Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
67,034
36,854


As you may have heard, Apple this week announced it's expanding end-to-end encryption to additional types of data stored in iCloud with a feature called Advanced Data Protection, including device backups, photos, messages, and more. With the new change, even more types of data stored in iCloud will be fully end-to-end encrypted, a higher level of encryption standard.

Apple-advanced-security-Advanced-Data-Protection_screen-Feature-Orange.jpg

To help MacRumors readers better understand what the new feature is, how it works, and more, we've created this short post answering some of the most-asked questions about Advanced Data Protection.

What does it do and why is it new?

Before Advanced Data Protection, Apple only encrypted certain types of user data in iCloud, such as passwords and health data. By encrypting data, only a trusted user device can access that information. Other information stored in iCloud, however, such as your photos, messages, and device backups, were not fully end-to-end encrypted meaning if Apple wanted to, it could access your information. With Advanced Data Protection, that all changes.

With Advanced Data Protection enabled for a specific iCloud account, the vast majority of data stored in the cloud will be end-to-end encrypted, meaning no one, not Apple, law enforcement, or governments can ever gain access to that information. Only a trusted device can decrypt that information.

What data will be fully end-to-end encrypted?

With Advanced Data Protection, users will have the following types of data end-to-end encrypted in iCloud alongside Health data and passwords.

  • Device Backup
  • Messages Backup
  • iCloud Drive
  • Photos
  • Reminders
  • Safari Bookmarks
  • Siri Shortcuts
  • Voice Memos
  • Wallet Passes

It's worth noting that iCloud Mail, Contacts, and Calendar will not be end-to-end encrypted as they all require the ability to connect to external sources, such as Gmail, Yahoo, etc.

Is it enabled by default, and if not, how do I enable it?

Advanced Data Protection will not be enabled by default for users. In a recent interview, Apple's senior vice president of software engineering Craig Federighi explained that Advanced Data Protection requires extra effort from the user to enable a recovery method. The extra process and responsibility that lies on the shoulders of users in case they forget their password or lose access to their account make it impractical to force every user to go through that process, Federighi explained.

Nonetheless, even if not enabled by default, it's still easy to enable. When the feature rolls out to all US users by the end of this month, depending on when you activated your device, you'll be able to go into Settings, iCloud, and Advanced Data Protection, enable it and follow the on-screen prompts.

Can I use it now?

Not yet. Advanced Data Protection will roll out to all US users by the end of this month, and Apple says it will launch globally in early 2023. Specific dates for a global rollout are unknown.

Is it free?

Yes, it's free. Advanced Data Protection is an additional layer of protection offered to anyone with an iCloud account, at no extra charge.

What has the reaction been?

As expected, the reaction from users has been positive. With Advanced Data Protection, user data will stay more secure and private. Privacy groups have also praised the decision by Apple, calling it a "victory for user privacy." On the flip side, governments don't seem especially thrilled about the new option given to users.

Article Link: Everything You Need to Know About Apple's New iCloud Encryption Feature
 
  • Like
Reactions: ozarkcanoer
Let's hope it rolls out and is live before the hammer comes down. Time is of the essence before someone from one of the three letter agencies tries to get legislation passed in the lame duck Congress or tries to get an injunction. Rolling it back would be more difficult than trying to stop activation.

I am surprised that it isn't available as soon as 16.2 is installed - and it may very well be if you haven't recently added a device to the account.
 
Last edited:
Aren't Messages supposed to be end-to-end encrypted already? Or am I missing something?
Is it only the backups?
 
Nonetheless, even if not enabled by default, it's still easy to enable. When the feature rolls out to all US users by the end of this month, depending on when you activated your device, you'll be able to go into Settings, iCloud, and Advanced Data Protection, enable it and follow the on-screen prompts.
What does this have to do with anything? Are they making it so everyone can't enable it at the same time so as to not overwhelm servers?
 
Let's hope it rolls out and is live before the hammer comes down. Time is of the essence before someone from one of the three letter agencies tries to get legislation passed in the lame duck Congress or tries to get an injunction. Rolling it back would be more difficult than trying to stop activation.

I am surprised that it isn't available as soon as 16.2 is installed.
I'm guessing it wouldn't matter one way or the other. Encryption can be disabled by law as easily as it's enabled by Apple.
 
What does this have to do with anything? Are they making it so everyone can't enable it at the same time so as to not overwhelm servers?

I thought perhaps it was to prevent someone from adding a new device to your account and then immediately turning on E2E encryption and so locking you out from your other devices with no way to recover. In theory it would give you time to notice there was a new device on the account during that time period.
 
Forgot, they never said what key generation code was used. It is probably the NIST version that has a built in government back door.

BTW, I would absolutely love to be proven wrong, so go ahead.
 
I'm guessing it wouldn't matter one way or the other. Encryption can be disabled by law as easily as it's enabled by Apple.

The point is that if it is active on 10 (or 100) million devices (including people in the executive, legislative and judicial branches in the US) it will be much harder for Congress to act or a court to act to tell Apple to either roll it back in a future iOS update without causing a huge uproar in the public sphere.

If it is a merely "don't release iOS 16.2 with this feature in it" it will die with a whimper and iOS 16.2 will be delayed for a RC2 without it.
 
Aren't Messages supposed to be end-to-end encrypted already? Or am I missing something?
Is it only the backups?

Per Apple:
Messages in iCloud is end-to-end encrypted when iCloud Backup is disabled. When iCloud Backup is enabled, your backup includes a copy of the Messages in iCloud encryption key to help you recover your data. If you turn off iCloud Backup, a new key is generated on your device to protect future Messages in iCloud. This key is end-to-end encrypted between your devices and isnʼt stored by Apple.

So it depends on the settings on your phone etc.
 
What about Notes? Are Notes not included in the advanced protection?

Notes are supposed to be included.

"
  • Advanced Data Protection for iCloud is an optional setting that offers our highest level of cloud data security. If you choose to enable Advanced Data Protection, your trusted devices retain sole access to the encryption keys for the majority of your iCloud data, thereby protecting it using end-to-end encryption. Additional data protected includes iCloud Backup, Photos, Notes, and more.
."
 
I for one would like to store information in Notes that I would not want a hacker to ever access, so this is a very positive development for me.
Right, but I think you misunderstand this feature. Your notes are already very much encrypted. It's exceedingly unlikely that anyone could access them, as they would essentially have to hack the iCloud storage.

Right now, Apple can (untrivially, but still) unlock your notes, though, so they would for instance be able to hand them over to government. But the situation for hackers doesn't change substantially.
 
  • Like
  • Disagree
Reactions: NathanWind and Sikh
Right after Proton Drive goes live I wont be using it for my files but definitely for my backups I thought these were already encrypted.
Yeah, I thought backups were already encrypted too but doesn't look like it since the article mentions photos. It looks like Proton Drive is live aside from the desktop apps.
 
  • Like
Reactions: Sikh
Which is a lie because in the security document iCould Security Overview it says
"You can turn off Advanced Data Protection at any time. Your device will securely upload the required encryption keys to Apple servers, and your account will once again use standard data protection."
It sounds like that happens only when the user disables advanced data protection. That said, there can always be mistakes. :D
 
Which is a lie because in the security document iCould Security Overview it says
"You can turn off Advanced Data Protection at any time. Your device will securely upload the required encryption keys to Apple servers, and your account will once again use standard data protection."

Maybe it should say, "Not even Apple has access to the encryption keys unless you tell your phone to give them to Apple by turning ADP off".
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.