News for hackers. Stuff that matters.
Re:Can Apple read your iMessages? by jlgaddis on Wednesday June 26, 2013 @05:45AM (#5945051)
The messages are encrypted end-to-end. What you do with them once they've arrived (e.g. backing them up to iCloud) has nothing to do with the transport.

A co-worker and I send encrypted e-mails back and forth occasionally. If he decrypts my attachments and saves them to his hard drive to work with, that doesn't mean that e-mailing them in an encrypted form was worthless.

Re:Can Apple read your iMessages? by pcl on Wednesday June 26, 2013 @09:29AM (#5945856)
They might well be encrypted end-to-end, but who manages the keys? If Apple manages the keys on the server side, then that end-to-end encryption does not prevent Apple from accessing the messages.

If you read the article, you'll note that the author was successful with an attack that demonstrates that Apple can access the plain text of at least recently-delivered messages (and possibly all of the backed up messages).

Re:Can Apple read your iMessages? by schrodinger on Wednesday June 26, 2013 @09:46AM (#5945941)
Apple manages public keys, not private. They'd have to lie to you and give you their own public key, and then man in the middle your conversation to get it.
Re:Can Apple read your iMessages? by robotresearcher on Wednesday June 26, 2013 @03:13PM (#5948289)
Right. A security system that relies on someone not lying to you is not so hot.
Re:Can Apple read your iMessages? by jonknee on Wednesday June 26, 2013 @09:11AM (#5945732)
Sure, but this is all transparent to the user. Apple heavily pushed iCloud backups and doesn't mention that it throws any data security out of the water. You hear iMessages are secure and then you accept the "use iCloud backup" question that appears right after you get your device. Except now your messages aren't secure.

Apple did a great thing by making iMessage secure by default. They should do a similarly great thing by making iCloud backups secure or by making it very obvious to the user that they are not secure (and what that means for your other "secure" data).

Re:Can Apple read your iMessages? by rainforest on Wednesday June 26, 2013 @09:26AM (#5945832)
Isn't it possible that iCloud backups are encrypted in storage? Apple could be holding the key in encrypted form and sending that to the device with a backup. If the user's password is used as the passphrase to the key, then only the user can use the key to decrypt it. Apple could hold a second key, with passphrases set to secret answers for reset scenarios - that would let them regenerate the normal password-encrypted key for the chosen changed password.

This seems likely given they offer to store your key for FileVault[1] under some secret answers. I think this delivers the same level of "secure" in the sense that, provided they don't store the passwords you submit (possible law enforcement request), then they shouldn't be able to decrypt your iCloud backups either.

1: http://support.apple.com/kb/ht4790

Re:Can Apple read your iMessages? by parasubvert on Wednesday June 26, 2013 @12:15PM (#5946948)
iCloud Backups are encrypted: https://www.apple.com/ipad/business/docs/iOS_Security_Oct12....

Apple can still get at them because they can reset your password on you. Certain files in the backup will not be accessible to them if they were encrypted with a key that wraps the Device UID. iMessages don't seem to be one of these files, but Mail backups are clearly inaccessible.

Re:Can Apple read your iMessages? by embolism on Wednesday June 26, 2013 @10:01AM (#5946048)
Yes. Not only possible but likely.
Re:Can Apple read your iMessages? by jimsilverman on Wednesday June 26, 2013 @09:23AM (#5945815)
agreed.

i think the most important takeaway here is that the reactionary press release "Apple’s Commitment to Customer Privacy" was very carefully worded to give the customer a sense of security. it's definitely not telling the full story, but it serves its purpose of reassuring a concerned user base.