Apple Inc. is upgrading the security protections on its devices, adding the ability to encrypt iCloud data backups for the first time.
Apple Inc. is upgrading the security protections across its devices, adding the ability to encrypt iCloud data backups for the first time, along with new protections for account logins and iMessage .
The most important new feature, Advanced Data Protection for iCloud, will encrypt end-to-end storage of iCloud backups — a near-full copy of data on users’ iPhones and iPads — in addition to notes, photos, files, voice memos, and messages. Previously, only some features, such as health data, passwords, and payment information, were end-to-end encrypted.
End-to-end encryption means that encryption keys are stored only on the user’s device rather than in the data center. That means hackers can’t get the decryption key by compromising the server and then accessing the user’s data.
These changes help meet long-term customer requirements and boost the iCloud services business, which has been an area of growth for Apple. Apple In recent years. iCloud services contributed more than $78 billion in services revenue for the company last fiscal year, up 14% from 2021.
While Apple’s physical devices — like iPhones, iPads, and Macs — have provided advanced security tools and advanced encryption, cloud storage has long been considered more vulnerable. . The latest moves aim to close that gap. However, end-to-end encryption will not support email, contacts, and iCloud calendars. The company says that’s because those features are based on legacy technologies and are used in third-party apps.
In the Messages app, Apple is adding Contact Key Verification. This feature, also provided by encrypted messages application alike Signalwill allow user to verify Who they are texting with. The mechanism shows both texters the same code they can use to ensure their identity. The Messages app notifies users if a contact’s code changes so they can verify that it’s actually still the same person.
“Conversations between users who have iMessage Contact Key Verification enabled will receive an automatic alert if a particularly advanced adversary, such as a state-sponsored attacker, has successfully breached cloud Apple said in a statement.
In some cases, there is a trade-off when using enhancements. Additional security in icloud which means Apple can’t recover the user’s account because that account no longer holds the encryption key. Instead, users will need to use a recovery contact or save a recovery key. Another compromise: Access to iCloud data over the web needs to be turned on manually.
Apple is also joining companies like Alphabet Inc’s Google. to provide support for physical security keys for logging into accounts. This feature will allow users worried about online threats to plug a physical key into their device — in addition to using an Apple account password — before they can sign in. This feature will replace notifications or text messages with codes, the most common form of two-factor authentication for online accounts.
Both the new iCloud and iMessage features are rolling out to all US users this month and will begin rolling out globally next year, Apple said. The physical security lock feature is also coming next year. The first two features will be available in iOS 16.2, iPadOS 16.2, and macOS Ventura 13.1. New beta versions with support for improvements were released on Wednesday.
Along with the new privacy features, Apple said it has completely scrapped its plan to apply child sexual abuse content detection (CSAM) to photos stored in iCloud. The company first announced that plan last year, but later halted the launch after outcry from security researchers and privacy advocates. However, the company has rolled out CSAM detection in its Messages app and added new features to Siri to educate users on the matter.
“We have decided to move forward with the previously recommended CSAM detection tool for iCloud Photos,” the company told Wired, adding that it is increasing its investment in security features. full contact. “Children can be protected without companies checking personal data,” Apple said, and it will continue to research ways to protect children and preserve their privacy.
