Apple is introducing three new security features to protect its users’ data. Among other things, there is a physical security key for the Apple ID and improved data protection through end-to-end encryption. iMessage should also become more secure.
The security features are intended to increase security against threats to data in the cloud. According to Apple, user data is threatened in an increasingly complex way, even if Apple products are considered relatively safe. However, it is precisely the networking of all devices and the associated backups in a cloud that make sensitive data vulnerable. With end-to-end encryption (E2E), Apple wants to combat data protection violations in cloud systems, which have been increasing since 2013.
More iCloud data get E2E encryption
So far, Apple protects 14 sensitive data categories with E2E encryption by default. Including passwords and health data. Now Apple includes 7 more categories including iCloud backup, Notes and Photos. However, some data is still excluded from the protection.
The iCloud mail, contacts and calendars are currently not protected by E2E encryption. This data must interact with Apple’s global systems. If they were encrypted, the company could no longer easily read the information during processing.
Also Read: iOS 16.2 Gets Karaoke Mode
Improved security for Apple’s iMessage and Apple ID
Contact verification has been improved for iMessage. Although Apple has been using E2E encryption since its introduction, it is now adding additional protection for people who are particularly vulnerable, such as journalists or human rights activists.
The improved contact key verification now automatically alerts with a small message after activation if a highly armed actor manages to follow the conversation. To ensure greater security, iMessage users can personally exchange a code. The message should only be readable between verified contacts.
The improvement in Apple ID protection concerns two-factor authentication. This means that in addition to the password, another step is necessary to log in. This can be a security question, an email with a code, or an additional one-time password (OTP). An Apple ID user now has an additional two-factor authentication in the form of a hardware security key. On the one hand, this can be a USB stick on which a cryptographic key is stored. The key is then transferred by inserting the stick. Alternatively, authentication also works via NFC tag, which transmits the information without contact. These security measures are designed to make it difficult for an online attacker to access the Apple ID accounts, even if they have the password. Because without the physical key, the password is useless.
source
- Apple NewsroomApple advances user security with powerful new data protections, accessed 12/08/22.