Hacker News Reader

Apple could have just gone "fuck it, let's store it in plaintext, since it's never going to be good enough anyway", but adding strong, transparent encryption to one of the most-used messaging services in existence right now is a very good thing, in my book.

That's the point of the article: the messages stored on iCloud aren't encrypted. The claim that iMessage uses end-to-end encryption is worthless.

You aren't required to use iCloud Backup to use iMessage. They're completely separate services.

The messages are encrypted end-to-end. What you do with them once they've arrived (e.g. backing them up to iCloud) has nothing to do with the transport.

A co-worker and I send encrypted e-mails back and forth occasionally. If he decrypts my attachments and saves them to his hard drive to work with, that doesn't mean that e-mailing them in an encrypted form was worthless.

Sure, but this is all transparent to the user. Apple heavily pushed iCloud backups and doesn't mention that it throws any data security out of the water. You hear iMessages are secure and then you accept the "use iCloud backup" question that appears right after you get your device. Except now your messages aren't secure.

Apple did a great thing by making iMessage secure by default. They should do a similarly great thing by making iCloud backups secure or by making it very obvious to the user that they are not secure (and what that means for your other "secure" data).

agreed.

i think the most important takeaway here is that the reactionary press release "Apple’s Commitment to Customer Privacy" was very carefully worded to give the customer a sense of security. it's definitely not telling the full story, but it serves its purpose of reassuring a concerned user base.

Isn't it possible that iCloud backups are encrypted in storage? Apple could be holding the key in encrypted form and sending that to the device with a backup. If the user's password is used as the passphrase to the key, then only the user can use the key to decrypt it. Apple could hold a second key, with passphrases set to secret answers for reset scenarios - that would let them regenerate the normal password-encrypted key for the chosen changed password.

This seems likely given they offer to store your key for FileVault[1] under some secret answers. I think this delivers the same level of "secure" in the sense that, provided they don't store the passwords you submit (possible law enforcement request), then they shouldn't be able to decrypt your iCloud backups either.

1: http://support.apple.com/kb/ht4790

Yes. Not only possible but likely.

iCloud Backups are encrypted: https://www.apple.com/ipad/business/docs/iOS_Security_Oct12....

Apple can still get at them because they can reset your password on you. Certain files in the backup will not be accessible to them if they were encrypted with a key that wraps the Device UID. iMessages don't seem to be one of these files, but Mail backups are clearly inaccessible.

They might well be encrypted end-to-end, but who manages the keys? If Apple manages the keys on the server side, then that end-to-end encryption does not prevent Apple from accessing the messages.

If you read the article, you'll note that the author was successful with an attack that demonstrates that Apple can access the plain text of at least recently-delivered messages (and possibly all of the backed up messages).

Apple manages public keys, not private. They'd have to lie to you and give you their own public key, and then man in the middle your conversation to get it.

Right. A security system that relies on someone not lying to you is not so hot.

I'd like to see a more comprehensive test to prove that the messages are part of the backup. Since you have to sign in to iMessage, it's possible that these are being retrieved from the iMessage server in an encrypted form - "I restored an iPhone and saw old messages" is not proof that they are stored in plaintext.

Also.. it's important to note that the iMessage client only retains about a day's worth of messages on the device. Earlier messages can be obtained via a "load earlier messages" button. This means that Apple does store the message history on the iMessage servers, and there is a way for the client to retrieve them in batches while the contents are not accessible to Apple.

It seems extremely likely that this 'iCloud Backup' vulnerability is a red herring. The messages are not stored in the regular backup but are fetched encrypted by the client when you sign in.

That's not what's happening with the "load earlier messages" button at all. The long term iMessages history is stored in an unencrypted sqlite database on the phone (which is included, unencrypted, in local iTunes backups).

Local backups can be encrypted (mine are). Also it's not necessary to use cloud backups (I don't).

Therefore, my iMessage history is secure (I fully understand that my message recipients may expose my individual messages, but my copy is safe).

The fact that it is possible to perform encryption on the entire backup file does not change the fact that many people are (wrongly) speculating about things which are easily verifiable.

They're not loaded from the server but the sms.db (sqlite) database on your phone.

Tools exist to read the database from the phone directly, from backups, etc. Which is great when you accidentally delete them... I wouldn't know that though. :)

But what's the difference? Whether the messages are stored in plaintext, or whether they are stored as part of the iCloud backup, the author proved that Apple can get to them in order to restore your newly purchased phone.

It matters because in one scenario Apple itself can't get to them - it can only restore them to your phone where they are decrypted using your password.

Because Apple said they were doing end-to-end encryption:

"For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. "

From: http://www.apple.com/apples-commitment-to-customer-privacy/

The article doesn't disprove end-to-end encryption.

"End-to-end encryption" is a pretty empty phrase.

The author did demonstrate that recently-delivered messages may be accessed without device-specific or user-specific secrets in place. So, even if all the transports on all the hops between all the machines in the message delivery chain are encrypted, Apple is able to access the plain text of at least the recently-sent messages.

Actually the author didn't prove this. The author entered their account password to retrieve the backup. Restoring the most recent day of messages could be done from a plaintext backup or it could be done by loading an encrypted batch from the iMessage servers. We don't have enough information to know for certain either way.

The author said that he changed his password and then got a new device and accessed recent iMessages on it. So that rules out the password as the encryption key.

It rules out the password as the encryption key, but it doesn't rule out encrypted backups. Implementations of encrypted volumes, such as in LUKS on Linux, commonly use the password as something that unlocks the real encryption key. So during password change, the new password could be used to re-encrypt the backup encryption key, making it so that as long as Apple doesn't store the passwords, Apple can't have access to the encrypted backups.

However, this is really far into the weeds on a topic that doesn't matter so much, as none of it really relates to Apple's claims about iMessages.

He reset his password using the IForgot service. So either data is encrypted under a key apple has or its encrypted under a key derived from your secret answers( which is unlikely). In the latter case, Apple might as well have your key given the limited entropy

Or it could be encrypted by a random key with high entropy, that Apple does not have, because it is encrypted by a key derived from your password. See, for example, LUKS:

http://en.wikipedia.org/wiki/Linux_Unified_Key_Setup

And that key got onto his new device how precisely? Observed behavior was reset password with questions/email, prevision a new device, get old chats on new divice. If the new device had the old encryption key, how did it get there?

you present a false choice between security and ease of use. They could easily add a security layer that uses a short authentication code, that let's people in physical connection(say spouses) verify their texts are secured. Just a simple optional feature.

But how much security can you guarrantee with closed source anyway?

Why is everyone being so critical of Skype? Skype deserves major props here. "They have the constraint of 'the system must be easy to use' and, from what I can tell, did pretty much as much as they could to add strong crypto to the mix at no benefit to themselves."

Which is actually, as far as we know, true for Skype too. The reason is both systems acquired a reputation (one that Apple's PRISM press release courted) that they were three letter agency proof(at least for most TLA's).

That reputation, we now know, at least for Skype was erroneous long before Microsoft bought them and might be for Apple. Yes, Apple deserves major props for deploying end to end crypto , but IChat security reputation is inaccurate.