Apple expands end-to-end encryption for iCloud

Apple announced Advanced Data Protection on 7 December, extending optional end-to-end encryption to iCloud backups, photos and notes. US beta testers can try it today; broader US availability is planned before year-end, followed by an international rollout beginning in early 2023.

The feature increases the number of end-to-end encrypted iCloud categories from 14 to 23. Apple says trusted devices retain the keys, protecting covered data even if its cloud servers are breached.

Recovery is part of the decision

Apple’s security guide requires a recovery contact or recovery key before activation. If those recovery methods fail after someone loses account access, Apple cannot restore the protected data. Two-factor authentication and device passwords or passcodes are also required.

Mail, Contacts and Calendar stay outside end-to-end encryption because they must work with other providers. Shared Albums, iWork collaboration and content shared with anyone holding a link also remain exceptions.

Web access to protected iCloud data is switched off initially. Users can restore it, but must approve each web sign-in on a trusted device. That gives the web session temporary access to the keys needed for the requested data.

Reducing what a breach exposes

An Apple-supported report by MIT professor Stuart Madnick, released alongside the announcement, argues that better passwords and account authentication cannot alone prevent theft from a service provider’s servers. It urges companies to reduce the customer data they collect, can access and retain, as well as encrypt what they store.

That distinction matters for backups: securing a person’s sign-in and limiting a provider’s access to stored files address different risks. The report describes both as necessary, rather than treating encryption as a replacement for sound account security. Its conclusions are the author’s, and Apple funded the work.

Two more features follow in 2023

Apple also plans hardware Security Keys for Apple ID in early 2023, and iMessage Contact Key Verification during 2023. The latter will let participants compare verification codes and receive alerts about certain sophisticated attempts to intercept conversations. Neither feature launches today.