauthorized access both while it is being transmitted to your devices and when it is stored in the cloud."
And
"iCloud Keychain encryption keys are created on your devices, and Apple can't access those keys. Only encrypted keychain data passes through Apple's servers, and Apple can't access any of the key material that could be used to decrypt that data."
And finally:
"You can choose to disable keychain recovery, which means that iCloud Keychain is kept up to date across your approved devices, but the encrypted data is not stored with Apple and cannot be recovered if all of your devices are lost."
(The last is opt-in, but seems quite explicit.)
That said, he's got an MS in mechanical engineering from Stanford and a BS in mechanical/aerospace engineering from Princeton. If his technical background isn't sufficient to you, I'm not really sure what to do for you. It seems that you have mistaken him admitting that he doesn't know something as a sign that he is not technical.
He's changed his position to "need more information to decide". Well DUH! how about getting that information before scaring up a call to backdoor all of our data?