Apple Abandoned Plans for Encrypted iCloud Backup after FBI Complained

me • January 23, 2020 8:00 AM

Reuters could not determine why exactly Apple dropped the plan.

That is easy to guess…

Seems that as soon as someone is near to make a system with decent security someone from the gov arrive and force you to stop working on security or destroy the security you already build.
(for example skype that was end-to-end before microsoft bought it)

Eric Hydrick • January 23, 2020 8:32 AM

iMore has a more in-depth article about this and the security trade-offs between backups Apple can’t decrypt and the current system. Basically encrypted backups that Apple couldn’t unlock caused more customer problems than the security problems they solved, which was a major reason in the change in how iCloud backups were handled. https://www.imore.com/apples-icloud-backup-plans-and-fbi

SocraticGadfly • January 23, 2020 8:55 AM

Lemme see. Eric posts a link from an iCult site. Why should I believe it’s anything more than PR?

I, and people better than me (Doctorow), have tackled both the relative insecurity of iPhones and the smugness of the iCult in the face of that and other things, such as how many trackers Apple allows on iOS. https://socraticgadfly.blogspot.com/2019/12/the-smugness-of-apples-icult.html

Alejandro • January 23, 2020 9:16 AM

@Eric Re:
“…encrypted backups that Apple couldn’t unlock caused more customer problems than the security problems they solved…”

Although I do think Apple crumbled under political pressure, I can testify encryption management by end users is difficult. Mistakes, like forgetting the (one and only) pw, like failing to follow the multiple steps precisely, like failure to understand terminology and apply settings, etc are common.

Also, based on some very recent experiments, I can suggest user managed encryption apps do seem to attract immediate unwanted attention from foreign entities …and Atlanta GA, …according my logs a security stuff.

parabarbarian • January 23, 2020 9:19 AM

I can understand Apple ending the program. After all, in today’s environment, “smart” phones have to be friendly to dumb users. Also, there is an option to disable Icloud backups (at least, Apple claims it does) and use a local backup to a Mac or PC so the intelligent user can opt out of having an easily decrypted backup that law enforcement can access.

Frankly there are more serious privacy concerns such as Amazon, Microsoft, and IBM having access to your medical data.

Ren • January 23, 2020 9:28 AM

Would be interesting to know what their implementation plans were. Especially if they had ideas about the lost decryption key problem.

Surprised they caved, I guess they figure everyone forgot the 2014 iCloud hack, which e2e would have prevented that embarrassing situation.

mrpuck • January 23, 2020 9:33 AM

Thanks, Eric. Living in the golden age of surveillance we must never forget the value of encryption. It protects both data in motion and data at rest.

RealFakeNews • January 23, 2020 10:10 AM

Wait… so if a user backs up locally using a password, it’s encrypted, but backing up to iCloud (how) is not, at all??

I note the words “not END TO END encrypted”.

Can we untangle this mess and get some clarity?

So the connection is not encrypted, but does that mean the data is NOT separately encrypted prior to upload?

The argument seems a bit flawed in the face of offline encrypted backups…

Dana Schwartz • January 23, 2020 10:21 AM

From the iMore video, bottom line, Reuters was wrong, but still Apple currently has backdoor access to most iCloud backup data on their servers. If users instead choose to backup locally, Apple will not have key, but it is slightly less convenient.

And the point remains, if bad guys could get access to iCloud backups & obtain the key(s?) Apple holds, they could read data just as police legally can.

Alejandro • January 23, 2020 10:37 AM

Here is a pretty good summary of iCloud encryption policy right now:

https://support.apple.com/en-us/HT202303

Noteworthy:

Email is not encrypted on Apple servers (thus is no more than a postcard).

Normal backups are encrypted, but Apple has the server key (thus it’s wide open to the right people).

However, certain data like Heath Data, Siri information and WiFi passwords have E2E encryption. (good!)

I would think they could put more apps and data in the E2E column and leave the basic sys app backup/s with encryption on the server as is.

As Dana et al already noted, full backups are always possible on your own pc or mac….so if it’s really a big deal to the user…just don’t let Apple have anything.

Sofakinbd • January 23, 2020 10:42 AM

Bruce,

The headline you went with a little misleading, you have: Apple Abandoned Plans for Encrypted iCloud Backup after FBI Complained. It is not that the backups are “unencrypted” it is that they are encrypted for both the user and Apple. So it is much more correct to say Apple Abandoned Plans for [Fully] Encrypted [End-to-End] iCloud Backup after FBI Complained. Right now it is still encrypted for the user and Apple, but protected from casual snoops.

Sofa

Nobody special • January 23, 2020 10:48 AM

Right now it is still encrypted for the user and Apple,

and (leaving aside any 3 letter agencies) for anyone at Apple who can be bribed or blackmailed or the agencies of any other country Apple wants to do business with.

Clive Robinson • January 23, 2020 10:48 AM

The point that most sticks out to me is,

according to one current and three former FBI officials and one current and one former Apple employee.

It’s no secret that the FBI/DoJ were not happy about the last time they dragged Apple to court and had to withdraw PDQ lest the Magistrate find against them thus not set the “case law” they were after.

There are rumours they are starting to do a re-run on a court case against Apple, to get a favourable finding that would effect not just the every phone supplier to the US but by the usuall economic rules “the whole world” (look back at the history of GPS in phones to see how that works).

Thus this ambiguous set of claims appears to be aimed at “store front setting” where the FBI/DoJ are trying to publically paint Apple into a corner and set an agenda, that benifts the FBI/DoJ by the harm it does to Apple.

So just another day of politics down in the J. Edgar Hoover and Robert F. Kenedy buildings at 935 and 950 Pennsylvania Ave.

Clive Robinson • January 23, 2020 11:11 AM

@ Alejandro, ALL,

As Dana et al already noted, full backups are always possible on your own pc or mac….so if it’s really a big deal to the user…just don’t let Apple have anything.

There are two issues their.

The first is “don’t let Apple have anything”, it’s highly unlikely that the user has any real choice in this. The Apple OS is a “walled garden” that Apple but not the phone user can change more or less at any time.

Secondly even if the first issue was not in play, the “full backup” issue is “moving not solving” the problem. Arguably you are moving your data from a semisecure platform(iPhone) to a totally insecure platform (PC/Mac). Thus the user has a whole bunch of hoops and loops to get through before that backup becomes even remotely secure and the platform sanitized of it’s plaintext.

MikeA • January 23, 2020 11:39 AM

@parabarbarian:

Also, there is an option to disable Icloud backups (at least, Apple claims it does)

“There’s this big ugly knife switch over here, but I wouldn’t touch it”

Or rather, I, too, believed that the “disable iCloud backups” switch did something, and more importantly continued to do something after an OS “upgrade”. Imagine my surprise when during the “upgrade” I saw a message about uploading my keychain to iCloud. Yeah, it apparently re-enabled iCloud backups as part of the “upgrade”

This was on a Mac laptop. I can only imaging the horrors of iPhone.

Alejandro • January 23, 2020 11:48 AM

@Clive,

I guess you could back up on the PC to a drive encrypted by VeraCrypt or some such. I know various similar options are available for the Mac. (Bit Defender not trustworthy in my view0

Meanwhile, maybe annother option might be to let Apple do the grunt work of backing up system apps and settings, but siphon off sensitive data to a locally encrypted machine.

Testing methods like this for real world weaknesses might is hard. For, example, if the user is using extraordinary means to avoid the Panopticon, does it result in increased scrutiny, etc.

I have more trust in the Apple system than any other at this point. In fact, I am trying to scrape up some dinero for a high end MacBook. They are a bit pricey, though.

Gary Moore • January 23, 2020 12:26 PM

Imagine all those Genius Bar kids reacting to someone showing up complaining they’ve forgotten their password to the backup data….

It would be silly to think something like that doesn’t figure into Apple’s decision. Customer service is expensive……good customer service is very expensive…

vas pup • January 23, 2020 2:34 PM

@me • January 23, 2020 8:00 AM

Yes, you are right.
For the same reason Government and NIST do not establish such standard that ALL IoT devices, smart phones, PC, laptops, tablet, Smart TV, etc having snooping devices microphones and cameras and which are marketing in US should mandatory have hardware kill switch which allowed USER to be in total control of such surveillance capabilities, not software which could hacked by criminals, fraudsters, peeping toms, PI, government agencies without court order, foreign ICs, you name it.

But, you clear and square explained in your post why it is against consumer protection best interest.

lurker • January 23, 2020 2:42 PM

I was once given a 512k Mac, I believe the first with internal HD, 5 (or 10?) megabytes MFS, Apple System 3.0 with floppies for the updates to 3.1 & 3.2. This had fulldisk encryption, the password had been “lost”, there was so much dust on it nothing of value could still be on the disk, so I removed the disk and bulk erased it with a VHS tape bulk eraser. The installer for the new system invited setting a password. If none was set the machine was “open” and so was the “Set Password” function, meaning the first passerby could set their own password. We wanted an “open” system on this box. My Mac System hacking chops at the time did not extend to rebuilding a compressed installer and manifest after removing the encryption function. It persuaded me that Apple didn’t really get encryption, and still don’t.

After losing a couple of floppies to a third-party encryption app, there seemed some truth in a ‘net meme of the time, that

Real Men don’t do backups, they just tar-zip their stuff in 1 MB chunks [yes, it was that long ago] labelled donkey-pn.nnn, and put it on anonymous ftp.

@Alejandro:
there’s a nice line of MacBook lookalikes with very similar hardware specs, and only two thirds the price. Problem? They’re made by a well-known Chinese phone equipment maker; and they’re too new to run any useful BSD.

Ismar • January 23, 2020 3:07 PM

Let’s face it – those who handle sensitive information (criminals in particular) would never keep it on their smart phones rendering most of the FBI arguments false leaving one to conclude that the main purpose of this pressure is to enforce total state control of its citizens.

Noni • January 23, 2020 4:18 PM

I’ve seen some weird data corruption over the net. At one point World of Warcraft kept crashing due to a bad router off the ISP serving Blizzard. Ping with a payload showed corrupt data returned when it went through that node on the network.

Sometimes data corruption is picked up by the networking hardware and automatically resent & corrected, but sometimes it’s not.

Good software will verify data integrity at both ends. Even so, removing encryption may have just saved Apple a giant headache or black eye. Imagine if you had backups that couldn’t be restored due to a cosmic ray bit flip rather than restoring from unencrypted & having a ‘5’ be a ‘%’ for one phone number….

As long as the data is not sent in plaintext, it’s safe in transit. If the only encryption key is stored on the phone, and your phone is lost, how do you restore your data? If the encryption key is stored in the cloud, then what’s the point to having data stored encrypted with the key stored right next to it in the cloud?

This whole thing seems like a mountain made out of a molehill.

Or perhaps it’s that our government wants Apple to break security and allow access to the phones themselves, and they are once again playing games…

Electron 007 • January 23, 2020 4:22 PM

Apple would no longer have a key to unlock the encrypted data, meaning it would not be able to turn material over to authorities in a readable form even under court order.

We currently have no way of distinguishing a legitimate court order from the orders of a mob boss presiding over a mafia junta. It’s the same thing in some cities.

In private talks with Apple soon after, representatives of the FBI’s cyber crime agents and its operational technology division objected to the plan, arguing it would deny them the most effective means for gaining evidence against iPhone-using suspects, the government sources said.

Government labor union employees are punching in the time clock on the taxpayer’s dime, and they put on masks and speak with “deep throats” under pre-arranged and pre-authenticated conditions of anonymity to the press. The dirty tricks they played on Nixon aren’t working against Trump.

SpaceLifeForm • January 23, 2020 5:29 PM

@ Alejandro

“Also, based on some very recent experiments, I can suggest user managed encryption apps do seem to attract immediate unwanted attention from foreign entities …and Atlanta GA, …according my logs a security stuff.”

Zero surprise. Zero. You may think, via ip, that it is Atlanta. It’s not.

Ft Gordon.

Would not surprise they are still running software that I wrote last century.

SocraticGadfly • January 23, 2020 6:26 PM

So, it’s not Apple caving to the Eff Bee Eye? But, per a couple of commenters, it’s dum fük iUsers?

SpaceLifeForm • January 23, 2020 6:43 PM

@ Alejandro

Research Aleksei Burkov’s “Direct Connection”

Can you be sure Augusta is far away from Atlanta?

Or anywhere else?

Sancho_P • January 24, 2020 10:53 AM

@Alejandro,
Be warned, I concur with @MikeA, Apple is now Pears:
A couple of weeks ago I was forced (by a new keyboard!) to “upgrade” my OS X, then tried to close all holes, but to no avail. Little Snitch still indicates data going up and down in the GB range nearly every week.
Never saw that on Snow Leopard or Mavericks.

VeraCrypt: This drive (+ key) is fully open to the OS (+) when working with it.

Q • January 25, 2020 4:40 AM

I think that the term “end-to-end encryption” has been misused there. It’s a storage medium, not a chat medium, the other end doesn’t need to know what is being stored. Ideally it would be a single-ended encryption only.

Unless they were really planning to offer end-to-end encryption and be able to read the content at their end. And then hoping everyone simply assumed the “end-to-end” thing meant that they couldn’t read it. It wouldn’t be the first time a company has deliberately used misleading terms to obscure their real intent.

Petre Peter • January 26, 2020 7:42 AM

This is confusing.Yes the devil is in the details.

tfb • January 26, 2020 3:43 PM

@lurker

If you’re really talking about a 512k Mac, then it definitely did not have full-disk encryption. I am not sure when that arrived on Macs, but sometime post the first OSX.

SpaceLifeForm • January 26, 2020 3:44 PM

@ Sancho_P, Clive

This is exactly why the encryption must be separate from the comms.

As, to the why about this article…

I was going to make a list of various players involved in this saga that use iJunk, but best ignored for now. Probably classified anyway.

And, the list would be so long, I would run out of printer ink.

Me • January 28, 2020 12:31 PM

I agree that they shouldn’t call it end-to-end (as they will still use that for transit), what they should call it is client-side encryption to denote that the server has no way to read it.

Also, @Electron 007

I’ve been around for a while, and I don’t think I’ve ever heard a “Nixon was Framed” argument before.

RealFakeNews • January 29, 2020 5:13 PM

@MikeA:

Imagine my surprise when during the “upgrade” I saw a message about uploading my keychain to iCloud. Yeah, it apparently re-enabled iCloud backups as part of the “upgrade”

This was on a Mac laptop. I can only imaging the horrors of iPhone.

Didn’t it ask first?

Schneier on Security

Comments

Also, there is an option to disable Icloud backups (at least, Apple claims it does)

Leave a comment Cancel reply