As far as I'm aware, iCloud for Messages is not enabled by default. Security-conscious users should know not to turn it on, though -- if iCloud servicing warrants is part of their threat model.

Further, Apple ended up rolling out Advanced Data Protection for iCloud in 2023, so users who truly don't want Apple holding those keys can effectively take them from Apple.

https://support.apple.com/guide/security/advanced-data-prote...

EDIT: Just confirmed with a test device and test apple id, iCloud for Messages is not enabled on it.

Messages in iCloud is separate from the inclusion of the iMessage database in the regular iPhone iCloud backups. Could you check what that setting is set to on your newly setup device?

Right, that’s why I am trying to clarify that it’s iCloud for Messages that is not enabled by default.

iCloud backup IS enabled. But Messages in iCloud is off.

Right, and in iCloud backups you can choose to include or don't include iMessage data in those, is the iMessage data included by default?

Gah, now I see. Yes, it does include messages in iCloud backup by default. The "Messages for iCloud" option is exposed at the "Apps using iCloud" menu but iMessage backups are in the iCloud Backup for the specific device.

TIL.

Self-replying since I can't edit or delete this.

Sneak was right -- by default iCloud backup is enabled and is backing up all iMessage, SMS, and MMS messages.

I was just caught up on the difference between iCloud for Messages and iCloud backup of messages.

Apple support article that lays out what's backed up by default:

https://support.apple.com/en-us/108770

To clear up the FUD here, this is only true if you turn on iCloud backups (many users do, but still) and don't turn on Advanced Data Protection. ADP is off by default because it means you'll lose all your backups if you forget your iCloud password.

> it’s a platform designed to aid illegal government surveillance.

Come on.

These are the defaults. You don’t need to turn on iCloud Backup, it’s already on. You don’t need to turn off Advanced Data Protection, it’s already off.

Literally all you need to do is turn on a new iPhone and try to install any app. It will prompt for your Apple ID login (impossible to install apps without it) and will automatically enable iCloud, iCloud Backup, and iMessage (and will not enable ADP).

https://www.forbes.com/sites/kateoflahertyuk/2020/01/21/appl...

They explicitly killed the e2ee support for backups some time ago at the behest of the FBI to preserve the backdoor. It’s still practically backdoored for nearly all iMessage users because it is off by default (and the UX sucks even if you turn it on). Approximately nobody is using it; the status quo is preserved. iMessage is backdoored and is not e2ee due to key escrow. If you message someone on iMessage, Apple will be able to read the message, even if you have ADP enabled (because the other endpoint does not). That’s fact, today.

Additionally, even if you turn on ADP, the hashes of unencrypted file content in iCloud are stored non-e2ee, so Apple can still see who has which unique files and when, and who else receives them and when. This allows them to monitor social graphs, too.

iMessage is excluded by default on iCloud backups, that's what the other guy is saying

Messages in iCloud (different thing, used for syncing iMessage conversations to all your devices) is off by default, to my knowledge backups of the iMessage database is on by default in the iCloud backup setting, but admittedly I haven't setup a new device without restoring an iCloud backup in many many years.

Messages is iCloud is mostly used to free up local storage, and to sync old messages to new devices. You don’t need it to sync messages most of the time.

> and will not enable ADP

Not only will it not enable ADP, it won't even ask you about it.

>> it’s a platform designed to aid illegal government surveillance.

> Come on.

Whilst I agree with the general skepticism, Apple didn’t add E2E encryption to (certain parts of) iCloud backups at the explicit request of the FBI.

https://arstechnica.com/tech-policy/2020/01/apple-reportedly...

That's still not the same as claiming that iMessage is designed specifically for the purpose of aiding government surveillance.

Not adding E2E was a conscious design decision by Apple specifically to aid surveillance.

Virtually every other big messaging service offered (optional) E2E at that point.

I’m not sure how much clearer you want it.

“Surveillance” doesn’t have to mean that Apple allowed the FBI to jack directly into the iCloud servers.

Wasn't it an attempt to take the fangs out of the FBI's push for encryption backdoors? As one of the largest messaging platforms in the US, what Apple does with E2E absolutely factors into public policymaking.