I'm basing this question off the iOS Security Guide.

If I understand this correctly, when you enlist in iMessage, the private key stays on your device, while the public key is pushed to a directory service. Since iMessage supports multiple devices, couldn't Apple just push their public key onto your account, so that when it syncs, it could also sync to one of their devices as well?

  • 2
    with non-open-source software, you can't really ever be sure of what the application is doing. – dandavis Jun 21 '18 at 5:12
  • 1
    And with Open source you can be theoretically sure, but only actually sure if you personally review the code (including all the supporting libraries) that is then used to create the binary. – Rоry McCune Jun 21 '18 at 11:11

If you make use of Apple's iMessage service then you are implicitly trusting Apple, as they wrote all the code that you are running and therefore could make it do anything they want it to.

So either you believe their statements, in which case iMessages are encrypted end-to-end and all is well, or you don't trust them and you should probably not use iMessage.

  • 1
    I think "in which case no iMessages are encrypted end-to-end" could be easier to parse. Maybe "no; iMessages..." or "iMessages are encrypted end-to-end, so Apple can't read them" – user123931 Jun 20 '18 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.