What "encrypted on your iPhone" really means
Scrambled, not hidden
Hiding a picture only moves it out of sight. Encrypting it changes the picture itself into data that looks like noise. Without the key, there's nothing to see, even if someone has the file. Think of a letter written in a code that only you have the book for, instead of a letter in a drawer.
What "on your iPhone" adds
Encryption can happen in two places: on your phone, or on a company's computer after your picture has been sent there. FirstHour does it on your phone. The result is stored on your phone as well.
- FirstHour makes a random key for your Vault. It's made on your iPhone, and it's never stored in a readable form.
- Each picture, video, file, note and preview is sealed with that key using AES-256-GCM.
- The key is locked in turn, twice: once by a key made from your pattern or PIN, and once by a key made from your recovery phrase.
- Where it can, your iPhone's chip joins in. Your pattern or PIN is tied to the Secure Enclave, so guesses can only be made on your iPhone.
A second layer from iPhone itself
FirstHour also asks iPhone to give the Vault's files its strongest file protection. Apple says that with this kind of protection, shortly after the iPhone locks, the key that opens those files is thrown away, and they stay out of reach until you unlock again with your passcode or Face ID. That's a protection from iPhone, on top of FirstHour's own.
What stays on your iPhone
- The Vault's files aren't uploaded anywhere by FirstHour, and they're left out of iCloud and computer backups.
- The locked key is stored in your iPhone's Keychain (its protected store for passwords and keys), set to stay on this iPhone only.
- Your pattern or PIN isn't stored at all. It's used to make a key each time, then forgotten.
What it doesn't mean
- It doesn't mean unbreakable. Nobody should promise that. Pictures are usually exposed by guessed codes, watched screens and unlocked phones, not by cracking the scrambling.
- An open Vault is readable. While you're in it, FirstHour has to unscramble what you look at, and anyone looking at your screen sees it.
- Face ID can't open the Vault. It uses its own pattern or PIN, so someone who has your iPhone passcode still can't walk in. Here's why.
- The recovery phrase doesn't use the chip. That's why it needs to be hard to guess, and why a backup file is protected by the phrase alone.
- Some temporary unlocked copies exist. To show most files, or to save or share a file or note, FirstHour makes one temporary copy and removes it afterwards. A file sent from another app waits unlocked until it's sealed or removed.
- Your iPhone may download pictures from your iCloud so the picture check can read them. That's separate from the Vault.
- Pictures still in Photos aren't encrypted by FirstHour. Only the copy in the Vault is.
- No outside audit yet. The Vault has had FirstHour's own security checks, but not an independent one.
Questions
Is it the same as iPhone's own encryption?
No. iPhone has its own built-in file protection, called Data Protection, which works with your passcode. FirstHour's Vault is a second, separate lock with its own key, so your iPhone passcode alone doesn't open it.
What happens to the Vault if I lose my iPhone?
It's gone with it, unless you saved an encrypted backup file and kept your recovery phrase. Read this before you delete FirstHour.
Sources
- Data Protection classes, Apple Platform Security
- Encryption and Data Protection overview, Apple Platform Security
- The Secure Enclave, Apple Platform Security