Search on iCloud.com security
Overview
Search on iCloud.com allows iCloud web applications—such as iCloud Drive and Photos—to search a user’s synced iCloud files from a web session on iCloud.com. This search uses the local index on a user’s iPhone, iPad, or Mac, enabling search from iCloud.com without needing to make an index available on iCloud servers. Search on iCloud.com uses multiple layers of cryptographic authentication, session binding, and user consent to protect access to the on-device index, and is further protected by the following policies:
No search query will be executed on a device without the user explicitly opting in.
No results are returned unless the device independently authorizes the requesting search on iCloud.com session.
The connection is scoped to access only index data for files synced across iCloud. Local-only files aren’t accessible.
Search on iCloud.com requires iCloud two-factor authentication, and isn’t available for Managed Apple Accounts.
Mutual authentication
Before a Search on iCloud.com session can communicate with a device, a cryptographic pairing key needs to be established between the web browser used for the session and the device that grants access to the index. A device accepts a pairing key only after the user approves on the device. Apple’s servers can’t authorize a pairing on the user’s behalf, and never learn the pairing key that results. In the browser, the pairing key is held as a non-extractable key object in secure browser storage, which helps prevent any code on the page from reading the raw key material. On the device, the pairing key is stored locally, isn’t synchronized to iCloud, and is excluded from device backups.
After a pairing key is established, the web browser and the device perform a mutual cryptographic handshake, proving to each other that they hold the same key. Until this handshake succeeds, the device won’t process any search requests. The pairing key is bound to the browser session it was created for and to the user’s Apple Account, so it can’t be used from a different browser or web session, or if either side signs in to a different Apple Account.
The web browser periodically requests a token from Apple’s servers that confirms the session is signed in to the user’s Apple Account and is the same session the pairing key was bound to. The web browser sends this token to the device, which verifies it with Apple’s servers before answering that session’s search requests for the next five minutes. After the web browser signs out, Apple’s servers no longer issue tokens for it, so the device soon stops answering.
If the user has chosen to trust the browser, the pairing key can be reused across sign-ins for as long as that browser remains trusted.
Note: All pairing keys expire after 90 days.
Message transport
All messages are sent using existing IDS protections including end-to-end encryption. On the device, incoming messages are subject to additional validation against the user’s Apple Account, checked for freshness to help prevent replay, and rate-limited to help prevent flooding.
Device-side security controls
The search daemon operates in a sandbox on iOS, iPadOS, and macOS with entitlement-based access control. Before processing any search request, the daemon validates the following:
The Apple Account uses two-factor authentication.
The user has explicitly turned on web search in their account settings.
The device has been unlocked at least once since it was restarted.
The device isn’t in Lockdown Mode.
Search queries are executed against files synced to iCloud only, and only metadata—such as file names and types—is returned. Files are then fetched from iCloud servers. The device displays a notification when the first web search—within a 24 hour period—is performed. This provides users awareness of when their device is being used to fulfill searches. Every query is logged to a local history that users can review and export in iCloud settings. and the user can also turn off web search from their device at anytime.
Important: Apple servers never have access to the content of queries or results, as all communication between the browser and device is end-to-end encrypted.