>Most people, including technically knowledgable users here on HN, were unaware iCloud backups have always been unencrypted.
iCloud backups are definitely encrypted. They just aren't end-to-end encrypted.
That should have been plainly obvious to any technically knowledgeable user because you don't lose your data forever when you forget your Apple ID password. Or the fact that you can see your photos through a web browser on icloud.com
> That should have been plainly obvious to any technically knowledgeable user
As you can see from this discussion, there are a lot of technically knowledgeable people who did not find this "plainly obvious". It's disingenuous to blame users for Apple's misleading marketing.
Can you explain how this works? I'm assuming my IPhone itself is encrypted with my own password (or thumbprint) and that Apple could absolutely not get into it without that thumbprint.
But when you send a backup, it's decrypted, sent to Apple, and then re-encrypted with a key that Apple controls, and has nothing to do with any of the "things I personally know"? IOW, I couldn't myself decrypt my Apple backup stored on their servers?
Apple can't comply with a law enforcement request to get into your iPhone. They can comply with anything in your iCloud Backup except for the things under End-to-end encrypted data on this page [1]. Backups are encrypted "in transit" and "at rest", but Apple retains a key. That's how they can comply with legal requests and how you can restore your data if you forget your password.
>That should have been plainly obvious to any technically knowledgeable user because you don't lose your data forever when you forget your Apple ID password. Or the fact that you can see your photos through a web browser on icloud.com
You could build a system where there's a key stored on each of your devices, and your password also acts like a key. In that case, you could
- Lose all your devices, but unlock with password
- Forget your password, but unlock with any device
- Lose one device, but unlock with your password or any other device
Of course, most people's passwords would probably be way to weak, no matter how much time Apple spends stretching it into a key, but for people who use a decent password this would be fairly secure.
iCloud backups are definitely encrypted. They just aren't end-to-end encrypted.
That should have been plainly obvious to any technically knowledgeable user because you don't lose your data forever when you forget your Apple ID password. Or the fact that you can see your photos through a web browser on icloud.com