Your backups are uploaded to Google and encrypted with your Google Account password. For some data, your device’s screen lock PIN, pattern, or password is also used for encryption
Some data is further encrypted with your device’s screen lock. Photos and videos stored in Google Photos, and MMS media received from your carrier are not encrypted by your device’s screen lock.
Is this the same end-to-end encryption that Apple offers, where even Google cannot see at its contents?
Or is it a situation where Google has a master key to see the contents of what is stored?
Also, does the type of lock used for encryption change its confidentiality? For example, is a pattern lock easier to crack than a PIN, and is a PIN lock easier to crack than a sufficiently long password?
I would trust Apple more than Google with their word on encryption offered on user accounts - however each decide to do it. They both have closed coursed OSs so technically, they both may have the master key for all their accounts. Even if they don’t have access to actual data of the users (which may be the case), they would still have enough meta data to identify whatever need be identified if a nation state asks them to identify anything.
Alphanumeric passwords are always strong but that also depends on the length and complexity of it. I would not use pattern lock or a numeric PIN code as a password.
But to answer your question more directly - as I understand it and reading the page you liked - no where does it explicitly mention that Google offers end to end encryption to your Android backups. But Apple does offer Advanced Data Protection which has E2EE for many things.
I agree that ultimately we don’t know how they (Google and Apple) handle backup data.
But to answer your question more directly - as I understand it and reading the page you liked - no where does it explicitly mention that Google offers end to end encryption to your Android backups. But Apple does offer Advanced Data Protection which has E2EE for many things
It has been suggested that the end-to-end encryption that Apple does is based on passcodes or passwords.
About end-to-end encrypted data
End-to-end encrypted data can be decrypted only on your trusted devices where you’re signed in to your Apple Account. No one else can access your end-to-end encrypted data — not even Apple — and this data remains secure even in the case of a data breach in the cloud. If you lose access to your account, only you can recover this data, using your device passcode or password, recovery contact, or recovery key.
This appears to be the same thing Google does when it encrypts; while Google does not use the term end-to-end encryption, is it safe to assume that they are handling some data in a process similar to the end-to-end encryption that Apple claims?
Googles documentation is…confusing. And I could never figure out what is and is not encrypted in a backup.
For Apple they have a convenient support page:
One clarification on the “passcode” being the encryption key. It isn’t but I understand the confusion. Each device logged into your Apple ID generates unique encryption keys stored locally on the device that are used to encrypt/decrypt iCloud E2EE data. Your passcode is required, on a trusted device already signed into your Apple ID, to release the decryption key from the Secure Enclave.
You cannot use a passcode from a device to decrypt the data on Apples servers. That is why a recovery key is required. That recovery key (long and random) is the decryption key that can be used to decrypt the data if you simultaneously lose access to all your trusted devices which hold decryption keys in their Secure Enclave.
Alternatively a recovery contact can be setup. That contact then gets a copy of your decryption key stored in the Secure Enclave’s of their trusted devices. So you better trust them if you go that route.
Thanks for elaborating on Apple’s encryption process. Those keywords gave me further insight into Google One backups.
My search led me to documentation on Android OS backups. This may suggest that the backup mechanism provided by Google encrypts the encryption key of the data with a PIN or password, similar to Apple’s:
Use the Standard Android Backup system
The Standard Android Backup system always encrypts backup data in transit and at rest. This encryption is applied regardless of the Android version in use and of whether your device has a lock screen. Starting from Android 9, if the device has a lock screen set, then the backup data is not only encrypted, but encrypted with a key not known to Google (the lock screen secret protects the encryption key, thus enabling end-to-end encryption).
Don’t know how both can be compared but personally I don’t take much of a word from Google as Its the same company that tracked users in chromes incognito mode. Apple might have some edge over here but then again both of them are closed source that means entrusting them to do the right thing. This is also why WhatsApp isn’t recommended here although they claim to utilize the same encryption protocol used by signal.
Neither Apple nor the recovery contact have the necessary information individually to recover the user’s end-to-end encrypted iCloud data.
So the recovery contact isn’t able to unlock your account without your permission.
There are safeguards in place to prevent a recovery contact from initiating recovery without the user’s consent, which include a liveness check on the user’s account. If the account is in active use, recovery using a Recovery Contact also requires knowledge of a recent device passcode or the iCloud Security Code.