Comment by Barbing
21 hours ago
The teardown showed this is the 1% right?
Also I thought you could trust iMessage if, unlike everyone, you disabled iCloud backup (and, unlike everyone, so did the recipient). Perhaps a way for the feds to be able to pin dumb criminals while giving investigative journalists & dissidents a way to stay safer.
According to Apple, you can have iCloud backup enabled while maintaining E2E encryption with their Advanced Data Protection option:
https://support.apple.com/en-us/102651#advanced
You do have to be sure to not enable web access via icloud.com
You also have to make sure everyone you contact did this, which is impossible.
Much easier to use a 3rd party app like Signal.
Even with "E2E" encryption with iMessage, you're still trusting Apple completely and totally with key distribution. If a new device is added to your account by an attacker or by Apple themselves, your existing devices will happily loop them in to share iMessage access with them. The vast, vast majority of iMessage users are never going to dig into the Apple keychain app to actually check what keys are being trusted and this is something that can be targeted to a single account so no one outside of Apple never even needs to know it happened.
CKV aims to cover that case:
https://support.apple.com/en-us/118246
https://support.apple.com/en-us/118247
> An unrecognized new device was added to that person’s Apple Account. This alert might mean that the person you are messaging has an issue with one of their devices, or that a sophisticated attacker might be attempting to eavesdrop on the conversation.
My understanding is that iMessage implements PFS. To get around PFS and access older messages, one needs to get their hand on a backup, which needs fully enrolling a device, not just messaging key exchange hackery.
And as far as trusting Apple with key exchange, well, if you're running their OS and hardware, I suppose that trust of key exchange is the least of your concern (or part of the whole deal anyway depending on how you look at it)
Uh-oh, I have that turned off. I’m used to seeing a message when someone on Signal gets a new phone, but I’d be none the wiser with a snooper on iMessage. Any downsides to enabling you know of? Assuming all my logged-in devices are on a current/supported version.