Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Plans to Encrypt iCloud Email in Transit Between Providers

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,523
30,811



NPR Yesterday wrote a story on the efforts of tech companies to protect consumer data, which included an extensive chart on how companies measure up when it comes to encryption.

While Apple was found to be encrypting iMessage end-to-end, as well as email from customers to iCloud, it was found to be one of the few global email providers based in the U.S. that does not encrypt customer email in transit between providers. That means emails that are sent from iCloud to iCloud are encrypted, but emails sent from iCloud to other providers, such as Gmail, are not encrypted.

Following the post, however, Apple told NPR that it is planning to encrypt those emails in the near future.
Apple encrypts e-mail from its customers to iCloud. However, Apple is one of the few global email providers based in the U.S. that is not encrypting any of its customers' email in transit between providers. After we published, the company told us this would soon change. This affects users of me.com and mac.com email addresses.
Click to expand...
As noted by 9to5Mac, Apple's response to NPR mentions only Me.com and Mac.com without a mention of the newer iCloud.com email addresses, but Google's data protection transparency website suggests that outbound iCloud.com emails are not encrypted, so it is likely Apple's plans include changes to the iCloud.com domain as well.

icloudencryption.jpg
As noted by NPR, end-to-end encryption of emails sent back and forth between service providers requires cooperation between providers. Both email services involved (such as Apple and Google or Apple and Yahoo) must implement encryption, which means Apple will need to work with other email providers for true end-to-end encryption of iCloud.com email.

NPR's study also noted that many app installations and iOS updates are sent unencrypted to iPhones, as are configuration files sent from telecom companies, and pre-login browsing/shopping traffic from the Apple Store.

Article Link: Apple Plans to Encrypt iCloud Email in Transit Between Providers
 
Article Link
https://www.macrumors.com/2014/06/13/apple-icloud-email-encryption/
PinkyMacGodess

PinkyMacGodess

Suspended
Mar 7, 2007
10,271
6,226
Midwest America.
Good grief! They don't already do that? :eek:

Exposure is limited, but come on... I'd have expected they were already doing this!:mad:

EDIT: Ohh, I thought this was about transit between their own servers. DUH, they had better be doing *something*...

Now between Yahoo, Google, and 'all the rest', in an industry notorious for having 'standards' being more like 'guidelines' that are ignored, or 'augmented' for proprietary reasons, I can see this being a rather large undertaking. Larger than it should be...
 
Last edited:
I

iLoveiTunes

macrumors 6502
Feb 26, 2011
268
512
kudos... iCloud is pretty much my primary off-work email these days. Stopped using gmail a while back
 
C

coolfactor

macrumors 604
Jul 29, 2002
7,056
9,723
Vancouver, BC
This article is quite misleading. There's two ways to protect emails in transit:

Method #1 - Encrypt the pipe that the email message travels through. This is basically the whole SSL/TLS discussion that has been in the news lately.

Method #2 - Encrypt the contents of the email message itself. This would allow the encrypted message to pass through non-encrypted pipes and still be safe. But this method is far more complicated, as it requires a certificate+handshake between the sending email client and the receiving email client.

It sounds like Apple will be ensuring that when it connects to another mail server, it will try to use an encrypted pipe, if the other server supports that whereas right now, it doesn't make that effort. That would make sense. The messages themselves won't be magically encrypted as per Method #2. That's up to the end-user to implement.
 
furi0usbee

furi0usbee

macrumors 68000
Jul 11, 2008
1,790
1,382
Yeah, it would be nice to have *real* encryption so even Apple cannot decrypt our messages and give them to the government.
 
C

ChrisA

macrumors G5
Jan 5, 2006
12,576
1,692
Redondo Beach, California
furi0usbee said:
Yeah, it would be nice to have *real* encryption so even Apple cannot decrypt our messages and give them to the government.
Click to expand...

You can do that now. But both you and the person you are sending to have to agree and set it up in advance. Practically it would work between and and a few others.

End to end encryption is not possible in general because you many times WANT someone you don't know to be able to read your mail.
 
D

DryHeave

macrumors member
Jun 13, 2014
64
38
Señor said:
The NSA has complete access to information anyway, and can easily decrypt it no sweat.
Click to expand...

Well that depends what method of encryption you're using. If you're using a one-time-pad xor method with truly random pad data, then unless an attacker has read-access to your one-time pad or you screw up and accidentally use the pad twice, nobody else is going to have even the remotest possible chance of decrypting it — no cryptologist, white hat, black hat, nor NSA, nor aliens, nor even the most advanced computer in the universe running for quadrillions of years, nor even God.

Ok, maybe God. But that's about it. Maybe Q.
 
Last edited:
Westside guy

Westside guy

macrumors 603
Oct 15, 2003
6,340
4,158
The soggy side of the Pacific NW
PinkyMacGodess said:
Good grief! They don't already do that? :eek:
Click to expand...

Google only recently started doing this. Same thing with encryption of data between their own different server farms - twelve months ago they weren't encrypting that, either.

Then Snowden/Greenwald released a talk slide from the NSA showing that tapping those messages between server farms was one of the ways they were intercepting (specifically) Google data. That slide was shown to a pair of Google engineers, who then reportedly responded "oh (expletive)".

Google does deserve credit for moving on this quickly - but all of these companies have been playing catch-up. And really this only addresses spying by national entities. This almost certainly isn't how criminals get hold of people's mail.
 
R

Ralf The Dog

macrumors regular
May 1, 2008
192
0
furi0usbee said:
Yeah, it would be nice to have *real* encryption so even Apple cannot decrypt our messages and give them to the government.
Click to expand...

https://gpgtools.org/

DryHeave said:
Well that depends what method of encryption you're using. If you're using a one-time-pad xor method with truly random pad data, then unless an attacker has read-access to your one-time pad or you screw up and accidentally use the pad twice, nobody else is going to have even the remotest possible chance of decrypting it — no cryptologist, white hat, black hat, nor NSA, nor aliens, nor even the most advanced computer in the universe running for quadrillions of years, nor even God.

Ok, maybe God. But that's about it. Maybe Q.
Click to expand...

The cool thing about a one time pad is, there is a decryption key for every possible message of that length. If you have a message describing nuclear launch codes, with a different key, that same message could be a shopping list. It is even better if you pad the message, so you can't even use the length to give you a clue about the content.

One cool trick, encrypt your message using the correct key, then generate a second key that decrypts a fake message. If you are compromised and forced to give up your key, give them the second one. :)

********

Honestly, if a mail server is not using encryption with a real key from a real cert authority, the sending server needs to bounce the message.
 
Westside guy

Westside guy

macrumors 603
Oct 15, 2003
6,340
4,158
The soggy side of the Pacific NW
ChrisA said:
That works only for special cases. How could I use GPG to send email to someone I don't know? The problem with encryption is that we want the reader to be able to read it. So you can only encrypt some email to some people.
Click to expand...

If a person has generated a GPG public/private keypair, they've probably uploaded their public key to one of the public key stores - and those usually sync between each other as well. so, generally speaking, you shouldn't need to know someone to send an encrypted email to them. If they've got a key, you can probably get it and use it.
 
PinkyMacGodess

PinkyMacGodess

Suspended
Mar 7, 2007
10,271
6,226
Midwest America.
ralf the dog said:
honestly, if a mail server is not using encryption with a real key from a real cert authority, the sending server needs to bounce the message.
Click to expand...

ok

----------
Westside guy said:
Google only recently started doing this. Same thing with encryption of data between their own different server farms - twelve months ago they weren't encrypting that, either.

Then Snowden/Greenwald released a talk slide from the NSA showing that tapping those messages between server farms was one of the ways they were intercepting (specifically) Google data. That slide was shown to a pair of Google engineers, who then reportedly responded "oh (expletive)".

Google does deserve credit for moving on this quickly - but all of these companies have been playing catch-up. And really this only addresses spying by national entities. This almost certainly isn't how criminals get hold of people's mail.
Click to expand...

How screwed up is this country?

Your own government tweaks your balls when you walk around with your pants down, rather than tell you to pull your pants up.

Whatever happened to 'Better of dead than red'?
 
dumastudetto

dumastudetto

macrumors 603
Aug 28, 2013
5,017
7,140
Los Angeles, USA
This is great news. Apple is always putting the security and privacy of its users at the top of its corporate goals. Now it's time for other companies to match Apple's pledge...
 
furi0usbee

furi0usbee

macrumors 68000
Jul 11, 2008
1,790
1,382
DryHeave said:
no cryptologist, white hat, black hat, nor NSA, nor aliens, nor even the most advanced computer in the universe running for quadrillions of years, nor even God.
Click to expand...

You had me until you started getting silly with the god stuff :)

But point taken.

----------
Señor said:
The NSA has complete access to information anyway, and can easily decrypt it no sweat.
Click to expand...

I won't go that far. If that's the case, there is zero point it trying to keep anything safe. However, do I assume my FileVault 2, 20 character password is safe from the NSA, probably not. I mean, they have billions of dollars of computer resources and if they are intent on cracking one single computer and it happens to be mine, I highly doubt there is anything I can do to protect myself.
 
2

2984839

Cancelled
Apr 19, 2014
2,114
2,239
furi0usbee said:
Yeah, it would be nice to have *real* encryption so even Apple cannot decrypt our messages and give them to the government.
Click to expand...

If Apple is encrypting them with Apple's keys, this has no effect on the government because Apple can simply be ordered to hand them over, just like Lavabit was.

Apple really needs to have customers generate their own keys locally and only pass encrypted data through Apple servers to address the NSL issue. If Apple doesn't hold the keys, they can't surrender them if served with an NSL.
 
roadbloc

roadbloc

macrumors G3
Aug 24, 2009
8,784
215
UK
I'm glad Apple (and other tech giants like Microsoft and BlackBerry) are taking user privacy seriously with the NSA threat.
 
spazzcat

spazzcat

macrumors 68040
Jun 29, 2007
3,679
4,767
PinkyMacGodess said:
Good grief! They don't already do that? :eek:

Exposure is limited, but come on... I'd have expected they were already doing this!:mad:

EDIT: Ohh, I thought this was about transit between their own servers. DUH, they had better be doing *something*...

Now between Yahoo, Google, and 'all the rest', in an industry notorious for having 'standards' being more like 'guidelines' that are ignored, or 'augmented' for proprietary reasons, I can see this being a rather large undertaking. Larger than it should be...
Click to expand...

Email isn't encrypted now unless you are doing yourself with certs...
 
PinkyMacGodess

PinkyMacGodess

Suspended
Mar 7, 2007
10,271
6,226
Midwest America.
556fmjoe said:
If Apple is encrypting them with Apple's keys, this has no effect on the government because Apple can simply be ordered to hand them over, just like Lavabit was.

Apple really needs to have customers generate their own keys locally and only pass encrypted data through Apple servers to address the NSL issue. If Apple doesn't hold the keys, they can't surrender them if served with an NSL.
Click to expand...

And what would stop Apple from doing that?
 
C

ctone

macrumors regular
Nov 28, 2006
103
4
dumastudetto said:
This is great news. Apple is always putting the security and privacy of its users at the top of its corporate goals. Now it's time for other companies to match Apple's pledge...
Click to expand...

Actually, it is time that Apple catches up to all of the other providers that have already improved email security. According to the article and confirmed by my tests, the only major email providers in the US that don't provide this security are Verizon and Apple.

See Google's research on this subject here
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom