News for hackers. Stuff that matters.

A comment on EU launches probe into Google-Fitbit takeover. Parent comment

Re:EU launches probe into Google-Fitbit takeover by kjakm on Tuesday August 04, 2020 @10:04AM (#24050050)
I thought all Health data was kept on-device with Apple platforms. Wasn't that the point of the secure enclave they introduced a good few years ago?
[ Parent | on HN ]
Re:EU launches probe into Google-Fitbit takeover by hadrien01 on Tuesday August 04, 2020 @10:12AM (#24050157)
It seems that by default it's synced through iCloud: https://support.apple.com/HT204351 They say it's 'end-to-end encryption', but I don't see how that's possible?
[ Parent | on HN ]
Re:EU launches probe into Google-Fitbit takeover by easton on Tuesday August 04, 2020 @10:46AM (#24050502)
The data is encrypted and requires an on-device key to unlock it, Apple doesn't have the key[0]. If you lose a device, the data can also be decrypted via a device's passcode + 2FA. (Or, alternatively, without 2FA, you make up another key that is needed to access the data)[1]

[0]: https://support.apple.com/guide/security/cloudkit-end-to-end...

[1]: https://support.apple.com/guide/security/icloud-keychain-rec...

[ Parent | on HN ]
Re:EU launches probe into Google-Fitbit takeover by hvidgaard on Tuesday August 04, 2020 @02:09PM (#24052774)
If they can decrypt the data if you lose the device, it by definition do not require an on-device only key. That is, Apple do have the key outside the device.
[ Parent | on HN ]