Don’t Kid Yourself: Apple iMessage Encryption Is Not Truly Secure
Not long after the initial NSA leaks escaped Edward Snowden's head this past summer, a handful of tech companies assured their customers that personal information stored with them is secure. One such company is Apple, which went on the record to state that even if the government demanded it, the company would be unable to decrypt the messages to hand them over.
One of the reasons iMessage is so secure is thanks to its end-to-end encryption. This prevents a message from being plucked via a man-in-the-middle attack and then viewed. In effect, only the sender and recipient can see it, which is how it should be.
However, because Apple is in charge of handling the encryption keys, it means that the company does have the ability to decipher messages should it be forced to. Much like how a house key can unlock the front door to your home, these keys can be used to tell the algorithm that it's a-OK to display a given message.
While that could be considered a bad thing, there are a couple of upsides. Man-in-the-middle attacks, for example, would be highly unlikely - though as we discovered just last month, it hasn't been beneath the US government to at least try. For a "normal" hacker, though, it seems safe to assume that your iMessage contents are secure.
It's worth pointing out that just because Apple has the keys required to 'unlock' a message, it doesn't mean that the company has that functionality built into the backend. But that said, given all we've learned since the summer, it seems that if a government wants to get some data, it's going to try - even if it requires the use of less-than-honest practices. For even more secure communications, a service like Bitmessage could be used, which is an encrypted and decentralized (an oh-so-important feature) messaging platform that would offer an unparalleled level of message security.
Still - even though the facts point to Apple being able to decrypt messages if it was forced to, the company seems to be doing a lot more to protect customer data than most.
