Why does Mail app contact iCloud when sending a non-iCloud email?

74 pointsposted 5 hours ago
by cdrnsf
(lapcatsoftware.com)

37 Comments

transcriptase

3 hours ago

Fun activity: install glasswire on windows for a day or 2, set it to prompt you before any connection is allowed, and watch as about 500 different windows components attempt connections with Microsoft as a result of any and every action. And how many onedrive exes randomly fire off throughout the day despite having never once used it. And how onedrive changes its version number every day when it realizes it can’t connect.

dd8601fn

an hour ago

You’re giving me ptsd of LittleSnitch + any Adobe (or microsoft) product.

You seriously can’t even use the machine without blanket, permanent approvals… the endless flood of network requests is paralyzing.

tengwar2

18 minutes ago

MS Office doesn't need permanent approval. I have Excel, Word, Powerpoint, Autoupdate and Update Assistant blocked from making any outgoing connection (on MacOS). That works for about a month, then I have to unblock briefly to let the licence check work. I don't use Adobe these days.

dylan604

2 hours ago

OneDrive is the most annoying of all the apps I never use that was installed alongside an app that I do use. Thankfully, I have now blocked it from notifying me that it can no longer connect to the mother ship.

gumby

an hour ago

Office apps no longer autosave unless you have OneDrive installed. So no autosave for me! Instead I save compulsively lie the days of floppy disk PCs.

(Meanwhile Emacs has had autosave since at least 1977)

2Gkashmiri

40 minutes ago

Older office 2019 or 21 I think with massgrave.

Libreoffice.

I'm more and more relying less on office nowadays.

bigyabai

2 hours ago

Pack-in slopware and it's consequences have been a disaster for the desktop operating system duopoly.

speak_plainly

3 hours ago

Probably Handoff and cross-device application state syncing.

artisinal

3 hours ago

Most likely answer so far. While writing an email you can take it over between iPhone, iPad and Mac. Once you hit send it probably gives a “you can stop Handoff now” signal.

gumby

an hour ago

Why would a local facility like handoff need to talk to the mother ship?

lapcat

2 hours ago

I've disabled Handoff.

Also, why would Handoff be triggered by sending an email rather than composing an email? Mail app uses IMAP for syncing mailboxes.

kridsdale1

3 hours ago

One Apple Mail feature nobody here has commented on was called Piano Mover internally. I don’t know the public marketing name. It lets attachments over 10MB in emails be replaced with iCloud hosted file references.

pinkyboy

2 hours ago

the marketing name is "Mail Drop", and it is separate from iCloud mail; though it should only fire if there's a 20mb+ attachment on the email.

cloudd is used by a shit-ton of services though, so I'm not sure how to track it down without better tracing of what actually initiated the call, or the contents of the call.

edit: tomasf nailed it - https://news.ycombinator.com/item?id=49158388

Onavo

2 hours ago

I think every major email hosting provider (that's not a dumb IMAP only platform) has some variant of this.

bantunes

3 hours ago

I assume for the same reason the OS pings Cupertino when you run a binary - surveillance, masquerading as protection.

SoftTalker

3 hours ago

Yes, the safe assumption is that Apple reads all your mail. Not that any other provider is better---most are probably worse.

bantunes

3 hours ago

I don't think they read all of it. Probably just metadata. But would be good to know what's being sent.

iAMkenough

an hour ago

Assume their AI agent now file system indexer is reading all your email on their behalf.

zikduruqe

3 hours ago

For a company who hangs their hat on privacy, it is a dang shame that their native mail client can't support PGP/GnuPG. I mean it'll do S/MIME, but who uses that regularly.

Barbing

2 hours ago

Why’s this post below an older less popular one? https://i.ibb.co/jnpcFJz/IMG-0549.jpg

stronglikedan

an hour ago

because rankings take other things into account, such as the time of the post

Barbing

15 minutes ago

Time of day? (It’s newer than a lesser commented, less voted one above - at top of screenshot.)

Barbing

3 hours ago

Jeff Johnson is an Apple privacy information hero and deserves every penny for his apps like StopTheMadness https://underpassapp.com/StopTheMadness

gumby

an hour ago

I agree, though I don’t think it’s relevant to this post.

Barbing

13 minutes ago

Fair! Hope some appreciated context around author credibility nonetheless.

Also if you care about the post and its implications, you’re the target market for the app. Course these kinds of defenses are still tangential and one could stretch annoyingly.

zer0zzz

3 hours ago

Everyone wearing their tinfoil hat while using Gmail and drive for everything

lapcat

2 hours ago

> while using Gmail and drive for everything

I don't.

zer0zzz

2 hours ago

You’d be in the minority.

lapcat

2 hours ago

I'd also be the author of the submitted article.

zer0zzz

2 hours ago

I admire your work greatly then. I definitely appreciate uncovering this sort of telemetry, but I feel the reaction from some may be a little more Tin-foil-hatted for my taste. I do thank you for doing the work though!

I also applaud you for not using the mainstream thing. That’s good too.

tomasf

2 hours ago

It's previous recipients synced over iCloud.

Run this and then send an email to see it: log stream --predicate 'subsystem == "com.apple.cloudkit"' --info --debug

pinkyboy

14 minutes ago

Verified - and the actual payload to the iCloud endpoint is e2e encrypted ciphertext.