iCloud Drive using Google Services...

[roguedaemon]

Story: I started to upload some documents to iCloud Drive on my Mac, to be notified by Little Snitch that it was actually uploaded to a Google service, not an Apple service... strange!
It connects to and uploads to googleapis.com.
Not happy about this, as I thought Apple was privacy-centric.

Screenshot (if attached doesn't work):

https://imgur.com/hgSiCl2

Thoughts, team?

 

[barbu]

apple doesn't own much of their own infrastructure. iCloud runs on both AWS and G Cloud, possibly Azure as well.

 

[roguedaemon]

Got a good response from /u/Unlikely-Return on Reddit.

Apple confirmed they use Google and Amazon S3 servers for iCloud data backup and storage in 2018. However, as I understand it, before any data is sent to Google, Apple breaks up the data in smaller chunks then anonymizes and encrypts each chunk using AES-128 and an unique to each user SHA-256 key. The SHA and file metadata is stored on Apple’s servers in the iCloud account. The data chunks go to either Google or Amazon S3. But that unique SHA-256 key and all file metadata resides only on Apple’s iCloud servers. All Google can see are encrypted chunk of data. Google can’t read the data nor can they trace any particular chunk back to a user.

 

[BrianBaughn]

That system sounds straightforward. Nothing could go wrong with that, right? 😁

 

[barbu]

That system sounds straightforward. Nothing could go wrong with that, right? 😁

It actually really is straightforward. It’s just encryption. If I encrypt a file and send it to you, you won’t be able to read it. If Apple encrypts a chunk of my data and sends it to google cloud, google can’t read it either.

 

[shenfrey]

As long a nobody can read it I'm happy.

 

[997440]

Use an encrypted disk image to shorten the trust chain.

Create a disk image using Disk Utility on Mac

Use Disk Utility on your Mac to create a disk image.

support.apple.com

 

[dallastigers]

Got a good response from /u/Unlikely-Return on Reddit.

I knew Apple used these services, but i had assumed that part happened after it uploaded to iCloud from device and never had a problem due to blocking both of them until yesterday. Seeing it a lot with Photos app uploading new pics to iCloud and Files app uploading new items to iCloud and some downloads to device from iCloud.

So for these Apple apps directly connecting 3rd party server to store on iCloud (or download) I assume the data is encrypted straight out of app in real time before upload starts (i hope) but if device & apps are connecting directly to googleapis and amazonaws would they be getting basic info about device and IP address now that they wouldn’t get if upload’s & downloads directly used apple server/service first and then in iCloud - “Each file is broken into chunks and encrypted by iCloud using AES-128 and a key derived from each chunk’s contents that utilizes SHA-256. The keys and the file’s metadata are stored by Apple in the user’s iCloud account. The encrypted chunks of the file are stored, without any user-identifying information, using third-party storage services, such as S3 and Google Cloud Platform.”

They eventually upload or download, but it’s now a very slow process. It’s just strange it’s happening every time for past couple of days but before this since using DNS filtering to block these two I had never had a problem or ever saw these being listed as blocked before on this device for these same actions and Photos & Files apps using iCloud (only change is updating to iOS 14.2 release candidate but this didn’t start immediately after update).

i know this is MacOS thread but was searching for articles on it.

 

[roguedaemon]

I knew Apple used these services, but i had assumed that part happened after it uploaded to iCloud from device and never had a problem due to blocking both of them until yesterday. Seeing it a lot with Photos app uploading new pics to iCloud and Files app uploading new items to iCloud and some downloads to device from iCloud.

So for these Apple apps directly connecting 3rd party server to store on iCloud (or download) I assume the data is encrypted straight out of app in real time before upload starts (i hope) but if device & apps are connecting directly to googleapis and amazonaws would they be getting basic info about device and IP address now that they wouldn’t get if upload’s & downloads directly used apple server/service first and then in iCloud - “Each file is broken into chunks and encrypted by iCloud using AES-128 and a key derived from each chunk’s contents that utilizes SHA-256. The keys and the file’s metadata are stored by Apple in the user’s iCloud account. The encrypted chunks of the file are stored, without any user-identifying information, using third-party storage services, such as S3 and Google Cloud Platform.”

They eventually upload or download, but it’s now a very slow process. It’s just strange it’s happening every time for past couple of days but before this since using DNS filtering to block these two I had never had a problem or ever saw these being listed as blocked before on this device for these same actions and Photos & Files apps using iCloud (only change is updating to iOS 14.2 release candidate but this didn’t start immediately after update).

i know this is MacOS thread but was searching for articles on it.

Thanks for that - so it still works, but would route to Apple's own servers in case Google is (reasonably) blocked. Good to know!