Apple has revealed plans to let users choose to encrypt their iCloud backups in a move to deter hackers – while also placing limits on law enforcement requests for user data. .
The new Advanced Data Protection feature for iCloud will allow users to encrypt data on Apple’s servers and thus prevent Apple itself from accessing user content. New content types that support end-to-end encryption (E2EE) include iCloud backups, Notes, and Photos.
This extends the 14 data categories that are protected by E2EE by default, such as iCloud Keychain, Health Data, Messages in iCloud, Maps, Safari History. Now types have extend to 23.
As Apple notes, with Advanced Data Protection, only the user’s trusted devices have access to those categories of data. It will protect the user’s content even in the event that an attacker compromises the iCloud server.
Advanced Data Protection for iCloud will be available to US users later this year. It will begin rolling out to the rest of the world in early 2023. This option will be available in iOS 16.2, iPadOS 16.2, and the soon-to-be-released macOS 13.1.
“Apple makes the most secure mobile devices on the market. And now, we’re building on that strong foundation,” said Ivan Krstić, Apple’s head of security engineering and architecture. , said. said in an announcement.
“Advanced Data Protection is Apple’s highest level of cloud data security, giving users the choice to protect much of their most sensitive iCloud data with end-to-end encryption so it can only be decrypted on their trusted devices.”
The Electronic Frontiers Foundation (EFF) digital rights group has welcomed E2EE’s iCloud backups — something the organization has long campaigned for. Apple CEO Tim Cook previously explained that Apple didn’t encrypt iCloud backups because sometimes users lose their private keys and then seek help from Apple to regain access to their data. surname.
“Encryption is one of the most important tools we have for maintaining online privacy and security,” Joe Mullin of EFF said. “Encryption on Apple devices is strong, but some particularly sensitive iCloud data, such as photos and backups, continues to be vulnerable to government requests and hackers.”
According to Apple, categories that are still not covered by E2EE include iCloud Mail, Contacts, and Calendars due to the need to interact with global email, contacts, and calendar systems.
“For users who opt-in, Advanced Data Protection will protect most iCloud data even in the event of a data breach in the cloud,” Apple said.
Not everyone is happy though. Based on washington articlesThe FBI said it was “deeply concerned” with the threat of end-to-end encryption and user-only access, saying it hinders agencies’ ability to protect against criminal acts. Many governments and law enforcement agencies worry that the increasing use of end-to-end encryption will make it harder for them to access information.
For public individuals who are security-conscious and at-risk, Apple is also introducing support for third-party hardware security keys with two-factor authentication for Apple ID. The security key becomes one of the two and is required to access the account, while also preventing phishing attacks from affecting the second factor.
Another security improvement for the public’s individuals and others who may be the target of advanced attackers is iMessage Contact Key Verification. This feature allows users to verify that they are messaging only with the people they intend to.
After users enable iMessage Contact Key Verification, they will receive an automatic alert if an attacker succeeds in compromising Apple’s servers, inserting their own device into it, and eavesdropping on contact information. encrypted contact. According to Apple, iMessage Contact Key Verification users can also compare Contact Verification Codes directly, on FaceTime or through another secure call.
