Apple Finally Will Let You Encrypt iCloud Backups. Here’s Why That’s Important.
Apple will let people encrypt most data backed up to iCloud from their iPhones and iPads, the company announced on Wednesday. The feature will be available in the US later this month and around the world in 2023.
Previously, Apple only encrypted sensitive information, such as people’s health data, credit card information, and passwords. But the new feature, known as Advanced Data Protection for iCloud, will allow users to encrypt device backups, which contain a copy of most personal data on an iPhone and iPad, in addition to notes, voice memos, photographs, and more, “end-to-end”.
Encrypting data end-to-end means that the digital key required to unlock it is only stored locally on someone’s device, as opposed to on a server somewhere. No one, including hackers or the company the server belongs to, can access the data.
iPhones and iPads have been encrypted for years, but keys to these backups, which can contain personal information like text messages and attachments, were typically stored in Apple’s data centers, leaving them vulnerable to attacks from hackers.
Advanced Data Protection is significant because switching it on will only store your key locally on your device and not on Apple’s servers. This will not only keep your backup safe in case a hacker breaches Apple’s data centers, but also prevent Apple from being able to turn over iCloud backups of devices to law enforcement agencies and governments in response to valid legal requests, something that the company has done thousands of times so far, according to its own transparency report.
While authorities might not like this development, digital rights advocates do. “Being able to opt in to end-to-end iCloud backups is a very good thing,” Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, a digital rights group based in San Francisco that has been asking Apple to let people encrypt iCloud backups for years, told BuzzFeed News. “Law enforcement really loved using the iCloud backup loophole as a way of getting access to the contents of people’s iPhones without having to obtain the phone itself or find a way to break into it.”
Apple said, however, that iCloud email and contacts and calendars backed up to iCloud won’t be encrypted, because those features need to interact with apps and platforms belonging to other companies.
By default, Advanced Data Protection will be turned off on iPhones and iPads. When you opt in, Apple will ask you to set a recovery key — a complex password that you can store in a safe place — or assign a trusted friend or family member as a recovery contact to help you unlock your encrypted iCloud backup when you get a new phone or iPad.
Setting up a way to unlock your backed-up data by either of these means is important, because it will mean only you can get into your backup, not Apple. But forget or lose the recovery key and you won’t be able to unlock your iCloud backup.
“I prefer strong defaults,” Galperin said. “But if you give users the power to lock themselves out of all their data forever, they will, and then they will get mad and stop using your product. So I understand the business case [for having to opt in] here.”
In addition to Advanced Data Protection, Apple also announced security improvements to iMessage, which will allow people to share a code with each other to verify whom they are chatting with. iMessage also will now warn people if state-sponsored attackers try to intercept their conversations.
If you truly need extreme security, you also will be able to make it so that you need to plug a hardware security key into your iPhone and iPad to unlock them.
Apple will let people encrypt most data backed up to iCloud from their iPhones and iPads, the company announced on Wednesday. The feature will be available in the US later this month and around the world in 2023. Previously, Apple only encrypted sensitive information, such as people’s health data, credit…
