3 ms·
probably the same loophole as the "end-to-end encryption" in iMessage. it's end-to-end, but the client is their close-source proprietary software, so if they n
by notatoad 5y ago
probably the same loophole as the "end-to-end encryption" in iMessage. it's end-to-end, but the client is their close-source proprietary software, so if they need access to the data they can just remotely access the client software that you've authenticated and access whatever they need to.
- jeromegv 5y agoThat’s not the iMessage loophole. The loophole is when you have iClouds backup enabled. They have access to it. Disable the backup, you disable the loophole.
- notatoad 5y agoMaybe something has changed or i'm missing something, but my understanding is that even without iCloud backup enabled, if you went through the "i forgot my password" process they could remotely generate a new key and create new copies of all your iMessages encrypted with the new key. Which is effectively replicating exactly the attack that e2e is supposed to protect against.
- MertsA 5y agoThat's not the only iMessage loophole. They also obscure key distribution and have the ability to add and remove keys that are ostensibly for your devices at will. Technically you can check in keychain but virtually no one even does that between their own devices, let alone share and verify out of band with every other party they communicate with. "E2E encrypted, we can't even read it, unless you use iCloud, or we get a NSL, or if we feel like being a MITM today".