Light

Episode #901 Quiz

Apple Encrypts the Cloud
Date: 2022-12-13 | Length: 2 hrs | Episode page at twit.tv

About this episode

Apple’s Advanced Data Protection moves most iCloud categories, including backups, photos, and notes, to end-to-end encryption, deleting Apple-held service keys from HSMs and rotating new keys solely on trusted devices. Web access remains a controlled exception. Users need updated devices, two-factor auth, and recovery contacts or keys.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what happens to Apple's existing available-after-authentication service keys when a user turns on Advanced Data Protection for iCloud?

Question 1

According to the episode, what happens to Apple's existing available-after-authentication service keys when a user turns on Advanced Data Protection for iCloud?

They are converted into a temporary web-access format so iCloud.com can keep decrypting all data. They are copied into the user's device and retained alongside the older Apple-held keys for recovery. They are deleted from Apple's HSMs and replaced by new keys kept only in the user's iCloud Keychain domain. They are archived in Apple data centers and used only if the user later disables the feature.

Question 2: What is the episode's key caveat about accessing ADP-protected iCloud data through iCloud.com?

Question 2

What is the episode's key caveat about accessing ADP-protected iCloud data through iCloud.com?

Web access remains always on, but only for Photos and Notes while all other categories stay disabled. Web access works only from Safari on macOS and is blocked from all other browsers. Web access is allowed only after Apple Support manually approves the user's session. Web access is disabled by default and can be re-enabled only after a trusted device authorizes each sign-in.

Question 3: Which set of iCloud data categories did the episode say remain outside ADP's end-to-end encryption because they must interoperate with global services?

Question 3

Which set of iCloud data categories did the episode say remain outside ADP's end-to-end encryption because they must interoperate with global services?

Passwords, Health data, and Keychain items. Shared Albums, shared folders, and iWork documents. iCloud Mail, Contacts, and Calendar. iCloud Backup, Photos, and Notes.

Question 4: What did the episode say is required before a user can enable Advanced Data Protection for iCloud?

Question 4

What did the episode say is required before a user can enable Advanced Data Protection for iCloud?

A trusted phone number, a recent password change, and a Face ID enrollment. A hardware security key, a paid iCloud tier, and a linked macOS device. Two-factor authentication, updated devices, and at least one recovery method. A synchronized Apple Watch, iCloud.com access, and manual Apple approval.

Question 5: What operational consequence did the episode identify if the recovery methods for ADP fail?

Question 5

What operational consequence did the episode identify if the recovery methods for ADP fail?

Apple can temporarily unlock the data through iCloud.com using a support-issued recovery token. Apple cannot help recover the user's end-to-end encrypted iCloud data. Apple can recover the data only if the user still has a working hardware security key. Apple can restore the data from the user's old service keys after identity verification.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.