NPR Yesterday wrote a story on the efforts of tech companies to protect consumer data, which included an extensive chart on how companies measure up when it comes to encryption. While Apple was found to be encrypting iMessage end-to-end, as well as email from customers to iCloud, it was found to be one of the few global email providers based in the U.S. that does not encrypt customer email in transit between providers. That means emails that are sent from iCloud to iCloud are encrypted, but emails sent from iCloud to other providers, such as Gmail, are not encrypted. Following the post, however, Apple told NPR that it is planning to encrypt those emails in the near future.
Apple on Friday said it is working to implement an in-transit encryption solution for its email domains, offering additional protection for iCloud customers sending and receiving messages from people using other providers like Gmail. Word of Apple’s initiative came in a statement provided to NPR after the broadcaster ran a reporton its blog looking into the steps big tech firms take to protect users’ data privacy. The story was based on an Electronic Frontier Foundation survey that asked companies like Apple, AT&T, Facebook, Google, Twitter and more about the encryption policies implemented in their products. Specifically, the EFF asked if the firms follow a recommended five-step plan the organization believes keeps consumer data safe. Specifically, the group looks wants companies to use HTTPS, HSTS , forward secrecy, STARTTLS, and encryption of email while in transit. While Apple’s iMessage inherently supports end-to-end encryption, the company’s other text-based communication methods are less secure. Users of Apple’s iCloud email service enjoy protections similar to iMessage as long as the conversation is with another iCloud address, but there is currently no encryption method being used for emails in transit between other providers like Google. As the publication noted in its follow-up, however, Apple is working on the issue and will soon have a solution ready to go.
