5 ms·

> It also tricks the sender into thinking that their secure iMessage conversations are what they look like. If you send a message to someone, you are assuming

> It also tricks the sender into thinking that their secure iMessage conversations are what they look like. If you send a message to someone, you are assuming that anything can happen to it unless you have a legal agreement to the contrary. They could have a keylogger (malware or device-management), someone looking over their shoulder, take a screenshot, forget to sign out of the library computer, etc. The end-to-end-encryption on iMessage gets defeated for most people anyway if they have iCloud Backup on.

bredren 6y ago
You are right, this has always been true with taking a photo of a screen and printing it out on your printer. This defeats any truly end-to-end encrypted conversation. I think you are also right to compare this service to malware. It takes content intended for a secured environment maintained by one party and exfiltrates it into another. This other environment is protected by an entity that is neither bound by the reputation damage of failing to keep the information secure, nor on the receiving end of funds that can be directed to keep it secure. Since 100% of the iMessage content, text and photos flows through this environment, it is not like occasionally taking photos of conversations. It is the wholesale duplication of the data. iCloud Backups are also encrypted, and are the security of that system is maintained by the first party the conversations were originally sent by.
jiofih 6y ago
> The end-to-end-encryption on iMessage gets defeated for most people anyway if they have iCloud Backup on. iCloud backups are encrypted using a unique key which is only unlockable with the user password, which is itself protected in hardware. So no, it doesn’t defeat the purpose.
- pseudalopex 6y ago
  Syncing messages through iCloud uses end to end encryption. Backups don't.[1] [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - jiofih 6y ago
    Keep reading: > Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple.
    - pseudalopex 6y ago
      Messages in iCloud and iCloud Backup are different features. That says Apple has the key as long as iCloud Backup is on.
      - sneak 6y ago
        This is exactly correct. Apple engineered that page to read to people who are scanning quickly that "it's encrypted, it's fine" when in fact iCloud Backup, which includes complete plaintext message history (and SMS history too, which Apple normally would not see, plus all iMessage/SMS attachments like photos and videos) is NOT end to end encrypted but encrypted with Apple keys, and can be decrypted by Apple at any time without the user's device or password. It's perhaps the most shady thing they do. Nothing on that page is a lie, yet if you read it without an intimate knowledge of Apple's services ("iCloud", vs "Messages in iCloud", vs "iCloud Backup") you will get an impression of the opposite of what is true. Additionally, they were going to e2e encrypt backups, but the FBI asked them not to, and so they didn't, and Apple and the FBI can read every message in every backup without a warrant.
        bredren 6y ago
        > the FBI can read every message in every backup without a warrant. Under what legal framework could this be possible?
        sneak 6y ago
        It's Section 702 of the FISA Amendments Act, aka FAA702, cited in Apple's transparency report as FISA (they turned over 30,000+ users' data without a warrant in 2019), and better known to the general public by its internal NSA codename of PRISM, thanks to Ed Snowden telling us that this is the primary, #1 source of information used by NSA spies. Apple wasn't lying when they said they "had never heard of PRISM"—until Snowden, it was not known by that name outside of the NSA/IC. It is regularly used against US users, in the US, as well as people in other countries. Snowden cited this use (resulting from a classified, private interpretation of FAA702 made by the classified FISA court) against US citizens as one of his main reasons for going public in the summer of 2013 with the fact that this is happening. https://www.eff.org/702-spying https://www.eff.org/702-spying https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008 https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveil... https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)

bredren 6y ago

You are right, this has always been true with taking a photo of a screen and printing it out on your printer. This defeats any truly end-to-end encrypted conversation. I think you are also right to compare this service to malware. It takes content intended for a secured environment maintained by one party and exfiltrates it into another. This other environment is protected by an entity that is neither bound by the reputation damage of failing to keep the information secure, nor on the receiving end of funds that can be directed to keep it secure. Since 100% of the iMessage content, text and photos flows through this environment, it is not like occasionally taking photos of conversations. It is the wholesale duplication of the data. iCloud Backups are also encrypted, and are the security of that system is maintained by the first party the conversations were originally sent by.

jiofih 6y ago

> The end-to-end-encryption on iMessage gets defeated for most people anyway if they have iCloud Backup on. iCloud backups are encrypted using a unique key which is only unlockable with the user password, which is itself protected in hardware. So no, it doesn’t defeat the purpose.

pseudalopex 6y ago
Syncing messages through iCloud uses end to end encryption. Backups don't.[1] [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- jiofih 6y ago
  Keep reading: > Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple.
  - pseudalopex 6y ago
    Messages in iCloud and iCloud Backup are different features. That says Apple has the key as long as iCloud Backup is on.
    - sneak 6y ago
      This is exactly correct. Apple engineered that page to read to people who are scanning quickly that "it's encrypted, it's fine" when in fact iCloud Backup, which includes complete plaintext message history (and SMS history too, which Apple normally would not see, plus all iMessage/SMS attachments like photos and videos) is NOT end to end encrypted but encrypted with Apple keys, and can be decrypted by Apple at any time without the user's device or password. It's perhaps the most shady thing they do. Nothing on that page is a lie, yet if you read it without an intimate knowledge of Apple's services ("iCloud", vs "Messages in iCloud", vs "iCloud Backup") you will get an impression of the opposite of what is true. Additionally, they were going to e2e encrypt backups, but the FBI asked them not to, and so they didn't, and Apple and the FBI can read every message in every backup without a warrant.
      - bredren 6y ago
        > the FBI can read every message in every backup without a warrant. Under what legal framework could this be possible?
        sneak 6y ago
        It's Section 702 of the FISA Amendments Act, aka FAA702, cited in Apple's transparency report as FISA (they turned over 30,000+ users' data without a warrant in 2019), and better known to the general public by its internal NSA codename of PRISM, thanks to Ed Snowden telling us that this is the primary, #1 source of information used by NSA spies. Apple wasn't lying when they said they "had never heard of PRISM"—until Snowden, it was not known by that name outside of the NSA/IC. It is regularly used against US users, in the US, as well as people in other countries. Snowden cited this use (resulting from a classified, private interpretation of FAA702 made by the classified FISA court) against US citizens as one of his main reasons for going public in the summer of 2013 with the fact that this is happening. https://www.eff.org/702-spying https://www.eff.org/702-spying https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008 https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveil... https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)