Apple will allow people to encrypt most data backed up to iCloud from iPhones and iPads, the company says announce Wednesday. The feature will be available in the US later this month and worldwide in 2023.
Previously, Apple only encrypted sensitive information, such as people’s health data, credit card information, and passwords. But the new feature, known as Advanced Data Protection for iCloud, will allow users to encrypt device backups, which contain a copy of most personal data on the iPhone and iPad, as well as notes, voice memos, photos, and more.
“End-to-end” data encryption means that the digital key required to unlock it is stored only locally on someone’s device, as opposed to on a server somewhere. Nobody, including hackers or the company the server belongs to, can access the data.
iPhones and iPads have been encrypted for years, but the keys to these backups, which can contain personal information such as text messages and attachments, have typically been stored in Apple’s data centers, leaving them vulnerable to hacker attacks.
Advanced Data Protection is important because turning it on will only cause your key to be stored locally on your device and not on Apple’s servers. Not only will this keep your backup safe in the event of a hacker breaching Apple’s data centers, but it will also prevent Apple from being able to turn iCloud backups of devices over to law enforcement agencies and governments in response to valid legal requests, something the company has done thousands of times to date. right Now , depending for its own transparency report.
While the authorities may not like this development, digital rights advocates do. “Being able to sign up for comprehensive iCloud backups is very good,” said Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, a San Francisco-based digital rights group that has been asks Apple to allow people to encrypt their iCloud backups for years, he told BuzzFeed News. “Law enforcement would really like to use the iCloud backup vulnerability as a way to access the contents of people’s iPhones without having to get the phone itself or find a way to break into it.”
However, Apple said that email, contacts, and calendars backed up to iCloud won’t be encrypted, because those features need to interact with other companies’ apps and platforms.
By default, Advanced Data Protection will be turned off on iPhones and iPads. When you sign up, Apple will ask you to set a recovery key — a complex password that you can store somewhere safe — or designate a trusted friend or family member as a recovery contact to help you unlock the encrypted iCloud lock when you get a new phone.
Setting up a way to unlock your backed up data by either of these two means is important, as this means that only you can access your backup, not Apple’s. But you forgot or lost your recovery key and you won’t be able to open your iCloud backup.
“I prefer a strong default,” Galperin said. “But if you give users the ability to lock themselves out of access to all their data forever, they will go crazy and stop using your product. So I get the business case.” [for having to opt in] over here.”
In addition to advanced data protection, Apple also announced security improvements in iMessage, which will allow people to share a code with each other to verify who they’re chatting with. iMessage will now warn people if state-sponsored attackers try to intercept their conversations.
If you really need extreme security, you will also be able to do so that you need to connect a hardware security key to your iPhone and iPad to unlock them.