Forgot your password?
typodupeerror
Bug Cellphones Communications Encryption Handhelds IOS Iphone Upgrades Apple

iOS 7 Update Silently Removes Encryption For Email Attachments 68

Posted by timothy
from the giveth-and-taketh-away dept.
An anonymous reader writes "Apple has removed encrypted email attachments from iOS 7. Apple said back in June 2010 in regards to iOS 4.0: 'Data protection is available for devices that offer hardware encryption, including iPhone 3GS and later, all iPad models, and iPod touch (3rd generation and later). Data protection enhances the built-in hardware encryption by protecting the hardware encryption keys with your passcode. This provides an additional layer of protection for your email messages attachments, and third-party applications.' Not anymore."
This discussion has been archived. No new comments can be posted.

iOS 7 Update Silently Removes Encryption For Email Attachments

Comments Filter:
  • by Anonymous Coward on Friday May 02, 2014 @07:15PM (#46904159)

    This 'news' is about a week or two old. Apple already issued a statement acknowledging the situation and is looking into it.
    Will probably fixed with an update.

    • by Rosyna (80334)

      What does the author of TFA want? Double-encryption of message attachments? The storage of the iPhone is always encrypted. In order to access any files, you must supply the encryption key. He supplied the key and could read the files.

      Unless he wants attachments double encrypted or encrypted on iCloud itself?

      • by Anubis IV (1279820) on Friday May 02, 2014 @10:38PM (#46905409)

        The storage of the iPhone is always encrypted. In order to access any files, you must supply the encryption key. He supplied the key and could read the files.

        From what I understand, that's actually not what's happening here, and that's the problem. He was able to simply mount the disk and gain access to the files, without having to supply an encryption key. In contrast, the messages themselves were encrypted, just as you'd expect. More or less, it turns out that not everything that's stored on the iPhone is actually being encrypted.

        • by Rosyna (80334)

          You cannot mount the disk without the encryption key.

  • Title is Misleading (Score:5, Informative)

    by Anonymous Coward on Friday May 02, 2014 @07:17PM (#46904165)

    The encryption for email attachment was not removed, it was never present.

    It's not nefarious, it's incompetent.

    Read the original (shorter!) post (http://www.andreas-kurtz.de/2014/04/what-apple-missed-to-fix-in-ios-711.html) instead of the rehashed ad-selling copy.

  • I need more info (Score:3, Insightful)

    by sgt scrub (869860) <saintium@@@yahoo...com> on Friday May 02, 2014 @07:27PM (#46904235)

    At first glance it looked like there might have been a significant enough performance hit using hardware encryption the took it out. It didn't seem like a big deal. TFA makes it sound like encrypted email I pull from my email server is stored decrypted. That would be a big deal.

    • by Anonymous Coward

      The idea behind hardware encryption is that there is no performance hit. Software encryption though is a performance hit.

      • by sgt scrub (869860)

        Not in CPU cycles but power. Granted, I should have pointed that out. This is /. after all.

  • Encrypt your attachment with PGP before sending.

    Or use a word .DOC managed by Active Directory Rights Management Services, or else: encrypted with the 'require a password to open this document' option

  • by gnasher719 (869701) on Friday May 02, 2014 @08:56PM (#46904829)
    Fact is, you can't read the data on a locked iPhone. You _can_ read the data if you, as the owner, unlock the iPhone, for example for backing it up. But if the NSA gets your locked phone into their hands, there's nothing that they can do. All the data is _always_ read and written using hardware decryption.

    In addition, apps can use further encryption on a per-file basis. Mail does that for most files, but apparently not for attachments. Additional encryption means for example that entering the key code is needed again for that kind of file. But files without that additional encryption still can't be read.

    What the guy is complaining about is like sending unencrypted data over https, or putting unprotected documents into an unbreakable safe.
    • by antdude (79039)

      Doesn't Apple have access to these locked phones for law enforcement to request with warrants?

      • Re: (Score:3, Informative)

        by Anonymous Coward
        Do a little googling... It seems Apple bypasses the OS to read the encrypted data directly, then does a brute-force attack on the passcode. Most people use a 4 digit numerical passcode, and very very few use more than 8 alphanumeric digits so brute forcing is usually a matter of minutes. There are third-party forensics tools that can do the same, but most police departments aren't up to speed and have an easier time just shipping the device+warrant to Apple and waiting a few weeks. Your data is only as safe
        • Do a little googling... It seems Apple bypasses the OS to read the encrypted data directly, then does a brute-force attack on the passcode. Most people use a 4 digit numerical passcode, and very very few use more than 8 alphanumeric digits so brute forcing is usually a matter of minutes. There are third-party forensics tools that can do the same,

          The trick is that only software signed by Apple is able to try out passcodes. When you enter a passcode say 1234, that passcode gets sent to Apple-signed software which then tries it out. Apple can obviously create Apple-signed software that tries any number of keys.

          There are two obstacles for this: One, Apple needs a legal search warrant and the actual device. Two, passcode checking is designed to take about 1/10th of a second per key. So 4 digits can be cracked in 15 minutes. 8 digits would take months

      • by BitZtream (692029)

        No

    • Doesn't the master code get stored on Apple's iCloud network for iOS devices? I know it's optional to have it backed up there when using FileVault for OSX. Anyways, all the NSA has to do is subpoena the information from Apple and they're in like Flynn!

      • Doesn't the master code get stored on Apple's iCloud network for iOS devices? I know it's optional to have it backed up there when using FileVault for OSX. Anyways, all the NSA has to do is subpoena the information from Apple and they're in like Flynn!

        Doesn't get stored anywhere. FileVault for MacOS X works slightly different because it has no individual key built into the CPU. When you backup that key with Apple, you have to supply three security questions + answers and it looks like the answers are not stored but just used to encrypt / decrypt the key. Apple states that without the security answers, they are not capable of supplying the code.

    • by AmiMoJo (196126) *

      Do you trust Apple's hardware encryption implementation? If I wanted a secure phone I'd want one where the encryption system was open source so I could verify it myself. After Goto Fail and Heartbleed people are looking at this stuff a lot more closely, when possible.

  • by konohitowa (220547) on Saturday May 03, 2014 @01:02AM (#46906005) Journal
    They forgot to use the phrases "much maligned" and "beleaguered". But "silently" is always a great fallback.
  • Suck it, iOS fanbois.

    • by Wovel (964431)

      Ah blackberry where they don't need your device because they just hand over the keys to the completely unnecessary server companies were forced to stick in the middle of the email chain.

      • by narcc (412956)

        Ah, you're confused, I see. They can't "hand over the keys" because they don't have them. As always, BES users are safe.

        Or are you that guy who keeps repeating this despite being told, multiple times, that it's nonsense?

  • What kind of idiot has sensitive data on their iStuff (or Android, for that matter), anyway? Companies go with Blackberry for this exact reason.

  • I have to say I don't see the big deal. If you're going to encrypt email attachments, what about the emails? What about all your other data? That's what disk encryption is for surely. This was just a band aid for one scenario among hundreds.

It is better to give than to lend, and it costs about the same.

Working...