Advanced Data Protection = private db access disabled for this account.

[Xaositek]

Overview

With the update to iOS 16.2 and enabling Advanced Data Protection; this will immediately break icloudpd with the following error.

Steps to Reproduce

1. Enable Advanced Data Protection with iOS 16.2
2. Attempt to perform a download (or re-initialize)
3. Observe: private db access disabled for this account. Please wait a few minutes then try again. The remote servers might be trying to throttle requests. (ACCESS_DENIED)

Expected Behavior

Photos are still able to be downloaded or a warning is prepared to know that iOS 16.2's Advanced Data Protection may break this application

Actual Behavior

The given statement implies throttling and this issue may auto-clear which is not correct....
private db access disabled for this account. Please wait a few minutes then try again. The remote servers might be trying to throttle requests. (ACCESS_DENIED)

[txwireless]

So I’ve been trying to work through the shared libraries issues and haven’t enabled advanced data protection yet and I see this same error when I use the shared endpoint.

[joshspicer]

+1 on this. It would be awesome if there were a solution to this so that folks don't have to decide between using the strongest security Apple offers and this tool to create offline backups.

[boredazfcuk]

+1 on this. It would be awesome if there were a solution to this so that folks don't have to decide between using the strongest security Apple offers and this tool to create offline backups.

ADP and iCloud Photos downloader are incompatible and there is no workaround.

iCloud Photos downloader uses the iCloud.com website to download the photos. ADP disables access to your photo stream via iCloud.com.

[GuardedAirplane]

+1 on this. It would be awesome if there were a solution to this so that folks don't have to decide between using the strongest security Apple offers and this tool to create offline backups.

ADP and iCloud Photos downloader are incompatible and there is no workaround.

iCloud Photos downloader uses the iCloud.com website to download the photos. ADP disables access to your photo stream via iCloud.com.

That was what I was thinking as well. Probably your best bet in terms of cost would be to spin up a macOS vm, but long term I suspect having a dedicated Mac is the only way to backup photos to a local disk automatically.

[vistalba]

Sad to hear about that. I thought there should be a possibility (other than icloud.com) as Mac and also iCloud for Windows are still working and can gain access to the files. So from my point of view there should be a possibility to access the filed. But they will be encrypted. So the cliend must take care for decrypting the content after downloading.

Any plan to investigate in this?

[nihelmasell]

Hi, there seems to be a way to turn on iCloud access for an hour, despite having Advanced Data Protection for iCloud turned on.

https://support.apple.com/en-us/HT212523

"Web access and Advanced Data Protection for iCloud
If you turn on Advanced Data Protection for iCloud, web access to your data at iCloud.com is automatically turned off to ensure that your data is available only on your trusted devices. If you’d like to access your data on iCloud.com, you need to first turn on web access. Then each time you want to access your iCloud data, you’ll use one of your trusted devices to approve temporary access.

To access your iCloud data on the web:
Turn on Access iCloud Data on the Web.
Sign in to iCloud.com using your Apple ID and password.
Use your trusted device to approve temporary access to your data.
After you approve access from your trusted device, you can access your data at iCloud.com for the next hour. Each time you access a new category of data — such as photos, notes, or files — you’ll be asked to approve that access from your trusted device. Some data isn’t available on iCloud.com, such as Health data and passwords in iCloud Keychain."

Can there be a workaround for this scenario? I guess one hour would suffice to update data. And if not, you can just repeat the procedure.

[trnghsrt]

The developer of this pyicloud-inspired JS library seems to have found a workaround but re-opened the ticket later (foxt/icloud.js#4).

[nihelmasell]

The developer of this pyicloud-inspired JS library seems to have found a workaround but re-opened the ticket later (foxt/icloud.js#4).

Amazing! I hope It can be implemented here some day.

[BRFud]

Hello. Could this issue be reopened (understanding there is perhaps a possibility for clients to work with account ADP enabled)? As with others, I'd like to enable ADP if possible but my reliance on using icloud_photos_downloader prevents it.

[boredazfcuk]

From the Apple website:

Advanced Data Protection and iCloud.com web access

When a user first turns on Advanced Data Protection, web access to their data at iCloud.com is automatically turned off. This is because iCloud web servers no longer have access to the keys required to decrypt and display the user’s data. The user can choose to turn on web access again, and use the participation of their trusted device to access their encrypted iCloud data on the web.
After turning on web access, the user must authorise the web sign-in on one of their trusted devices each time they visit iCloud.com. The authorisation “arms” the device for web access. For the next hour, this device accepts requests from specific Apple servers to upload individual service keys, but only those corresponding to an allow list of services normally accessible on iCloud.com

So it seems that there is a way of re-enabling iCloud.com access with ADP enabled, but with manual approval required and only for an hour at a time.

I, like many others, use icloud_photos_downloader as an automated backup tool and I personally backup photos every 4 hours. Apple's requirement of an hourly authorisation approval would essentially make using icloud_photos_downloader a manual task. My current workflow would require 6 authorisations per day, with a minimum of 1 occurring whilst I am asleep.

I've seen users of my container complaining that they have to re-authenticate their multi-factor authentication token once every 90-days.

Saying that, I have 2-way comms enabled in my container. So I can remotely instruct icloud_photos_downloader to perform a backup run. If ADP was supported, I could change my container to only perform downloads when remotely instructed. At which point, I could also approve the access for an hour.

[avt00]

Adding this feature would be great! Even running it manually is better than having no backup at all.

[ckurdziel]

+1 for adding this feature as described above. Even a manual backup this way would be great to have.

[functionaldude]

+1 for adding this feature as described above for manual backups