Apple adds three new security features to iCloud (2023 availability) to help deter targeted attacks among high profile individuals

captain_to_fire · December 8, 2022

Summary

Together with Lockdown mode, Apple is adding new features to iCloud to make it more difficult to execute targeted attacks among high-profile individuals.

Quotes

Quote

“At Apple, we are unwavering in our commitment to provide our users with the best data security in the world. We constantly identify and mitigate emerging threats to their personal data on device and in the cloud,” said Craig Federighi, Apple’s senior vice president of Software Engineering. “Our security teams work tirelessly to keep users’ data safe, and with iMessage Contact Key Verification, Security Keys, and Advanced Data Protection for iCloud, users will have three powerful new tools to further protect their most sensitive data and communications.”

iMessage Contact Key Verification

Conversations between users who have enabled iMessage Contact Key Verification receive automatic alerts if an exceptionally advanced adversary, such as a state-sponsored attacker, were ever to succeed breaching cloud servers and inserting their own device to eavesdrop on these encrypted communications. And for even higher security, iMessage Contact Key Verification users can compare a Contact Verification Code in person, on FaceTime, or through another secure call.

Spoiler

Security Keys

For users who opt in, Security Keys strengthens Apple’s two-factor authentication by requiring a hardware security key as one of the two factors. This takes our two-factor authentication even further, preventing even an advanced attacker from obtaining a user’s second factor in a phishing scam.Advanced Data Protection for iCloud

Spoiler

Advanced Data Protection for iCloud

iCloud already protects 14 sensitive data categories using end-to-end encryption by default, including passwords in iCloud Keychain and Health data. For users who enable Advanced Data Protection, the total number of data categories protected using end-to-end encryption rises to 23, including iCloud Backup, Notes, and Photos. The only major iCloud data categories that are not covered are iCloud Mail, Contacts, and Calendar because of the need to interoperate with the global email, contacts, and calendar systems.

Spoiler

My thoughts

If you ask me the likes of security keys like Yubikey support for Apple ID is long overdue since I already use those whenever I setup my Google and Microsoft accounts on my iPhone. I do like the idea of end-to-end encrypted iCloud backups, I just wish Apple would integrate iCloud backups to Time Machine on the Mac. It’s nice that Apple is finally stepping up their security game after a bunch of hackers responsible for the Pegasus spyware were able to hack into several high profile individuals.

But if there’s one thing I want Apple to get rid off it’s the fucking Stage Manager! It’s so dumb, useless, and clunky when using. Mission Control is still way better.

Sources

Apple