3 ms·

So, seems that E2E is a total bullshit then?

nickburns 2y ago
Only if it's backdoored (or otherwise breakable).
sneak 2y ago
iMessage e2ee is bullshit because iCloud Backup e2ee is opt-in, and approximately 0% of Apple’s user base has turned it on, making iCloud Backup non-e2ee in practice. All of the iMessage access data (either the iMessages themselves or the iMessage sync key for “Messages in iCloud”) is stored in the non-e2ee iCloud Backup. This means that the iMessage service e2ee is meaningless because the iMessages themselves are not e2ee. Note well that turning on iCloud e2ee is insufficient, as everyone else that you iMessage with will still have it off, and all of your iMessages will still be backed up non-e2ee to Apple in their device backups. Having iCloud e2ee available is the best of both worlds for Apple: they can say that it’s available for privacy-conscious users to opt into, while still being able to turn over basically 100% of all iMessages to the feds whenever they ask.
- kdmtctl 2y ago
  Sorry. Didn't get it. So, if iMessages IS e2ee (supposedly) and someone properly makes iCloud backups e2ee (supposedly), how the Feds will break it? I do understand the counterpart party problem, it is not someone can control. Sent once, it's free to be seen by anyone.
  - nickburns 2y ago
    Nobody has suggested that anyone, Feds included, has the present technical capability to break any of the security levels that are in widescale E2EE usage today.
  - sneak 2y ago
    If both you and the iMessage counterparty both have e2ee enabled for iCloud Backup, it's unlikely at present that the feds can read the messages without a warrant under FAA702 "foreign" intelligence collection (which as we now know thanks to Snowden is routinely used against even Americans). With an actual warrant or wiretap order, there is no guarantee that Apple can't or won't insert additional endpoint keys into the conversation. But, that said, 99.9%+ of users don't have e2ee enabled for iCloud Backup, so the e2ee in iMessage is mostly irrelevant, and it's available in full to the feds at any time, no warrant required. tl;dr: use Signal.

Only if it's backdoored (or otherwise breakable).

iMessage e2ee is bullshit because iCloud Backup e2ee is opt-in, and approximately 0% of Apple’s user base has turned it on, making iCloud Backup non-e2ee in practice. All of the iMessage access data (either the iMessages themselves or the iMessage sync key for “Messages in iCloud”) is stored in the non-e2ee iCloud Backup. This means that the iMessage service e2ee is meaningless because the iMessages themselves are not e2ee. Note well that turning on iCloud e2ee is insufficient, as everyone else that you iMessage with will still have it off, and all of your iMessages will still be backed up non-e2ee to Apple in their device backups. Having iCloud e2ee available is the best of both worlds for Apple: they can say that it’s available for privacy-conscious users to opt into, while still being able to turn over basically 100% of all iMessages to the feds whenever they ask.

kdmtctl 2y ago
Sorry. Didn't get it. So, if iMessages IS e2ee (supposedly) and someone properly makes iCloud backups e2ee (supposedly), how the Feds will break it? I do understand the counterpart party problem, it is not someone can control. Sent once, it's free to be seen by anyone.
- nickburns 2y ago
  Nobody has suggested that anyone, Feds included, has the present technical capability to break any of the security levels that are in widescale E2EE usage today.
- sneak 2y ago
  If both you and the iMessage counterparty both have e2ee enabled for iCloud Backup, it's unlikely at present that the feds can read the messages without a warrant under FAA702 "foreign" intelligence collection (which as we now know thanks to Snowden is routinely used against even Americans). With an actual warrant or wiretap order, there is no guarantee that Apple can't or won't insert additional endpoint keys into the conversation. But, that said, 99.9%+ of users don't have e2ee enabled for iCloud Backup, so the e2ee in iMessage is mostly irrelevant, and it's available in full to the feds at any time, no warrant required. tl;dr: use Signal.