<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class="">On 11 Nov 2022, at 1:55 am, Shironeko <<a href="mailto:shironeko@waifu.club" class="">shironeko@waifu.club</a>> wrote:</blockquote><div class=""><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">Jerry Leichter <<a href="mailto:leichter@lrw.com" class="">leichter@lrw.com</a>> writes:<br class=""><br class=""><blockquote type="cite" class="">Now you really are speaking nonsense. They are outright telling you that your<br class="">password is sufficient to recover your encrypt messages, so any speculation<br class="">about how the key derivation “relies on other secrets” is just wrong.<br class=""></blockquote><br class="">I should have phrased it as “if A then contradiction, or if B then also<br class="">contradiction” rather than just an “and if”<br class=""><br class=""><blockquote type="cite" class="">As for Apple “reseting your password”: Where do you see them offering to do that? If they did, anything encrypted based on that password would be toast.<br class=""></blockquote><br class=""><<a href="https://support.apple.com/en-us/HT201487" class="">https://support.apple.com/en-us/HT201487</a>><br class=""></div></div></blockquote><br class=""></div><div>Head of Apple Security Engineering presented at Blackhat 2016 where he describedd in great detail how iCloud Keychain and the associated backup is achieved without exposing user data to Apple, or anyone else.</div><div><br class=""></div><div>Its here <a href="https://www.youtube.com/watch?v=BLGFriOKz6U" class="">https://www.youtube.com/watch?v=BLGFriOKz6U</a> The relevant part starts at 22:30 He does go quite fast but is thorough. Recommend watching it.</div><br class=""><div class="">LA.</div></body></html>