Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I do believe apple’s e2e encryption promises on iMessage content, and don’t think it should interfere with their ability to control for spam / bad actors.

But I also expect them to know the sender/receiver, and I imagine if I click “Delete and Report Junk” button, that I would probably submit the unencrypted contents of that whole conversation to Apple. And they should have also have metrics of total sends vs reported sends.



The vast majority of iMessages (99%+), including normal/unreported ones, are readable by Apple because either the iMessages themselves or the iMessage cross-device sync keys are escrowed to Apple in the non-e2ee iCloud Backup. In the latter case the messages are readable in realtime.

This is documented (not the 99% figure, but the situation) by Apple in knowledge base articles on the apple.com website.

The e2ee in iMessage is effectively irrelevant, as for most people, most of the time, it functions just like Telegram (which is not e2ee).


Fair enough, though this is probably useful people for most non tech people, who might forget their passwords / lose keys, and don’t want to lose all access and data.

Personally, a few months ago I enabled Advanced Data Protection (ADP) which afaik does make iCloud backups (including messages), Photos, iCloud Drive and few other things inaccessible to Apple.

- https://support.apple.com/en-us/102651 - https://support.apple.com/guide/security/advanced-data-prote...

Whether you trust that Apple actually did throw away their keys after enabling the feature is a different story, but it’s good enough for me.

When enabling ADP there’s multiple warnings about how you’ll end up completely locked out if you lose all your devices / lose recovery keys / lose all hardware authenticators. Iirc I was also forced to register at least 2 yubikeys. For anyone tech savvy you should enable ADP.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: