> as Safari does exactly the same thing

Source? I thought Safari downloaded the Google Safe Browsing database (using the "Update API" described at https://developers.google.com/safe-browsing/v4/#update-api-v...) to do client-side checks.

I believe it does, though I have not been able to find a definitive source as to whether it is used in online or offline modes.

Safari does the same for an unrelated feature: iCloud tabs

iCloud data is e2e encrypted. Apple can't tell what tabs you have open.

Not all iCloud Data is E2E encrypted, most iCloud services actually work on the web if you go to icloud.com. In fact E2E encrypted services are still the exception, not the rule: https://support.apple.com/de-de/HT202303

It's frustrating that Apple does not let users disable iCloud tabs without also disabling bookmarks and the reading list (which I am fine with being synced on US servers).

Workaround: Toggle mobile Safari into private browsing mode and use apps for everything that needs a login, use private browsing mode most of the time on macOS :/

> most iCloud services actually work on the web if you go to icloud.com

This is not evidence of a lack of E2E. Your browser can be an "end", with a key derived from your login.

Much of the details of iCloud's security is not a secret, and can be found in the iOS Security PDF:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Point taken, it could be E2E on the web. It seem it's just a "classic" web app though.

From both the PDF and the KB article, I don't see any indication that iCloud tabs are E2E encrypted? I'd love to be wrong :)

(Oops, I've linked to the German version; English overview here: https://support.apple.com/en-us/HT202303)

Last I checked, Siri's privacy policy was very clear about the fact that Siri data is used only to improve Siri. I was pretty surprised to find that; maybe I read it wrong.