2 ms·

They backup the private key to iCloud unless you manually disable backups. So even though iMessage is advertised as E2E encrypted, for the vast majority of user

They backup the private key to iCloud unless you manually disable backups. So even though iMessage is advertised as E2E encrypted, for the vast majority of users, Apple can read each and every message. (And even if you disable backups, Apple can still read most if not all of your messages, because the persons on the other side of the conversations have not disabled backups)

catlifeonmars 6y ago
Can Apple read your iCloud storage? I’m not saying that it is, but shouldn’t that be encrypted at rest with a customer-specific key?
- EwanToo 6y ago
  I don't have any detailed knowledge of it, but I've seen various similar comments based on this article and similar ones: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- claudeganon 6y ago
  Yeah, they can read everything: https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ They were going to actually encrypt it, but suddenly had a change of heart after the FBI had a chat with them: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - catlifeonmars 6y ago
    Ugh
tlburke 6y ago
It's worth noting that Google, the big bad guys of privacy, uses a proper E2E encryption scheme.
- olliej 6y ago
  iMessages is e2e encrypted, so I’m not sure what you’re saying here
Spivak 6y ago
This stance undermines the point of E2E. The messaging system is still E2E even if people backup their plaintext messages or their key on non-E2E storage. Having you messages deleted because you forgot your iCloud password is good security but a terrible default.

catlifeonmars 6y ago

Can Apple read your iCloud storage? I’m not saying that it is, but shouldn’t that be encrypted at rest with a customer-specific key?

EwanToo 6y ago
I don't have any detailed knowledge of it, but I've seen various similar comments based on this article and similar ones: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
claudeganon 6y ago
Yeah, they can read everything: https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/ They were going to actually encrypt it, but suddenly had a change of heart after the FBI had a chat with them: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- catlifeonmars 6y ago
  Ugh

tlburke 6y ago

It's worth noting that Google, the big bad guys of privacy, uses a proper E2E encryption scheme.

olliej 6y ago
iMessages is e2e encrypted, so I’m not sure what you’re saying here

Spivak 6y ago

This stance undermines the point of E2E. The messaging system is still E2E even if people backup their plaintext messages or their key on non-E2E storage. Having you messages deleted because you forgot your iCloud password is good security but a terrible default.