Apple Inc. said Wednesday it plans to strengthen iCloud data security by offering a trio of new features in the coming year. One of these is available today for beta testers.
Apple
AAPL,
shares declined 1.3% in recent trading to an intraday low of $140.58, while the Dow Jones Industrial Average
DJIA,
which counts Apple as a component, was flat. Meanwhile, the S&P 500 index
SPX,
slipped 0.2%, and the tech-heavy Nasdaq Composite Index
COMP,
declined 0.4%.
“Our security teams work tirelessly to keep users’ data safe, and with iMessage Contact Key Verification, Security Keys, and Advanced Data Protection for iCloud, users will have three powerful new tools to further protect their most sensitive data and communications,” said Craig Federighi, Apple’s head of software engineering, in a statement.
Advanced Data Protection for iCloud, which is available immediately to U.S. beta testers and scheduled to be available to U.S. users by the end of the year, broadens the number of categories of what gets end-to-end encrypted to 23, including iCloud Backup, Notes and Photos, from a current 14. Apple said the only major categories that won’t get the encryption are iCloud Mail, Contacts, and Calendar “because of the need to interoperate with the global email, contacts, and calendar systems.”
A support guide for Advanced Data Protection for iCloud is available at Apple’s website.
In early 2023, Apple plans to release Security Keys for Apple ID, which is an extra physical layer of factor verification — third-party hardware security keys — for users to access their Apple ID account. With two-factor ID released in 2015, Apple said 95% of users have the feature enabled already.
“This takes our two-factor authentication even further, preventing even an advanced attacker from obtaining a user’s second factor in a phishing scam,” Apple said.
Available sometime in 2023, Apple also plans to launch iMessage Contact Key Verification for “users who face extraordinary digital threats — such as journalists, human rights activists, and members of government,” a service for users to verify that they are communicating only with intended recipients.
Conversations where the feature is enabled will “receive automatic alerts if an exceptionally advanced adversary, such as a state-sponsored attacker, were ever to succeed breaching cloud servers and inserting their own device to eavesdrop on these encrypted communications.”
