This is a supplemental article to Apple Is the Best on Privacy, But It's Still Not Close to What We Need
What's in the Toolbox
First let's discuss the best tool we have for internet privacy at the moment: End to end encryption (E2E). This is where your data is locked with a key that is generated on the device and stays there.
That means that even if data is stored on a remote server outside of your control, no one can see into it without the key. It just looks like gibberish text. E2E is usually what people assume when companies say "encryption," but unless they specifically say "End to end encryption" then they're probably using something less secure.
For example, a common workflow is where the sending device (client) and server both have keys to the data. This is generally what happens when you interact with a secure webpage. Both your computer and the webpage server can unlock the data you share, but nobody can observe what data is being transferred in between. Great.
But the server can see any data you send it, unlike in E2E where the server remains blind to your data. So usually when companies say that your data is encrypted, they mean that they can see it, but no one else can without your key or their key.
This is what happens with iCloud. Apple's privacy section of their website says "data backed up to iCloud is encrypted both in transit and on our servers," which sounds like E2E, but isn't.
What it does mean is that your data is visible to Apple when they receive it, and continues to be when they store it, since it's then locked with their key. So should Apple decide to cooperate with law enforcement or someone obtains their key somehow, your data is accessible.
And uh oh, we just found out that Apple runs some of iCloud on Amazon's AWS servers. Now we have another point of failure and possible access to our data through Amazon.
Apple does use E2E with iMessage and FaceTime, which is awesome. But here we are still trusting Apple to have implemented their E2E scheme correctly and without a backdoor key. Plus, how do we know what's happening with the data after it's decrypted and displayed to the user? These are the same suspicions leveled against Signal, Telegram, and WhatsApp. We really just don't know how they're encrypting messages.
Still Better Than the Rest
While it's possible to have a similarly secure experience on Android, the beauty of Apple's security is that it's all baked in by default. A user doesn't need to go through any extra effort to enjoy the privacy that Apple provides.
Also, the company is making real product sacrifices to ensure user privacy. Siri is worse than Alexa or Google Assistant, and that's arguably because Apple doesn't send your audio to their servers. That means Apple doesn't pay people to listen in on your conversations like Amazon does. The same goes for the Maps app versus Google Maps: Apple misses out on some features and benefits for the sake of user privacy.
Not to say that Apple is being altruistic. Privacy is a differentiator for them and they see economic opportunity is promoting it. But the "why" doesn't really matter. At least they're trying, instead of pretending to try and selling you out in secret like most companies.
Photo by Xavier Wendling on Unsplash