Behind the Scenes of iOS Security

What Hacker News said

Strong rec karlshea · 2018-01 · on “Apple, in Sign of Health Ambitions, Adds Medical Records Feature for iPhone”

They do all sorts of device key exchange, if you haven't watched the talk at Black Hat I'd highly recommend it: [this video] (link goes to beginning of Secure Enclave content, and later on in the talk he discusses iCloud which uses the SEP keys)

Strong rec karlshea · 2018-01 · on “Apple, in Sign of Health Ambitions, Adds Medical Records Feature for iPhone”

The Black Hat talk was really great: [this video] (link is to SEP and on-device encryption, 22:30 is iCloud stuff) > I know they said they could have accessed that San Bernardino terrorist’s iCloud backup if only they had one. Not sure if they’ve change the security architecture since then. I actually think they have, the shooting was in 2015 and iOS 10 was released in 2016 and was first to have some of the features he talks about in the video.

Strong rec Twisell · 2019-09 · on “Ask HN: How comfortable do you feel using cloud-based password managers?”

I tried 1Password but finally resolved to use iCloud keychain after watching this BlackHat 2016 video [this video] . I mean as far as I already trust their OS nothing can really protect me from being spied by them if they are ill intentioned, so as long as they are serious and patch their security flaw on a timely manner I can live with that. Beside it come as a free plan if you don't need more than 5GB of iCloud storage. I'd figure using an external password manager just add another third party I need to trust and the fact that 1Password offer browser app interface (on top of native) don't reassure me in any way. Of course if I'd ever need to reassess my threat model because I can't trust Apple

Strong rec dilippkumar · 2024-02 · on “Apple confirms it's breaking iPhone web apps in the EU on purpose”

There have been several comments along the lines of: "Why should I trust apple and their security, but not that of a third-party web browser?" I don't have an answer for you. But I want to recommend this talk from 7 years ago: [this video] That alone convinced me. Apple knows what it is doing when it comes to device security. Today, I trust them with my most sensitive data and sleep peacefully at night.

Strong rec jesseendahl · 2025-07 · on “UK backing down on Apple encryption backdoor after pressure from US”

This is not just encryption in transit or simplistic client-side encryption. It is end-to-end encryption, where each device's key generation is handled by your phone's Secure Enclave. This article is a decent starting point in terms of what Advanced Data Protection is: [LINK] If you want a deeper dive into the security engineering of iCloud Keychain, the second half of this Blackhat talk by Apple's head of Security Engineering & Architecture (SEAR) is really great: Synchronizing secrets: [this video]

Strong rec eddyg · 2026-01 · on “Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops”

You shouldn't include Apple in this. As of macOS Tahoe, the FileVault key you (optionally) escrow with Apple is stored in the iCloud Keychain, which is cryptographically secured by HSM-backed, rate-limited protections. You can (and should) watch [this video] for all the details about how iCloud is protected.

Strong rec eddyg · 2026-01 · on “MS confirms it will give the FBI your Windows PC data encryption key if asked”

Which is a very good thing. iCloud is much more secure than most people realize because most people don’t take the 30 minutes to learn how it is architected. You can (and should) watch [this video] for all the details about how iCloud is protected, but especially the time-linked section. :)

Recommends arkadiyt · 2016-11 · on “The limitations of Android N Encryption”

For a really in-depth dive about the iOS class keys system he mentions I recommend this 2016 blackhat talk by Ivan Krstic (head of security at Apple): [this video] (relevant portion starts at 6:56)