That's the point of the article: the messages stored on iCloud aren't encrypted. The claim that iMessage uses end-to-end encryption is worthless.
A co-worker and I send encrypted e-mails back and forth occasionally. If he decrypts my attachments and saves them to his hard drive to work with, that doesn't mean that e-mailing them in an encrypted form was worthless.
If you read the article, you'll note that the author was successful with an attack that demonstrates that Apple can access the plain text of at least recently-delivered messages (and possibly all of the backed up messages).
Apple did a great thing by making iMessage secure by default. They should do a similarly great thing by making iCloud backups secure or by making it very obvious to the user that they are not secure (and what that means for your other "secure" data).
This seems likely given they offer to store your key for FileVault[1] under some secret answers. I think this delivers the same level of "secure" in the sense that, provided they don't store the passwords you submit (possible law enforcement request), then they shouldn't be able to decrypt your iCloud backups either.
Apple can still get at them because they can reset your password on you. Certain files in the backup will not be accessible to them if they were encrypted with a key that wraps the Device UID. iMessages don't seem to be one of these files, but Mail backups are clearly inaccessible.
i think the most important takeaway here is that the reactionary press release "Apple’s Commitment to Customer Privacy" was very carefully worded to give the customer a sense of security. it's definitely not telling the full story, but it serves its purpose of reassuring a concerned user base.
Also.. it's important to note that the iMessage client only retains about a day's worth of messages on the device. Earlier messages can be obtained via a "load earlier messages" button. This means that Apple does store the message history on the iMessage servers, and there is a way for the client to retrieve them in batches while the contents are not accessible to Apple.
It seems extremely likely that this 'iCloud Backup' vulnerability is a red herring. The messages are not stored in the regular backup but are fetched encrypted by the client when you sign in.
Tools exist to read the database from the phone directly, from backups, etc. Which is great when you accidentally delete them... I wouldn't know that though. :)
Therefore, my iMessage history is secure (I fully understand that my message recipients may expose my individual messages, but my copy is safe).
"For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. "
From: http://www.apple.com/apples-commitment-to-customer-privacy/
The author did demonstrate that recently-delivered messages may be accessed without device-specific or user-specific secrets in place. So, even if all the transports on all the hops between all the machines in the message delivery chain are encrypted, Apple is able to access the plain text of at least the recently-sent messages.
However, this is really far into the weeds on a topic that doesn't matter so much, as none of it really relates to Apple's claims about iMessages.
But how much security can you guarrantee with closed source anyway?
Which is actually, as far as we know, true for Skype too. The reason is both systems acquired a reputation (one that Apple's PRISM press release courted) that they were three letter agency proof(at least for most TLA's).
That reputation, we now know, at least for Skype was erroneous long before Microsoft bought them and might be for Apple. Yes, Apple deserves major props for deploying end to end crypto , but IChat security reputation is inaccurate.
Apple could have just gone "fuck it, let's store it in plaintext, since it's never going to be good enough anyway", but adding strong, transparent encryption to one of the most-used messaging services in existence right now is a very good thing, in my book.
Sure, the transparency introduces some flaws, but Apple has protected itself by a whole slew of passive attacks, which, to my knowledge, is the kind of attack that the mass surveillance state uses, and what a large messaging service is most at risk of.
Getting a warrant and saying "hey, we have a warrant for X, can we look at their communications", and then having Apple MITM that person is much, much more preferable to me than having a government say "we need all your data" and then the provider just handing the data over, since it's all in plaintext.
As it stands, Apple has pretty much disabled large-scale surveillance of iMessage accounts, which is what PRISM and all the furore is about, and people still shit on them?
Can we have some perspective please? If we lambaste any provider who takes steps to safeguard our privacy (again, at no benefit to them, since most people who use iMessage don't even know what encryption is), then what do you think the next service to have the choice in a product will say? "Hmm, I could either store everything in plaintext and have governments strong-arm me into sharing it with them (which I couldn't really care less about), I could build really strong encryption into it and make it an unusable mess for no added benefit to me, or I could build as much encryption into it as doesn't impact usability, again for no benefit to me, and get shat on for not providing option #2. Gee, how can I ever decide?"
If you want strong privacy/security, use Silent Circle (disclosure I work for them etc). If you care about your day-to-day privacy and want to talk to people you know, you could do much worse than iMessage.