Have you checked their iOS security guide? It has a section on internet/cloud services.
https://www.apple.com/business/site/docs/iOS_Security_Guide....
EDIT to add: DuckDuckGo gave me the above link for the iOS 11 version, but it has actually been updated already for iOS 12.
Re:iOS 12 released
by Silhouette on Monday September 17, 2018 @04:14PM
(#18009611)
Yes, thanks. Actually, that's the main documentation I was looking at before. I can't figure out from those descriptions how Apple IDs and iCloud keys work, and in particular, whether Apple themselves hold all of the necessary credentials to decrypt data held in iCloud services or whether something remains with the user alone.
I’ve read the entire iOS security guide (seriously; version ~9/10), and while I don’t remember the specifics, I distinctly remember coming to the conclusion that I could not use most iCloud features as they did not provide the same privacy as on-devices features. I distinctly remember that your photos can be seen by Apple as that was the main thing I wanted to know.
Some things, like the keychain, are not accessible by Apple, and only on your enrolled devices.
Re:iOS 12 released
by Silhouette on Monday September 17, 2018 @08:12PM
(#18011265)
That was my suspicion as well, but just on the basis that for certain features such as the keychain they do explicitly talk about how the encryption works and having no access at Apple, so maybe the exception proves the rule. However, I've also read in several places that Apple has been at least considering reworking iCloud so that it really does have no access, as a means of countering government prying eyes. It would be nice to get the current facts, whatever they are.
Indeed. Between that and the imminent arrival of dual-SIM iPhones, I may actually want to buy something here.
And yet, for all the information Apple provide about security and privacy, including much talk of end-to-end encryption in some cases, I have so far been unable to determine the fundamental way that all of their online services work and whether they have access to (for example) any photos I take or messages I send from the phone, if I choose to use iCloud services. Can anyone point me in the right direction?