<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 25, 2016, at 08:58 , Jerry Leichter <<a href="mailto:leichter@lrw.com" class="">leichter@lrw.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: Georgia; font-size: 13.800000190734863px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">So far, Apple (and others) have decided *not* to respond technically to demands for copies of information uploaded to their servers. Apple could certainly encrypt the uploads. It would have to do so using a key unavailable to them, which makes sharing across devices more complicated: There would have to be a common key across all the devices sharing the software *distinct from* the key used to log in to the Apple account, since that's revealed to Apple every time you log in. But it could certainly be done. (Most on-line backup services already provide the option to use a private - never revealed to the service - key.)</span></div></blockquote></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div>Gentlemen,<div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Apple provides at least two secure cloud services for developers: Keychain syncing and CloudKit. Apple claims in their security document that they cannot unlock the Keychain nor CloudKit. Of course, the developer has to use the security services. While they are quite straightforward, they are documented in a somewhat haphazard fashion. The Keychain is particularly poorly documented. I depend upon Apple’s inability to decrypt the keychain for my cryptographically private apps. I have also been privately assured that Apple does not believe they can crack their keychain. The weak point into the keychain is from the phone or a Mac on the same iCloud account.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div class="">
<div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Anon,<br class="">Andrew<br class="">____________________________________<br class="">Andrew W. Donoho<br class="">Donoho Design Group, L.L.C.<br class=""><a href="mailto:awd@ddg.com" class="">awd@DDG.com</a>, +1 (512) 750-7596, <a href="http://twitter.com/adonoho" class="">twitter.com/adonoho</a><br class=""><br class="">New: Spot marks the taX™ App, <<a href="http://spotmarksthetax.com" class="">http://SpotMarksTheTaX.com</a>><br class="">Retweever Family: <<a href="http://image.retweever.com" class="">http://Image.Retweever.com</a>>, <<a href="http://retweever.com" class="">http://Retweever.com</a>><br class=""><br class=""></div><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">No risk, no art.<br class=""><span class="Apple-tab-span" style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> </span>No art, no reward.<br class=""><span class="Apple-tab-span" style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> </span><span class="Apple-tab-span" style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> </span>-- Seth Godin<br class=""><br class=""></div></div></div></div>
</div>
<br class=""></div></body></html>