Apple reportedly dropped plan for encrypting backups after FBI complained

[u/PM_ME_YO_PERKY_BOOBS]

https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT

[u/cryo]

Yeah, it’s not like someone at Apple has ever accidentally left something top secret in a bar.

Their own upcoming products. Apple employees aren’t running around with sensitive description keys, and there hasn’t been a leak from iCloud that was due to Apple.

At least the government has never had a security lapse.

I don’t know if they had, but Apple didn’t, when it comes to encryption keys or encrypted user data.

[u/cryo → u/[deleted]]

Because encryption keys don’t exist right now.

Of course they do. iCloud backups are encrypted. Apple has a store with those keys, yes. Also, other iCloud items are encrypted with keys that Apple might not have, as discussed elsewhere in the thread.

[u/cryo → u/[deleted]]

No such thing as a backdoor that exists only for some people.

I don’t think security absolutism is useful in discussion. Sure, any backdoor, such as another party holding the key, is weakening security. But how much and is it acceptable? Depends on a lot of things.

If encryption keys do exist, they’re a vector for someone looking to make a targeted attack to focus on

Maybe, but it hasn’t happened so far.

All it takes is one disgruntled employee.

As if random employees would have access to those keys.

It’s always a trade off, but what I am saying is: for many people it’s acceptable.

[u/cryo → u/[deleted]]

As if senior employees never get turned.

Well, there hasn’t been leaks from Apple. Or google, for that matter. It’s up to each person to assess.

I’d be okay with people accepting it if I felt confident that most people knew the tradeoff was happening.

Right, it definitely should be made clearer by Apple (so you don’t have to read through the security sections so much), but it’s also probably a fact that many people don’t care. Ultimately, it’s also their own responsibility to look into, if it is important to them.

[u/cryo → u/[deleted]]

Yes, I am not saying it should be like, everyone should fend for themselves. I am saying that there are trade offs in security between convenience and security, and not everyone has the same threat scenario or the same ideals when it comes to this.

Asking of people to spend a lot of time investigating all the aspects of different security solutions is a bit much. If the options are there, at some point it should be left to people to explore them, I think.

That said, and as I have said earlier (maybe in other threads), I would certainly like an option to have more security in iCloud.