They're still strong, much stronger than Google's and most others', just not as strong as you perhaps believed beforehand. It doesn't need to be a binary "can't trust them at all" || "can trust...
They're still strong, much stronger than Google's and most others', just not as strong as you perhaps believed beforehand. It doesn't need to be a binary "can't trust them at all" || "can trust them completely".
I completely agree, but Apple seems to get a pass for a lot of privacy related stuff just because they push "we care about your privacy" in their marketing. I say this as someone who owns tons of...
I completely agree, but Apple seems to get a pass for a lot of privacy related stuff just because they push "we care about your privacy" in their marketing.
I say this as someone who owns tons of Apple stuff both for personal and professional use.
Does Apple hold any power here? They're the largest US company and the only one who focuses on privacy, meaning the FBI has a vested interest in keeping them quiet and since they're a US company,...
Does Apple hold any power here? They're the largest US company and the only one who focuses on privacy, meaning the FBI has a vested interest in keeping them quiet and since they're a US company, the FBI has the power to do so and if Apple doesn't Tim Cook goes the way of Jeffrey Epstein, right?
At the very least, Apple has the power to tone down their marketing claims, so that they don't mislead consumers who don't read the fine print or pay attention to tech news.
At the very least, Apple has the power to tone down their marketing claims, so that they don't mislead consumers who don't read the fine print or pay attention to tech news.
For those interested in maximizing their privacy, you should disable iCloud backups, as well as Messages integration with iCloud. Finally, set up encrypted local backups. This will establish full...
For those interested in maximizing their privacy, you should disable iCloud backups, as well as Messages integration with iCloud. Finally, set up encrypted local backups. This will establish full end-to-end encryption for all your data, without sharing any of the keys with Apple (they say).
Aren't Messages e2e encrypted with a device key or something? I thought that was why there was no web interface and if you want to add a device to your Messages account you need a device that's...
Aren't Messages e2e encrypted with a device key or something? I thought that was why there was no web interface and if you want to add a device to your Messages account you need a device that's already on it.
Maybe there's some weasel wording in here that I'm not picking up on but it sounds like even if you backup your Messages to iCloud they are encrypted.
For your convenience, iMessages are backed up in iCloud and encrypted if you have either iCloud Backup or Messages in iCloud enabled.
This is the crucial ambiguity: The device key is used to perform E2E encryption, always. However, if iCloud Message backups are enabled, copies of the conversation keys are uploaded to Apple. This...
This is the crucial ambiguity:
[...] there’s no way for Apple to decrypt the content of your conversations when they are in transit between devices.
The device key is used to perform E2E encryption, always. However, if iCloud Message backups are enabled, copies of the conversation keys are uploaded to Apple. This is so that you can, for example, pick up a conversation where you left off on a different device. If they were using private keys located only on the involved devices, you wouldn't be able to see old messages on other devices, which naturally would have different private keys.
Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple.
Of course, if Apple has a backup of your keys, then they can read your messages (edit: or provide those keys to third parties which request them). They just can't read them while in transit, only at rest on the server.
I'll keep this in mind whenever Apple goes on about how strong their privacy protections are at their next event.
They're still strong, much stronger than Google's and most others', just not as strong as you perhaps believed beforehand. It doesn't need to be a binary "can't trust them at all" || "can trust them completely".
I completely agree, but Apple seems to get a pass for a lot of privacy related stuff just because they push "we care about your privacy" in their marketing.
I say this as someone who owns tons of Apple stuff both for personal and professional use.
Does Apple hold any power here? They're the largest US company and the only one who focuses on privacy, meaning the FBI has a vested interest in keeping them quiet and since they're a US company, the FBI has the power to do so and if Apple doesn't Tim Cook goes the way of Jeffrey Epstein, right?
At the very least, Apple has the power to tone down their marketing claims, so that they don't mislead consumers who don't read the fine print or pay attention to tech news.
For those interested in maximizing their privacy, you should disable iCloud backups, as well as Messages integration with iCloud. Finally, set up encrypted local backups. This will establish full end-to-end encryption for all your data, without sharing any of the keys with Apple (they say).
Aren't Messages e2e encrypted with a device key or something? I thought that was why there was no web interface and if you want to add a device to your Messages account you need a device that's already on it.
Maybe there's some weasel wording in here that I'm not picking up on but it sounds like even if you backup your Messages to iCloud they are encrypted.
https://support.apple.com/en-us/HT209110
This is the crucial ambiguity:
The device key is used to perform E2E encryption, always. However, if iCloud Message backups are enabled, copies of the conversation keys are uploaded to Apple. This is so that you can, for example, pick up a conversation where you left off on a different device. If they were using private keys located only on the involved devices, you wouldn't be able to see old messages on other devices, which naturally would have different private keys.
From here: https://support.apple.com/en-us/HT202303
Of course, if Apple has a backup of your keys, then they can read your messages (edit: or provide those keys to third parties which request them). They just can't read them while in transit, only at rest on the server.