Tag Archives: pages

Document security and Apple iCloud

I have just set up iCloud on three Apple devices: a Mac, an iPad 2, and an iPhone 4.

image

On the iOS devices I was asked if I wanted to use iCloud, and when I agreed, watched as all my documents were transferred from the device to iCloud.com.

I then went to the iCloud website, signed in with my Apple ID – username and password – and saw that all my documents were there ready for download.

I also tried editing a document on the iPhone. In moments, the edited document was also updated on the iPad.

All very convenient; but I realised that I’d just sent up to the cloud a couple of documents that include information I do not want to share. How safe is it on iCloud? Does Apple encrypt the documents?

I looked at Apple’s iCloud information and on the support site and found nothing about security on a quick look, other than that traffic is SSL encrypted, so here are my own observations.

First, access to iCloud.com is protected only by the username and password which form your Apple ID. Sony recently reported a breach of 93,000 accounts on the PlayStation network, apparently based on a list of username/password combinations that a hacker found elsewhere. In other words, some other popular site(s) suffered a security breach, and the hacker automated an attack on the PlayStation Network on the assumption that the same credentials might be used there. The majority failed, but 93,000 succeeded, demonstrating that this is not a small risk.

Second, I wondered if I could mitigate the risk by encrypting my iCloud documents. I cannot find a way to set a password on a Pages document in iOS, but I can do so on the Mac. I password-protected a document, and then uploaded it to iCloud. Next, I opened this on the iPad. I was prompted for the password – good. However, I then modified the document in Pages on the iPad. This automatically updated the document on iCloud, but it was no longer password protected. I do not recall seeing a warning about the password protection being removed. It looks as if password protection does not iWork if you use iOS.

Third, I found this statement in Apple’s terms of service for iwork.com. It is repeated in the terms for MobileMe, and which I cannot yet find terms for iCloud.com it may well be the same there too:

Access to Your Account and Content

You acknowledge and agree that Apple may access, use, preserve and/or disclose your account information and Content if legally required to do so or if we have a good faith belief that such access, use, disclosure, or preservation is reasonably necessary to: (a) comply with legal process or request; (b) enforce these TOS, including investigation of any potential violation thereof; (c) detect, prevent or otherwise address security, fraud or technical issues; or (d) protect the rights, property or safety of Apple, its users or the public as required or permitted by law.

I guess what this means is that if you have confidential documents, iCloud.com is not a sensible place to keep them.

I would like to see some way of disabling cloud sync for specified documents, but as far as I can tell there is no such feature yet.

Further, if your Apple ID is the same username and password that you use on dozens of other sites on which you have been required to register, it would be worth changing it to something long and unique. I would also suggest reviewing the insecurity questions, which are not for your protection, but to reduce the number of password reset requests which support have to deal with. The best answers are those which are not true and therefore potentially discoverable, but made-up ones, as essentially these are secondary passwords.

Apple iPad, Pages and Microsoft SharePoint – it works

I’ve been trying out an Apple iPad 2 recently, and one of the topics that interests me is the extent to which it can replace a laptop.

That is a nebulous question of course – it depends what you use a laptop for – but one essential from my perspective is the ability to create and edit documents. Therefore I installed Apple’s iWork apps in their iPad guise: Pages, Numbers and Keynote.

Now, one iPad annoyance is that accessing its storage is more awkward than with a laptop. You cannot simply copy files to and fro over a network. You can copy files to the iPad using a network browser app like Stratospherix FileBrowser, but that works by opening recognised file types.

As for Pages, how it stores documents is opaque to the user. They save as you type, and you can manage them in a My Documents view within Pages, but if you want to move them elsewhere you have to use one of five options: email, iWork.com which is cloud storage for iWork apps, send to iTunes for synchronization, copy to iDisk which is cloud storage for MobileMe, or copy to WebDAV.

image

The options for opening a document are similar, but without the email or for some reason iWork.com options.

None of these options appealed greatly, except possibly the last one. I use SharePoint, which supports WebDAV, might this enable me to open and save documents from Pages direct to SharePoint? This is convenient for me, since I have SharePoint as a mapped drive in Windows Explorer, and it works both on the internal network and over the internet.

I typed a document in Pages, then went to My Documents and chose Copy to WebDAV. I chose Word format. Then I entered the URL, username and password for my SharePoint server.

Rather to my surprise, it connected immediately, and performance was good. I then went to my mapped SharePoint drive in Windows Explorer and there it was.

image

It works the other way too. I typed a document in Word 2010 and saved it to SharePoint in the default .docx format. Pages can import .docx, and the document opened smoothly.

image

I appreciate that I am in a small minority of individuals running SharePoint – I do it for test and review – but for business users this is a handy feature. Individuals might want to check out DropDAV, though I’ve not tried the service.

Update: I have tried this successfully with both SharePoint 2010 and SharePoint 2007. If SharePoint is using a port other than 443 for secure access, then you enter the full URL in Pages, for example https://sharepoint.yourdomain.com:444

However I have not yet been able to get this to work with SharePoint in Office 365.