5 ms·

> The end-to-end-encryption on iMessage gets defeated for most people anyway if they have iCloud Backup on. iCloud backups are encrypted using a unique key whi

by jiofih 6y ago

> The end-to-end-encryption on iMessage gets defeated for most people anyway if they have iCloud Backup on. iCloud backups are encrypted using a unique key which is only unlockable with the user password, which is itself protected in hardware. So no, it doesn’t defeat the purpose.

pseudalopex 6y ago
Syncing messages through iCloud uses end to end encryption. Backups don't.[1] [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- jiofih 6y ago
  Keep reading: > Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple.
  - pseudalopex 6y ago
    Messages in iCloud and iCloud Backup are different features. That says Apple has the key as long as iCloud Backup is on.
    - sneak 6y ago
      This is exactly correct. Apple engineered that page to read to people who are scanning quickly that "it's encrypted, it's fine" when in fact iCloud Backup, which includes complete plaintext message history (and SMS history too, which Apple normally would not see, plus all iMessage/SMS attachments like photos and videos) is NOT end to end encrypted but encrypted with Apple keys, and can be decrypted by Apple at any time without the user's device or password. It's perhaps the most shady thing they do. Nothing on that page is a lie, yet if you read it without an intimate knowledge of Apple's services ("iCloud", vs "Messages in iCloud", vs "iCloud Backup") you will get an impression of the opposite of what is true. Additionally, they were going to e2e encrypt backups, but the FBI asked them not to, and so they didn't, and Apple and the FBI can read every message in every backup without a warrant.
      - bredren 6y ago
        > the FBI can read every message in every backup without a warrant. Under what legal framework could this be possible?
        sneak 6y ago
        It's Section 702 of the FISA Amendments Act, aka FAA702, cited in Apple's transparency report as FISA (they turned over 30,000+ users' data without a warrant in 2019), and better known to the general public by its internal NSA codename of PRISM, thanks to Ed Snowden telling us that this is the primary, #1 source of information used by NSA spies. Apple wasn't lying when they said they "had never heard of PRISM"—until Snowden, it was not known by that name outside of the NSA/IC. It is regularly used against US users, in the US, as well as people in other countries. Snowden cited this use (resulting from a classified, private interpretation of FAA702 made by the classified FISA court) against US citizens as one of his main reasons for going public in the summer of 2013 with the fact that this is happening. https://www.eff.org/702-spying https://www.eff.org/702-spying https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008 https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveil... https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)
        bredren 6y ago
        Okay, I am familiar with prism. However, the context of this thread is to compare the relative security of Apple iMessage and iCloud backups with what happens to those messages when they are exfiltrated by Beeper. I do not see the existence of Prism belying the practical expectation of security Apple users get from iCloud and iMessage. It doesn’t make the point that beeper’s service has a similar level of security. But to your point, some apple iMessage users will unknowingly have their data shared with a third party if the recipient is using beeper and doesn’t tell them. Which makes having a friend quietly using beeper a bit like having a prism inquiry.
        danShumway 6y ago

by jiofih 6y ago

pseudalopex 6y ago

Syncing messages through iCloud uses end to end encryption. Backups don't.[1] [1] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

jiofih 6y ago
Keep reading: > Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple.
- pseudalopex 6y ago
  Messages in iCloud and iCloud Backup are different features. That says Apple has the key as long as iCloud Backup is on.
  - sneak 6y ago
    This is exactly correct. Apple engineered that page to read to people who are scanning quickly that "it's encrypted, it's fine" when in fact iCloud Backup, which includes complete plaintext message history (and SMS history too, which Apple normally would not see, plus all iMessage/SMS attachments like photos and videos) is NOT end to end encrypted but encrypted with Apple keys, and can be decrypted by Apple at any time without the user's device or password. It's perhaps the most shady thing they do. Nothing on that page is a lie, yet if you read it without an intimate knowledge of Apple's services ("iCloud", vs "Messages in iCloud", vs "iCloud Backup") you will get an impression of the opposite of what is true. Additionally, they were going to e2e encrypt backups, but the FBI asked them not to, and so they didn't, and Apple and the FBI can read every message in every backup without a warrant.
    - bredren 6y ago
      > the FBI can read every message in every backup without a warrant. Under what legal framework could this be possible?
      - sneak 6y ago
        It's Section 702 of the FISA Amendments Act, aka FAA702, cited in Apple's transparency report as FISA (they turned over 30,000+ users' data without a warrant in 2019), and better known to the general public by its internal NSA codename of PRISM, thanks to Ed Snowden telling us that this is the primary, #1 source of information used by NSA spies. Apple wasn't lying when they said they "had never heard of PRISM"—until Snowden, it was not known by that name outside of the NSA/IC. It is regularly used against US users, in the US, as well as people in other countries. Snowden cited this use (resulting from a classified, private interpretation of FAA702 made by the classified FISA court) against US citizens as one of his main reasons for going public in the summer of 2013 with the fact that this is happening. https://www.eff.org/702-spying https://www.eff.org/702-spying https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008 https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveil... https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)
        bredren 6y ago
        Okay, I am familiar with prism. However, the context of this thread is to compare the relative security of Apple iMessage and iCloud backups with what happens to those messages when they are exfiltrated by Beeper. I do not see the existence of Prism belying the practical expectation of security Apple users get from iCloud and iMessage. It doesn’t make the point that beeper’s service has a similar level of security. But to your point, some apple iMessage users will unknowingly have their data shared with a third party if the recipient is using beeper and doesn’t tell them. Which makes having a friend quietly using beeper a bit like having a prism inquiry.
        danShumway 6y ago