Despite iMessage’s end-to-end encryption, Apple could theoretically read your messages. How Apple Can Read Your Encrypted Messages?
You probably use Apple’s Messages app to communicate with your friends if you have an iPhone and they all have iPhones. That’s just the way things are. One of the platform’s selling points, aside from its convenience and ubiquity, is that its end-to-end encryption should theoretically ensure that only you and those you text can read your conversations. That may not be the case, as Apple is likely to have access to the messages of a large number of iMessage users, even if end-to-end encryption is in place.
Related: How to Force Restart or Use ‘Recovery Mode’ on Your iPhone 13
By default, iMessage is protected from Apple’s eyes
The encryption in iMessage, as designed by Apple, ensures that messages sent from one Apple device to another are only viewable by the parties involved. The iMessage files themselves are scrambled in transit, so if someone accessed them without first opening them on your trusted device, they’d see a jumble of data instead of the message’s content. Your Apple device serves as the “key” to decrypting that information; without it, the information remains locked in an Encrypted Messages state.
This end-to-end encryption works as expected in its most basic form. The keys to unlock and read your messages are only available to your connected devices and Apple devices that receive your messages. Apple, as well as law enforcement and other third parties, are unable to read your messages without access to your unlocked device. Only iMessages are encrypted; SMS texts (which appear in Messages as green bubbles instead of the standard blue) are not.
How you back up your messages matters
So, yes, your texts are encrypted both when they are sent and when they are received. However, few of us delete every text as it arrives; we keep them around in case we need to refer back to them later, which necessitates some form of backup. And it turns out that how you back up your messages can make the difference between having a truly secure iMessage history and giving Apple the key to unlock all of your conversations.
First, let’s talk about iCloud Messages. This service syncs your messages across all of your connected Apple devices and backs them up to your iCloud account. It’s a simple way to start a conversation on your iPhone and carry on with it on your Mac or iPad, as well as a reliable backup method.
Then there’s iCloud Backup, Apple’s service for backing up your iPhone’s contents. An iCloud Backup can hold a variety of items, including app data, device settings, Home screen settings, photos and videos, and, yes, messages. You can use Messages in iCloud alongside an iCloud Backup; the two features aren’t mutually exclusive. Apple, on the other hand, stores your Messages history separately from your device’s iCloud Backup when you do so.
iCloud Backup is not a secure method for saving your messages
Here’s the tricky thing; Messages in iCloud is end-to-end encrypted, just as you’d expect—that’s why there’s no way to access your messages on the web, such as by logging in to icloud.com. There’s one big problem, though: your iCloud Backup isn’t end-to-end encrypted—and Apple stores the key to unlock your encrypted messages within that backup.
Apple does this to provide a backup to your backup—it doesn’t want you to lose your data forever if you forget your Apple ID password or your device’s unlock passcode, and that’s exactly what would happen if iCloud backups and the data inside were end-to-end encrypted. Apple’s iCloud Data Recovery Service can retrieve any non-encrypted data backed up to iCloud, which is most of your data. In this situation, many people are likely relieved when Apple “saves” their messages. Those of us who value our privacy, on the other hand, are more likely to be concerned.
Apple has the key to decrypt all of your iCloud data, not just your messages. In addition to Keychain, Screen Time, and Health data, Apple has the key to decrypt all of your iCloud data. Now, there’s no evidence that Apple is or has ever decrypted users’ messages and data using the iCloud keys, but that’s beside the point. The point is that the company could do so if it wanted to, or if it was forced to share that key and the data associated with it with law enforcement. In the event of a major iCloud data breach, hackers could use this method to gain access to your information. It’s not a truly secure backup solution, but it’s easy to mislead people into thinking it is (before researching this piece, I certainly thought it was).
How to prevent Apple from reading your messages
Fortunately, there’s a simple solution to this problem: don’t store old texts in iCloud Backup. The key to unlock your messages, as well as the rest of your unencrypted data, is stored in Apple’s backup service, so if you don’t have any data locked up, it can’t be accessed. That doesn’t rule out the possibility of archiving your messages. Remember that iCloud Messages are end-to-end encrypted, so even though you’re storing them in the cloud, Apple doesn’t have the key to decrypt them.
iCloud Backup can be turned off in Settings > Apple ID > iCloud > iCloud Backup. Make sure the iCloud Backup toggle is grayed out. When you turn off iCloud Backup, your most recent backup will be kept for 180 days in the cloud. That means you’ll have to wait six months to be sure Apple doesn’t have access to your messages on its servers. The good news is that once iCloud Backup is disabled, a new key is generated for future messages; your new messages will be protected from here on out.
If you want to use the secure Messages in iCloud feature to backup and sync your conversations, you can check its status from the iCloud settings page; the toggle next to Messages should be green. If you want an alternative backup solution, try backing up your iPhone to your computer via Finder (macOS Catalina or later) or iTunes (Windows or macOS Mojave or earlier). Apple has an easy-to-follow walkthrough if you’ve never done it before. You can even encrypt these backups, ensuring that the entire contents of your iPhone are protected by anyone who might have access to your laptop.
Related: How to Install the Latest macOS on an Unsupported Mac
You’re never fully protected using iMessage
You can follow the steps above to ensure that your messages are encrypted end-to-end on your end, but you have no control over the actions of the people you text. There’s no way of knowing whether or not someone else has iCloud Backups turned on; if they do, Apple will have access to all of the messages you’ve sent them. Of course, even if you know that the messages themselves never leave the devices of the people involved in the conversation (as with an app like Signal), nothing prevents others from photographing your conversations or handing over their device to a third party.
All you can do is do your best with the data you have under your control and encourage others to follow good cybersecurity and privacy practices.
