Can users edit their own private data in CloudKit

Question

I like CloudKit for many reasons:

• a pull based approach, makes me confident, that I receive the most recent data;
• unlike iCloud key value store, the CloudKit data is never erased after the user removed the application from his devices.

With all that beauty the data is also shared between devices of the same user, without any logins and user management, that I should care about.

There are many cases how I can use it, some of them relay on the fact, that the data is only accessible to the application, and it cannot be modified or copied by the user. Example of that could be consumable in-app purchases, such that I can store all the purchases in CloudKit and they will be shared across devices of the same user.

So the actual question is:

Can a user without a jailbroken device somehow modify his CloudKit data outside the app?

I believe that jailbreak will allow him to do many things, including replacement of CloudKit methods, but what about ordinary users?

Encryption could be a solution to protect the data, but it doesn’t protect from copying data, for example, a user can share his records with another user and that different user will get what he is not supposed to have.

It seams that apple took a great care to make that impossible. I listened some of communication between device and CloudKit and found, that they use protobuf for communication, which is opened standard, but not comprehensive without definition of messages. Also I it seems, that each request is signed, using current time and request identifier. However, all of that is only my guesses and probably there are plenty of ways to work it around.

Answer 1

Short answer - No, a user without a jailbroken device can not modify their CloudKit data outside of the app.

Apple does not give non-developer users access to any data that apps store in their iCloud account via CloudKit.

And developers only have access to data stored in the public database or their own data stored in their private database and only for their app containers.