4 ms·

I'd like to see a more comprehensive test to prove that the messages are part of the backup. Since you have to sign in to iMessage, it's possible that these ar

I'd like to see a more comprehensive test to prove that the messages are part of the backup. Since you have to sign in to iMessage, it's possible that these are being retrieved from the iMessage server in an encrypted form - "I restored an iPhone and saw old messages" is not proof that they are stored in plaintext. Also.. it's important to note that the iMessage client only retains about a day's worth of messages on the device. Earlier messages can be obtained via a "load earlier messages" button. This means that Apple does store the message history on the iMessage servers, and there is a way for the client to retrieve them in batches while the contents are not accessible to Apple. It seems extremely likely that this 'iCloud Backup' vulnerability is a red herring. The messages are not stored in the regular backup but are fetched encrypted by the client when you sign in.

dvanduzer 13y ago
That's not what's happening with the "load earlier messages" button at all. The long term iMessages history is stored in an unencrypted sqlite database on the phone (which is included, unencrypted, in local iTunes backups).
- r00fus 13y ago
  Local backups can be encrypted (mine are). Also it's not necessary to use cloud backups (I don't). Therefore, my iMessage history is secure (I fully understand that my message recipients may expose my individual messages, but my copy is safe).
  - dvanduzer 13y ago
    The fact that it is possible to perform encryption on the entire backup file does not change the fact that many people are (wrongly) speculating about things which are easily verifiable.
mannkind 13y ago
They're not loaded from the server but the sms.db (sqlite) database on your phone. Tools exist to read the database from the phone directly, from backups, etc. Which is great when you accidentally delete them... I wouldn't know that though. :)
fortepianissimo 13y ago
But what's the difference? Whether the messages are stored in plaintext, or whether they are stored as part of the iCloud backup, the author proved that Apple can get to them in order to restore your newly purchased phone.
- embolism 13y ago
  It matters because in one scenario Apple itself can't get to them - it can only restore them to your phone where they are decrypted using your password.

dvanduzer 13y ago

That's not what's happening with the "load earlier messages" button at all. The long term iMessages history is stored in an unencrypted sqlite database on the phone (which is included, unencrypted, in local iTunes backups).

r00fus 13y ago
Local backups can be encrypted (mine are). Also it's not necessary to use cloud backups (I don't). Therefore, my iMessage history is secure (I fully understand that my message recipients may expose my individual messages, but my copy is safe).
- dvanduzer 13y ago
  The fact that it is possible to perform encryption on the entire backup file does not change the fact that many people are (wrongly) speculating about things which are easily verifiable.

mannkind 13y ago

They're not loaded from the server but the sms.db (sqlite) database on your phone. Tools exist to read the database from the phone directly, from backups, etc. Which is great when you accidentally delete them... I wouldn't know that though. :)

fortepianissimo 13y ago

But what's the difference? Whether the messages are stored in plaintext, or whether they are stored as part of the iCloud backup, the author proved that Apple can get to them in order to restore your newly purchased phone.

embolism 13y ago
It matters because in one scenario Apple itself can't get to them - it can only restore them to your phone where they are decrypted using your password.