Category: encryption

By default, Apple stores encryption keys for some iCloud data types on its servers to ensure that users can recover their data if they lose access to their Apple ID account. If a user enables Advanced Data Protection, the encryption keys are deleted from Apple’s servers and stored on a user’s devices only, preventing Apple, law enforcement, or anyone else from accessing the data, even if iCloud servers were to be breached.

iCloud already provides end-to-end encryption for 14 data categories without Advanced Data Protection turned on, including Messages (excluding backups), passwords stored in iCloud Keychain, Health data, Apple Maps search history, Apple Card transactions, and more. Advanced Data Protection expands this protection to the vast majority of iCloud categories, with major exceptions including the Mail, Contacts, and Calendar apps. For more information, you can read Apple’s Advanced Data Protection support document.

CircleCi said the theft of the session token allowed the cybercriminals to impersonate the employee and gain access to some of the company’s production systems, which store customer data. “Because the targeted employee had privileges to generate production access tokens as part of the employee’s regular duties, the unauthorized third party was able to access and exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys,” said Rob Zuber, the company’s chief technology officer. Zuber said the intruders had access from December 16 through January 4.

Zuber said that while customer data was encrypted, the cybercriminals also obtained the encryption keys able to decrypt customer data. “We encourage customers who have yet to take action to do so in order to prevent unauthorized access to third-party systems and stores,” Zuber added. Several customers have already informed CircleCi of unauthorized access to their systems, Zuber said. Zuber said that CircleCi employees who retain access to production systems “have added additional step-up authentication steps and controls,” which should prevent a repeat-incident, likely by way of using hardware security keys.

1.) How did the test key get left behind?
2) Was it by accident or design?

This lexical shift has weighed heavily on cryptographers, who, over the past few years, have repeated the rallying cry “Crypto means cryptography” on social media. T-shirts and hoodies trumpet the phrase and variations on it; there’s a website dedicated solely to clarifying the issue. “‘Crypto’ for decades has been used as shorthand and as a prefix for things related to cryptography,” said Amie Stepanovich, executive director of Silicon Flatirons Center at the University of Colorado Law School and creator of the pro-cryptography T-shirts, which have become a hit at conferences. “In fact, in the term cryptocurrency, the prefix crypto refers back to cryptography….”

[T]here remains an internecine feud among the tech savvy about the word. As Parker Higgins of the Freedom of the Press Foundation, who has spent years involved in cryptography activism, pointed out, the cryptography crowd is by nature deeply invested in precision — after all, designing and cracking codes is an endeavor in which, if you get things “a little wrong, it can blow the whole thing up….”

“Strong cryptography is a cornerstone of the way that people talk about privacy and security, and it has been under attack for decades” by governments, law enforcement, and “all sorts of bad actors”, Higgins said. For its defenders, confusion over terminology creates yet another challenge.

Stepanovich acknowledged the challenge of opposing the trend, but said the weight of history is on her side. “The study of crypto has been around for ever,” she said. “The most famous code is known as the Caesar cipher, referring to Julius Caesar. This is not new.” Cryptocurrency, on the other hand, is a relatively recent development, and she is not ready to concede to “a concept that may or may not survive government regulation”.