<story><title>Apple introduces end-to-end encryption for backups</title><url>https://support.apple.com/en-us/HT202303#advanced</url></story><parent_chain><item><author>Andrew_nenakhov</author><text>One must understand that E2EE is used when you don&amp;#x27;t trust your service provider to handle your data. In other words, the adversary in your threat model is the service provider - and in this case, Apple. And what good is that encryption, if Apple obviously can do almost anything with your device?&lt;p&gt;They can remotely wipe apps. They can force-install apps and force updates. It is not too far-fetched to think that they can just remotely copy anything stored on your device to their servers. So, with an adversary that capable, I&amp;#x27;m not sure encrypted backups provide a meaningful improvement to security and privacy.</text></item></parent_chain><comment><author>tshaddox</author><text>&amp;gt; In other words, the adversary in your threat model is the service provider - and in this case, Apple. And what good is that encryption, if Apple obviously can do almost anything with your device?&lt;p&gt;The adversary in this threat model isn&amp;#x27;t the service provider. The adversary is someone attacking the service provider, like a hacker or a government with a warrant, and getting access to Apple&amp;#x27;s storage of your data.&lt;p&gt;Now of course it&amp;#x27;s not impossible for such an adversary to &lt;i&gt;also&lt;/i&gt; defeat other systems at Apple and get your data another way, for example by controlling Apple&amp;#x27;s ability to send over-the-air updates to Apple devices. But I think that is a sufficiently distinct threat that it&amp;#x27;s not worth dismissing solutions to the first threat. That would be like dismissing the importance of a web server storing passwords salted and hashed, since attackers could just use a totally different attack to bypass the web server&amp;#x27;s database access control. Another way to illustrate this might be to point out that attackers can physically coerce you to hand over data regardless of &lt;i&gt;any&lt;/i&gt; security measures any service provider could possibly make, but that doesn&amp;#x27;t mean we should dismiss all such security measures.</text></comment>
<story><title>Apple introduces end-to-end encryption for backups</title><url>https://support.apple.com/en-us/HT202303#advanced</url></story><parent_chain><item><author>Andrew_nenakhov</author><text>One must understand that E2EE is used when you don&amp;#x27;t trust your service provider to handle your data. In other words, the adversary in your threat model is the service provider - and in this case, Apple. And what good is that encryption, if Apple obviously can do almost anything with your device?&lt;p&gt;They can remotely wipe apps. They can force-install apps and force updates. It is not too far-fetched to think that they can just remotely copy anything stored on your device to their servers. So, with an adversary that capable, I&amp;#x27;m not sure encrypted backups provide a meaningful improvement to security and privacy.</text></item></parent_chain><comment><author>schrodinger</author><text>There are multiple meanings of trust in this scenario: belief in honesty, and confidence of ability. Eg I can trust you to tell me the truth but not trust you to protect me from a missile.&lt;p&gt;I trust Apple’s honesty. I don’t trust many attack vectors. Someone could gain access to their data center. E2EE protects that. A gov could legally compel them to provide data. I trust when they say they’ve engineered it in such a way that they can’t currently do it, and that they would publicly cause a scene and legal battle if attempted-as they have before. Accidental data leaks also happen. In all these scenarios I trust Apples intentions but know that nothing is perfect. E2EE adds a lot for me.</text></comment>