Daisuke Wakabayashi, writing for the Wall Street Journal:
Apple is working to bolster its encryption so that it won’t be able to decode user information stored in iCloud, according to people familiar with the matter.
But Apple executives are wrestling with how to strengthen iCloud encryption without inconveniencing users.
And:
If a user forgets a password, for example, and Apple doesn’t have the keys, the user might lose access to photos and other important data. If Apple keeps a copy of the key, the copy be “can be compromised or the service can be compelled to turn it over,” said Window Snyder, a former Apple security and privacy manager who is now chief security officer at Fastly, a content-delivery network.
And:
An Apple spokeswoman pointed to comments by Craig Federighi, the company’s senior vice president of software engineering, in a March 6 opinion piece in the Washington Post. “Security is an endless race–one that you can lead but never decisively win,” Mr. Federighi wrote. “Yesterday’s best defenses cannot fend off the attacks of today or tomorrow.”
Security vs convenience. Why is that middle ground an issue when it comes to iCloud but not to iPhone?
Is it that Apple is moving towards a similar uncompromising commitment to privacy in iCloud, but they just haven’t gotten there yet? Or is there a difference between the approaches required for iPhone and iCloud?
I the issue is that if you have that approach with one system but not the other then the user always has the other system to fall back on, but if you apply it to both they could lose access to their data. So that’s the convenience vs security issue they are talking about here.
At the moment if you somehow get locked out of your iPhone and iCloud Apple can give you access to your data by resetting your iCloud password for you. If they don’t have the key to either system and you get locked out of both then your data is effectively gone.
“Security vs convenience. Why is that middle ground an issue when it comes to iCloud but not to iPhone?”
Because of custodianship. It’s your phone, your responsibility. But the backups to the data are being held by Apple. If you forget your passcode to your
phone, then that’s on you. If Apple wipes out the backups it was keeping of your baby pictures, that’s on Apple.
Also, right now, If you get locked out of an iphone, you have a backup: plug in the phone to Itunes, enter your apple account credentials, and override the passcode. The data on the phone will be wiped, but you have your icloud backup, so you lose nothing or almost nothing.
But if you get locked out of your apple account, today the only backup is calling Apple and getting them to reset the password for you. And if the data in icloud is encrypted, then resetting the password means you lose all that data forever. Encrypting the backup means there’s no safety net anymore.
There’s also the fact that FBI aside, there are circumstances in which there is a very legitimate need for third parties to gain access to a person’s phone. When someone dies or becomes demented, it’s very hard to tell their relatives that they cannot ever see Aunt Mary’s photos, texts, etc. If the backup stays unencrypted, then that data is easy to recover. If backups are encrypted, then that data is gone forever unless they wrote their password down somewhere. And saying “sorry, without the password that dear departed Mary never told anyone, you’ll never see those baby pictures again” is a very hard sell.
Absolutely there is a difference between the approaches required for a device and the cloud. And, don’t take this personally, you guys should know it. You guys HAVE TO know it. It’s your job.
Forgot to say:
It’s very important to everyone that their phone’s data is safe from thieves. Protecting your backups from hackers is a far more abstract priority, and also a far lesser priority because 99% of hackers aren’t interested in your phone data unless you are famous, they’re interested in getting personal data on millions of people at once (from a bank or from Wal Mart) rather than data on one person.
So the threat model for icloud is far different, and that makes the importance of securing it with encryption far less, while the importance of being able to access it even if you’ve had a stroke and forgotten all your passwords is just as great as ever.
<
blockquote …………………………………………………………………………………………………>”my .friend’s mate Is getting 98$. HOURLY. on the internet.”….
<
blockquote>two days ago new Mc.Laren. F1 bought after earning 18,512$,,,this was my previous month’s paycheck ,and-a little over, 17k$ Last month .,3-5 h/r of work a days ..with extra open doors & weekly. paychecks.. it’s realy the easiest work I have ever Do.. I Joined This 7 months ago and now making over 87$, p/h.Learn. More right Hereo!550➤➤➤➤➤ http://GlobalSuperEmploymentVacanciesReportsWorld/GetPaid/98$hourly…. .❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:::::o!550………….