Re:Apple to allow outside app stores in overhaul spurred by ...
by DCKing on Tuesday December 13, 2022 @05:11PM
(#33976744)
You seem to think that your phone's pin is used directly as some sort of encryption key for cloud backups, but that's not how these systems work. Your pin or face or fingerprint unlocks your phone's secure element, and the secure element contains a randomly generated high entropy encryption key for your data.
This is why you can casually change your pin code in your phone's settings without it chewing through your battery and data plan reencrypting and reuploading gigabytes of cloud data.
Re:Apple to allow outside app stores in overhaul spurred by ...
by everfree on Tuesday December 13, 2022 @05:25PM
(#33976949)
In addition to what DCKing said, you can effectively rate-limit password attempts on encrypted data by deriving the key using a cryptographic hashing function such as bcrypt with a high amount of iterations.
Yes, but only as secure as the passphrase you use to unlock your phone. Except actually less secure than that; your phone will rate limit attempts to guess your passphrase, but encrypted iCloud backups turned over to a government won't and can't rate limit attempts.
For the average user with a relatively short passphrase, iCloud backups will be trivial to crack. Still, it's an improvement.