Apple Data Protection — The ugly truth

Up until now, Apple kept an encryption key for things like your personal photos and messages stored on their iCloud servers. That meant, if you ever forgot your passcode or otherwise locked yourself out, Apple could recover that data for you. But, side effect, that also meant a government could subpoena them, or a super-villain could theoretically break in and steal them.

Now, in the US, and in more places over the course of the next year, we’ll have the option to turn on Advanced Data Protection for iCloud. In other words, turn off Apple’s ability to access almost everything on iCloud. literally make them throw their key away. Then, just like our health data and passwords have been, our photos and messages will be utterly, completely locked down.

But should they be? Should we actually turn advanced data protection on?

🔗 LINKS

🗂 CHAPTERS

🚨 ETHICS & DISCLAIMER

All opinions are my own. This channel does not produce sponsored or paid reviews. Companies occasionally provide briefings or loan sample products to facilitate reviews but provide no payment and get no editorial input, content approval, or advanced previews. They see them for the first time when you do

Links may contain referrals for affiliate programs that provide this channel with a tiny commission should you make a purchase. They likewise receive zero editorial input or consideration

📝 CREDITS

📷 Some video and images via by Getty Images and/or AP Archives
🎸 Some music via by Epidemic

[ReneRitchie]

🤔 Will you be turning on Advanced Data Protection?

[avonbarksdale]

TLDR: Personal responsibility is hard, welcome to being an adult. Encrypt everything, stop giving these psychopaths all your data

[movdqa]

My family members know my keys. I gave them when I was undergoing cancer treatment and there was a non-zero risk of dying from treatment. My mother died recently and she has done a lot of things that have made it difficult for her survivors to settle the estate, so managing data and accounts and finances and finding things has been a lot harder than it needed to be.

[augustofretes]

For the vast majority of people, the default is the right choice. That's why it's called "advanced", it's not meant for regular users.

[tysqii]

the option is certainly not for everyone but I appreciate that apple gives us the option to choose ourselves whether they should keep a backup key

[ItsMalibuArt]

Here is the problem. To use Enhance Data Protection, all your devices using your Apple ID must be on the latest OS. If you have older devices not able to be updated to the latest operating system, you must purge those devices from your Apple ID: IPad Air (Second Gen), 2015 MacBook Pro, iPad Mini 3, etc. All software, messages, documents, everything will disappear since you cannot take information from your old Apple ID to a new one, even a family Apple ID. Yes, you could go through the hassle of reinstalling purchased software but if it is no longer available, it will be lost. Pictures, credit cards, passwords, must be migrated to the new Apple ID using a 3rd party software. This is asking a lot from people who were perfectly fine with their older devices. There is simply no reason why Apple cannot issue a security update to bring Enhanced Data Protection to iPadOS 15 or MacOS Catalina. It would certainly help the transition.

[sydneys]

This is probably the best explanation of the balance between security and privacy and access I've ever seen.

[JCross]

That’s why I setup 3 recovery contacts so I have a backup for the backup.

[omar]

I've tried to watch this video with headphones and couldn't, I don't know what you did to the audio but is very very uncomfortable, it't even much worst when watching it at faster speed

[cobrabtc]

Here’s a question that no one seems to answer. You’re a techie and perhaps you can provide some input. How does Apple handle and re-encrypt the previously encrypted data which they had the old key? Usually the data would need to be de-encrypted and re-encrypted with the new key. That would be very server intensive if millions of people are starting ADP. I’m curious to know how Apple is implementing ADP once enabled so that previous data is encrypted with the new key and Apple discards the old key. Thanks

[tylerbigge]

So should I turn this feature on or leave it off?

[OfficialZvikaSGL]

Hey thanks!
Btw - Which camera do you use in order to film yourself?

[brandonw]

This is the worst argument for not encrypting. This is why you have recovery contacts. If you locked yourself out of your 2FA accounts you probably swapped phones and didn’t transfer everything before wiping the old phone.

[ericfielding]

Thanks for the discussion. Didn’t you talk about something like this a while ago? I remember you saying that you didn’t want to encrypt your irreplaceable files before.

[exp]

»Data loss affects more people than data theft«
Do you have any source for that statement beyond "data recovery experts told me"?

Like statistics, maybe a study, even just comparing the case numbers per year, or who these experts are and what kind of customer base they work with (that can skew their experience, just like a Dermatologist vs Proctologist view Medicine through a different lens).

[rustychain]

I’ve been waiting for a video like this…thank you René

[Screaming-Trees]

But you can encrypt encrypted data. You can still ransomware someone if they've encrypted their data by encrypting their encrypted copy again with a different key. There are no easy answers here. The only obvious answer is "risk management". And that subject isn't easily understood by a layperson. Most vectors are vulnerable applications though so we go back to "no liability in software" problem. Introduce liability in software and see if the application layer exposure improves then decide next steps. There are downsides to most things. All phenomena are hard to pin down exactly. What seems sure footed can easily turn on you. And that means "risk management" all the way, all the time.

[michaela]

I agree. The everyday person doesn't need this. It's your choice

[chinchorrero]

Advance Data protección is not available in Canada

[RyanNuo]

If I have already setup a Physical Security Key for my Apple ID, do I still need to generate the an account recovery code for Apple iCloud Advance Data Protection ?
In other words, what the difference between Physical Security Key vs. Account Recovery Code (in iCloud)?
Can I not use the same Physical Security Key to cover both my Apple ID and iCloud Advance Data Protection?
It would be much easier to a keep a Physical Security Key than a printed Account Recovery Code.