That's the point of the article: the messages stored on iCloud aren't encrypted. The claim that iMessage uses end-to-end encryption is worthless.
That's the point of the article: the messages stored on iCloud aren't encrypted. The claim that iMessage uses end-to-end encryption is worthless.
A co-worker and I send encrypted e-mails back and forth occasionally. If he decrypts my attachments and saves them to his hard drive to work with, that doesn't mean that e-mailing them in an encrypted form was worthless.
Apple did a great thing by making iMessage secure by default. They should do a similarly great thing by making iCloud backups secure or by making it very obvious to the user that they are not secure (and what that means for your other "secure" data).
i think the most important takeaway here is that the reactionary press release "Apple’s Commitment to Customer Privacy" was very carefully worded to give the customer a sense of security. it's definitely not telling the full story, but it serves its purpose of reassuring a concerned user base.
This seems likely given they offer to store your key for FileVault[1] under some secret answers. I think this delivers the same level of "secure" in the sense that, provided they don't store the passwords you submit (possible law enforcement request), then they shouldn't be able to decrypt your iCloud backups either.
Apple can still get at them because they can reset your password on you. Certain files in the backup will not be accessible to them if they were encrypted with a key that wraps the Device UID. iMessages don't seem to be one of these files, but Mail backups are clearly inaccessible.
If you read the article, you'll note that the author was successful with an attack that demonstrates that Apple can access the plain text of at least recently-delivered messages (and possibly all of the backed up messages).
Also.. it's important to note that the iMessage client only retains about a day's worth of messages on the device. Earlier messages can be obtained via a "load earlier messages" button. This means that Apple does store the message history on the iMessage servers, and there is a way for the client to retrieve them in batches while the contents are not accessible to Apple.
It seems extremely likely that this 'iCloud Backup' vulnerability is a red herring. The messages are not stored in the regular backup but are fetched encrypted by the client when you sign in.
Therefore, my iMessage history is secure (I fully understand that my message recipients may expose my individual messages, but my copy is safe).
Tools exist to read the database from the phone directly, from backups, etc. Which is great when you accidentally delete them... I wouldn't know that though. :)