Turn THIS on if you use iCloud!

Summary

The video script discusses the misconception of privacy associated with Apple's iCloud service. Despite Apple's marketing on privacy and the introduction of end-to-end encryption for certain iCloud categories in late 2022, the script highlights that iCloud may not be as private as users believe. It explains that the 'Advanced Data Protection' setting, which prevents even Apple from accessing user files, is not enabled by default. The video provides a guide on how to enable this setting, including updating devices, setting up account recovery, and using two-factor authentication. It also outlines the limitations of Advanced Data Protection, noting that iCloud Mail, Contacts, and Calendars are not end-to-end encrypted, and metadata remains visible to Apple. The script concludes with alternative backup options for those seeking to limit their exposure to the Apple ecosystem and emphasizes the importance of taking control of one's data privacy.

Takeaways

• 📱 Apple's marketing emphasizes privacy, leading users to believe their data is private when using Apple products.
• ☁️ iCloud, Apple's cloud storage service, is not as private as users might think without additional settings.
• 🔒 End-to-end encryption for iCloud was introduced in late 2022 for certain categories, enhancing data security.
• 🛡️ The 'Advanced Data Protection' setting offers stronger privacy by ensuring only the user can access their files, even from Apple.
• ⚠️ Advanced Data Protection is not enabled by default, meaning Apple can see your data if you haven't turned it on.
• 📅 To enable Advanced Data Protection, update all devices, enable Account Recovery, and set up a recovery contact or key.
• 🔓 With Advanced Data Protection on, you won't be able to access your data via iCloud.com unless you manually toggle the feature.
• 🚫 Despite Advanced Data Protection, iCloud Mail, Contacts, and Calendars are not end-to-end encrypted.
• 📁 Apple can still see metadata for all files, even with Advanced Data Protection enabled.
• 🔑 Users are responsible for their own data recovery; Apple does not have access to help with account recovery.
• 🌱 For users concerned about privacy, there are alternative options to Apple's ecosystem for mail, calendar, and file backups.

Q & A

What is the main misconception about iCloud privacy that Apple users often have?

Many Apple users assume that all their data with iCloud is private due to the company's aggressive marketing on privacy, but in reality, iCloud may not be as private as they think, especially if the Advanced Data Protection setting is not enabled.

What was introduced by Apple in late 2022 to enhance user privacy and data security in iCloud?

Apple introduced end-to-end encryption for a range of iCloud categories and a setting called 'Advanced Data Protection' which significantly enhances user privacy and data security by ensuring that protected data can only be accessed by the user.

Why is it crucial for users to know about the default settings of the new end-to-end encryption feature in iCloud?

It's important because the end-to-end encryption provided by the new setting is not turned on by default. This means that if users have been backing up their private files to iCloud without enabling Advanced Data Protection, Apple has been able to see everything they've uploaded.

What are some of the data categories protected by the Advanced Data Protection setting in iCloud?

Advanced Data Protection protects iCloud Backup including device and Messages backup, iCloud Drive, Photos, Notes, Reminders, Safari Bookmarks, Siri Shortcuts, Voice Memos, Wallet passes, and Freeform.

What steps are required to enable Advanced Data Protection on iCloud?

To enable Advanced Data Protection, users must update all their devices to the latest software versions, enable Account Recovery by setting up a recovery contact or a 28-character recovery key, and ensure that 2FA is enabled on their Apple ID with a passcode locking their device.

What is the main limitation of Advanced Data Protection when it comes to iCloud Mail, Contacts, and Calendars?

Even with Advanced Data Protection enabled, iCloud Mail, Contacts, and Calendars are not end-to-end encrypted. Apple retains the ability to scan these data due to the need for interoperability with other email and calendar providers.

What metadata is still visible to Apple even when Advanced Data Protection is enabled?

Apple can still see metadata such as file type, file size, how many times a photo has been viewed, whether a file was pinned or marked as favorite, and usage data like timestamps of when the file was created or last modified.

What is the responsibility of the user when it comes to regaining access to their account with Advanced Data Protection enabled?

With Advanced Data Protection enabled, Apple does not have access to the user's account, so the user is responsible for keeping their recovery contact information up to date and ensuring their recovery key is saved safely. These are the only options to recover the account if the password is forgotten.

What alternative options are suggested for users who want to limit their exposure to the Apple ecosystem for backups?

For users looking for alternatives, it's recommended not to use Apple mail, calendar, or contacts due to the lack of end-to-end encryption. Instead, users can explore more private email options, use Proton's end-to-end encrypted calendar, store contacts locally on a device, and consider private backup options like Proton Drive, Synology, or Nextcloud.

How does the privacy and security of Apple products compare to top competitors?

Apple products generally offer a higher level of security and privacy compared to top competitors. For instance, a stock iPhone is considered more private and secure than a stock Android device.

What is the importance of turning on Advanced Data Protection for users who are already logged into an iCloud account?

Turning on Advanced Data Protection is a crucial step for users to improve the privacy of their digital files. It ensures that only devices signed into the user's iCloud account and explicitly trusted by the user can access the files.

How is the NBTV channel funded, and how can viewers support it?

NBTV is funded entirely by community donations. Viewers can support the channel by making donations through the provided link on their website or by purchasing their book, 'Beginner’s Introduction to Privacy'.

Outlines

00:00

🔒 Understanding iCloud Privacy and Advanced Data Protection

This paragraph discusses the misconceptions about Apple's iCloud privacy. Despite Apple's marketing, which emphasizes privacy, the default settings of iCloud do not offer end-to-end encryption, meaning Apple can access user data. The paragraph introduces 'Advanced Data Protection,' a setting that, when enabled, ensures only the user can access their data, even preventing Apple from doing so. It outlines the categories protected by this feature, including photos, notes, and iMessage backups, and provides a step-by-step guide on how to enable it, including updating devices, enabling account recovery, and setting up two-factor authentication and a passcode. The limitations of Advanced Data Protection are also mentioned, noting that certain data like iCloud Mail, Contacts, and Calendars are not end-to-end encrypted and metadata remains visible to Apple.

05:02

📁 Advanced Data Protection Limitations and Alternative Backup Options

The second paragraph delves into the limitations of Apple's Advanced Data Protection, emphasizing that even with the feature enabled, iCloud Mail, Contacts, and Calendars are not end-to-end encrypted, and Apple can still access metadata such as file types, sizes, and usage data. It also stresses the importance of having a recovery contact and key due to Apple's lack of access to encrypted user data. The paragraph then suggests alternative backup options for those wanting to minimize their exposure to the Apple ecosystem, including using non-Apple mail, calendar services with end-to-end encryption, and self-hosting options like Synology and Nextcloud for photos and files. It acknowledges Apple's higher security and privacy compared to competitors but advises users to enable Advanced Data Protection for better privacy of their digital files. The paragraph concludes with a note on the video's funding through community donations and a personal anecdote from a hacker conference.

Keywords

💡Privacy

Privacy refers to the state of being free from unauthorized intrusion or information disclosure. In the context of the video, it is the central theme as it discusses the privacy measures Apple implements for its iCloud service. Apple's marketing emphasizes privacy, but the video points out that users should be aware that not all iCloud data is private by default.

💡iCloud

iCloud is Apple's cloud storage service where users can back up various types of data, including photos, contacts, emails, and more. The video explains that while iCloud is marketed as a private service, it may not be as private as users believe without additional settings enabled.

💡End-to-End Encryption

End-to-end encryption is a security measure that ensures data can only be decrypted by the intended recipient. It is highlighted in the video as a feature Apple introduced for certain iCloud categories to protect against unauthorized access. The video emphasizes the importance of enabling this feature for enhanced privacy.

💡Advanced Data Protection

Advanced Data Protection is a setting on iCloud that, when enabled, provides a higher level of privacy by encrypting data so that only the user can access it. The video explains how to enable this setting and what data it protects, underlining its significance for users who want to keep their iCloud data private.

💡Account Recovery

Account Recovery is a process set up by Apple to help users regain access to their accounts if they forget their password. The video describes it as a necessary step before enabling Advanced Data Protection, as it ensures users can still recover their data without Apple's involvement.

💡Two-Factor Authentication (2FA)

Two-Factor Authentication is a security process that requires two different authentication factors to verify a user's identity. In the video, it is mentioned as a prerequisite for enabling Advanced Data Protection on iCloud, adding an extra layer of security to the user's account.

💡Data Metadata

Data metadata refers to information about data, such as file type, size, and viewing statistics. The video points out that even with Advanced Data Protection enabled, Apple can still see metadata, which can reveal usage patterns and other details about the files stored in iCloud.

💡Interoperability

Interoperability is the ability of different systems or components to work together. The video discusses how Apple does not end-to-end encrypt iCloud Mail, Contacts, and Calendars to maintain interoperability with other service providers, which means these data types are not as private as other iCloud data.

💡Proton Drive

Proton Drive is mentioned in the video as one of the alternative private backup options to iCloud. It is part of a discussion on how users can limit their exposure to the Apple ecosystem and maintain greater control over their data privacy.

💡Self-Hosting

Self-hosting refers to the practice of hosting services on one's own servers rather than relying on third-party services. The video suggests self-hosting options like Synology and Nextcloud as ways to back up data privately and automatically, offering an alternative to using iCloud.

💡Telemetry

Telemetry is the process of collecting data from users' devices for analysis. The video briefly touches on how Apple collects a significant amount of data from users, particularly through telemetry, which can be a concern for privacy-conscious individuals.

Highlights

Apple's iCloud is not as private as users might think, contrary to the company's marketing on privacy.

Apple introduced end-to-end encryption for certain iCloud categories in late 2022.

The 'Advanced Data Protection' setting significantly enhances user privacy and data security on iCloud.

Despite the new setting, iCloud is not private by default as end-to-end encryption is not enabled by default.

Apple can see all data uploaded if Advanced Data Protection is not turned on.

Advanced Data Protection allows only the user to access their files, even preventing Apple from accessing them.

Sensitive data categories like passwords, health data, and home data are protected by end-to-end encryption by default.

Enabling Advanced Data Protection adds more categories to the list, including iCloud Backup, Photos, and Notes.

To enable Advanced Data Protection, all devices must be updated to the latest software versions.

Account Recovery must be set up before enabling Advanced Data Protection.

A recovery contact or a 28-character recovery key is required for data recovery if the password is forgotten.

Two-factor authentication (2FA) and a device passcode are prerequisites for Advanced Data Protection.

Once enabled, Advanced Data Protection prevents access to data via iCloud.com by default.

Turning on Advanced Data Protection is a significant step towards improving the privacy of digital files.

Certain data types like iCloud Mail, Contacts, and Calendars are never end-to-end encrypted.

Apple can still see metadata of all files, even with Advanced Data Protection enabled.

Users are solely responsible for protecting their data once Advanced Data Protection is enabled.

Alternative options for backups outside the Apple ecosystem are suggested for users concerned about privacy.

The video recommends not using Apple mail, calendar, or contacts due to the lack of end-to-end encryption.

Proton Drive, Synology, and Nextcloud are suggested as private backup options.

Apple products generally offer a higher level of security and privacy compared to competitors like stock Android.

It is crucial to enable Advanced Data Protection on iCloud for better privacy of digital files.

Transcripts

Many people who use Apple products  assume that all their data with them  

is private because of the company’s aggressive  marketing on the topic. They say things like:

“Some things shouldn’t be shared.  iPhone helps keep it that way,”

and “Privacy. That’s iPhone.”

Privacy is something we’ve come to  immediately associate with Apple.

Now if you use an iPhone or other Apple products,  

you probably also use the company’s cloud  storage service, iCloud, to back up your photos,  

contacts, emails, calendars, notes,  messages, voice memos, and other data.

But your iCloud is probably NOT as  private as you think. Let me explain.

In late 2022, Apple did introduce  end to end encryption for a range  

of iCloud categories. Sensitive  and personal data like photos,  

notes, and iMessage backups were now  protected from unauthorized access.

With the addition of a setting called “Advanced  

Data Protection” Apple significantly  enhanced user privacy and data security.

Things protected with this setting can only be  

accessed by the user -- not even  Apple can access these files.

But it’s super important that users know that,  

even though this enhanced privacy setting  exists, and despite Apple, in general,  

being a vocal proponent of privacy, your  iCloud is probably not at all private.

Because this new setting’s end to end  encryption is NOT turned on by default.

So if you’ve been happily backing up  all of your private files to iCloud  

all this time and never bothered to  turn on Advanced Data Protection,  

Apple has been able to see  everything you’ve uploaded.

In this video I’m going to give an overview of  exactly what is being protected with Advanced  

Data Protection, how to turn it on, and  I’ll also talk about its limitations,  

and other options that you might  use for your backups instead.

Let’s start by diving into the  details of Advanced Data Protection.

It’s a setting that gives you a choice to better  protect your privacy on iCloud if you want to,  

and take your data out of the  reach of even Apple itself.

Once enabled, it makes sure that data can only  

be decrypted on devices where you're  signed in with your Apple ID account.

Whether you turn on Advanced Data  Protection or not, Apple does already  

protect some sensitive data categories  with end to end encryption by default.

These include things like  your passwords and keychain,  

payment information, health data and home data.

Enabling Advanced Data Protection, adds a  whole bunch more categories to that list.

iCloud Backup including device and Messages  backup, iCloud Drive, Photos, Notes, Reminders,  

Safari Bookmarks, Siri Shortcuts, Voice  Memos, Wallet passes, and Freeform.

Now let’s dive into exactly how to set it up.

First you'll first have to update all your  devices to the latest software versions.

This means every device where you’re signed  in with your Apple ID, otherwise you’ll  

have to sign out on those devices, because  they won’t support end to end encryption.

Next, you’ll have to enable Account Recovery.

If you lose access to your account, Apply  won’t be able to resend you your log in.

So you’re required to set  up a recovery contact first,  

which ensures that you can still recover  your data if you forget your password.

First, open Settings on your iPhone  and click on your Apple ID at the top.

Then select iCloud. Click Advanced Data  Protection and click Account Recovery

Then you’ll add your recovery contact,  

which is a trusted person who also owns an  Apple device, like a friend or family member.

Once you confirm them as your recovery contact,  they will receive recovery codes if you ever  

forget your password. You'll also have the  option to set a 28-character recovery key,  

which you should write down somewhere  safe or store in a password manager.

The final two things that you’ll need in order to  turn on Advanced Data Protection are 2FA on your  

Apple ID and a passcode locking your device, both  of which you hopefully already have set up anyway.

Now you should see the option to toggle on  Advanced Data Protection for iCloud backups.

Once Advanced Data Protection is  enabled, it’s worth noting that,  

by default, you won’t be able to  access your data via iCloud.com.

If you’d like this feature, you’ll  have to toggle it on manually,  

but keep in mind that this allows the web browser  and Apple to have access to your encryption keys.

That's it. Your iCloud backups are now protected  with end-to-end encryption. It means that only  

devices signed in to your iCloud account, and  that you have explicitly trusted, can access  

your files. Your decryption keys are held only  on these devices, so nobody else can decrypt  

and view your sensitive digital assets. Turning  this on is a huge step forward for your privacy.

But now let’s talk about some of the  limitations of Advanced Data Protection.

First, even if you turn on the new  Advanced Data Protection feature,  

three important kinds of data are never end-to-end  encrypted: iCloud Mail, Contacts, and Calendars.

Apple says that it can’t encrypt  this data because it wants these  

services to remain interoperable with  other email and calendar providers.

So keep in mind that no matter what you do, Apple  will be able to scan your emails, calendar events,  

and see personal details about people in your  network. But on top of that, whether you have  

Advanced Data Protection turned on or not, all  your files’ metadata is still visible to Apple.

This includes: File type, File size,  How many times a photo has been viewed,  

Whether a file was pinned or marked as favorite,  

usage data, such as timestamps of when  the file was created or last modified.

Finally, you are now in control  of protecting your own data.

You can’t go to Apple to regain access to your  account, because Apple itself doesn’t have access.

So make sure your recovery contact is  up to date, and make sure that you have  

your recovery key saved somewhere really  safe. If you ever forget your password,  

these recovery methods are your only options.

Now I want to briefly mention some alternative  options to using the Apple ecosystem for backups.

Why might you want to do this?

Well, in other videos we talk about the huge  amount of data that Apple collects from users,  

especially through things like telemetry,  and how they bypass VPNs for a lot of this  

collection. So some people might  want to limit their exposure to the  

Apple ecosystem as much as they can,  even while still using Apple devices.

So we’d recommend not using apple mail,  calendar, or contacts because of their lack  

of end to end encryption. We have videos diving  into more private email options. For calendars,  

I personally like Proton’s end to end  encrypted calendar, and my contacts are  

all stored locally on my Graphene phone  and not backed up to any central server.

When it comes to backing up photos and files,  we just released a video exploring 3 options  

that we like: Proton Drive, and 2 self hosting  options: Synology and Nextcloud. These are all  

private backup options that you can set up to  happen automatically, so that you never have to  

think about it again. So check out those videos  if you want to be walked through the process.

In general, Apple products  do offer a higher level of  

security and privacy compared to top competitors.

For example, stock iPhone is far more  private and secure than stock Android.

But don’t presume that your iphone is more  private than it actually is. And if you’re  

already logged into an iCloud account, absolutely  make sure that you have Advanced Data Protection  

turned on. It’s an easy step that goes a long way  to improving the privacy of your digital files.

As always, there were no sponsors in this video.  NBTV is funded entirely by community donations.  

So if you’d like to support our free educational  videos, head to nbtv.media/support. Or take a look  

at our book, “Beginner’s Introduction to Privacy”,  which also supports our channel. Thanks so much  

for liking, sharing, and subscribing,  and for watching through till the end.

I just got back from CactusCon, which  is a hacker conference in Arizona,  

and they had the best theme this  year, which was “Big Hacktar”,  

a Big Brother spin off. So, a big shout out to  them for putting a focus on privacy at their  

conference. And this little guy is gonna go into  my set. And thanks so much to everyone who came  

to say “hi”! It was super awesome to meet so  many of you. If you ever see me at an event,  

come say hi because you will get one of these  little NTV stickers. Stickers! He’s adorable!