iCloud backup helped uncover a $320M crime ring in Brazil

$320M crime ring exposed because someone couldn’t take 30 seconds to turn on advanced data protection. :kissing_face:

3 Likes

I was about to ask about that. The article didn’t specify if he used ADP, but most likely he didn’t. This is why defaults matter. The vast majority of Apple users do not have ADP enabled, which is why I was so surprised by the UK trying to force Apple to remove the feature.

Enabling ADP requires a high level of responsibility because you can’t get your data back if you forget your credentials. I suspect this is why some people are hesitant to enable it. It’s certainly why I hesitate to encourage some of my family members to enable it. I’m sure that one of the reasons Apple doesn’t want to enable it by default is because they don’t want to deal with the flack of all the inevitable people who will complain about getting locked out of their accounts.

4 Likes

It’s been so long since I enabled it on my device, don’t they literally require you to have two hardware security keys to even enable it anyway? Am I making that up, or is that no longer a requirement? And you’re right, the average Joe probably isn’t exactly doing that.

1 Like

Separate features.

ADP is under iCloud settings along with features like Apple Relay. It provides you with a recovery key and states that you need either that or a recovery contact to regain access to most data on your account. Although based on the one time I had to go through with it only the recovery key was accepted.

I’ve never enabled “Security Keys” under Two Factor Authentication in security settings. Although it does indeed require two hardware security keys based on the setup screen.

That’s actually what I meant. When ADP was first announced, you had to have two hardware security keys in order to even enable it. I was just curious if that is still a requirement.

You have to have some kind of recovery method. You can just generate a recovery code which is what I did. I don’t remember it ever being the case that you needed to have hardware keys to enable it. You also have to have 2FA enabled on your Apple account but by default they just use your devices as the 2FA method, but you can set up hardware keys for that if you want.

It shouldn’t come as too much of a surprise given how rapidly the U.K. is becoming a ‘nanny state’. The Online Safety Act (that has nothing to do with online safety), the will to break e2ee (except for the U.K. government who will retain e2ee… obviously…), ID card proposals, etc.

Also, they forced Apple’s hand to stop ADP being adopted. It still exists in the U.K. for those who have it. It’s still on my device. How much longer, who knows. Because, again, the U.K. have stopped Apple talking about it. Technical Capability Notice and other embargoes.

When it comes to the U.K. and privacy, think again…

My surprise came from the fact it would be unnecessary to make such a demand when you consider that so few people use it. However, it’s possible that the UK is targeting very specific people in mind who have ADP enabled, and they are willing to strip the entire population of that feature, just to get to those individuals’ data.

Your characterization of the UK may be true, but given the fact that like the US and Australia, the UK has a strong history of rejecting national IDs, I still have hope that digital IDs will be rejected there. It’s much harder for countries who’ve had national IDs for generations to reject digital IDs because they are already in the matrix.

1 Like

enable recovery key then delete it’s existence. never use recovery contact because iCloud search warrant will reveal existence of ADP, timestamp of when it was turned on, recovery method in use, and who the recovery contact is if there is one.