2

I'm basing this question off the iOS Security Guide.

If I understand this correctly, when you enlist in iMessage, the private key stays on your device, while the public key is pushed to a directory service. Since iMessage supports multiple devices, couldn't Apple just push their public key onto your account, so that when it syncs, it could also sync to one of their devices as well?

2
  • 2
    with non-open-source software, you can't really ever be sure of what the application is doing.
    – dandavis
    Jun 21, 2018 at 5:12
  • 1
    And with Open source you can be theoretically sure, but only actually sure if you personally review the code (including all the supporting libraries) that is then used to create the binary. Jun 21, 2018 at 11:11

2 Answers 2

7

If you make use of Apple's iMessage service then you are implicitly trusting Apple, as they wrote all the code that you are running and therefore could make it do anything they want it to.

So either you believe their statements, in which case iMessages are encrypted end-to-end and all is well, or you don't trust them and you should probably not use iMessage.

1
  • 1
    I think "in which case no iMessages are encrypted end-to-end" could be easier to parse. Maybe "no; iMessages..." or "iMessages are encrypted end-to-end, so Apple can't read them"
    – user123931
    Jun 20, 2018 at 21:05
0

Yes, they can be read, see Forbes article: https://www.forbes.com/sites/zakdoffman/2021/05/15/how-to-stop-apple-reading-your-imessages-on-your-iphone-ipad-mac/?sh=6b024b317777

As Apple confirms, “Apple retains the [iCloud] encryption keys in its U.S. data centers. iCloud content, as it exists in the customer’s account, may be provided in response to a search warrant issued upon a showing of probably cause, or customer consent.”

...

If you enable the generic iCloud Backup on your Apple devices, then Apple will store a copy of your iMessage end-to-end encryption key within your backup. It’s like locking your front door but leaving a key visibly hanging from a hook inside, just in case of emergencies. Pointless.

If you disable the generic iCloud backup, then Apple will then cut you a new iMessage end-to-end encryption key, and it will not have a copy, as Apple explains, “a new key is generated on your device to protect future messages and isn't stored by Apple. “Just like Signal, if anyone comes calling for your content, it’s not available.

1
  • 2
    So, yes, they can, if certain conditions apply. Please make sure that you include the relevant details and context. Because "yes they can" is technically wrong.
    – schroeder
    Mar 31, 2023 at 7:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .