How Apple Can Read Your Encrypted Messages

If you have an iPhone and your friends are mostly iPhones, you probably use the Apple Messages app to connect with them. This is the nature of things. And beyond the convenience and ubiquity of the platform, one of the benefits of the iMessage platform is that its end-to-end encryption should, in theory, ensure that only you and the people you send messages to can read your conversations. However, that might not be the case: Apple can probably access messages for many, many iMessage users, even with end-to-end encryption.

By default, iMessage is protected from Apple’s eyes.

As designed by Apple, iMessage encryption works in such a way that messages sent from your Apple device to another Apple device can only be viewed by interested parties. The iMessage files themselves are encrypted in transit, so if someone theoretically gains access to them without opening them on your trusted device, they’ll see a mess of data instead of message content. Your Apple device acts as a “key” to decrypt this data; without this key, the data remains locked in an encrypted state.

In its basic form, this end-to-end encryption works as expected. Only your connected devices and the Apple devices that receive your messages have keys to unlock and read said messages. Apple cannot read your messages without access to your unlocked device, as well as law enforcement or other third parties. Note that only iMessages are encrypted; SMS texts (which appear in messages as green bubbles instead of the standard blue ones) are not encrypted.

How you back up your messages matters

So yes, your texts are encrypted both sent and received. But few of us delete each text as it comes in; we store them in case we want to come back to them later, which means that we need to somehow back them up. And as it turns out, how you back up your messages can mean the difference between a truly secure iMessage history and giving Apple a key to unlock all your conversations.

Let’s talk about messages in iCloud first. This service backs up your messages to your iCloud account and syncs them across all connected Apple devices. It’s a convenient way to start a conversation on your iPhone and continue on a Mac or iPad, and it’s also a reliable backup method.

Then there is iCloud Backup, Apple’s service for backing up your iPhone’s contents. ICloud backup can store many different things, from app data to device settings, home screen settings, photos and videos, and yes, messages. These two functions are not mutually exclusive; you can enable Messages in iCloud along with iCloud backup. However, when you do this, Apple keeps your message history separate from your device’s iCloud backup.

iCloud Backup is an insecure method of saving your messages.

Here’s a trick; Messages in iCloud are encrypted, as you’d expect, which is why there is no way to access your messages online, for example by logging into icloud.com . However, there is one big problem: your iCloud backup is not encrypted, and Apple stores a key to unlock your encrypted messages in that backup.

Apple does this to ensure your backup is backed up – if you forget your Apple ID password or device unlock password, Apple doesn’t want you to permanently lose your data, and this is what happens if iCloud backs up and data inside, have been encrypted with end-to-end encryption. Apple’s iCloud Data Recovery service can recover any unencrypted data backed up to iCloud, which is most of your data. Many people are probably relieved when Apple “saves” their messages in this situation. However, those of us who care about privacy are most likely concerned.

These are not just your messages; In addition to your keychain, screen time, and health data, Apple has a key to decrypt all of your iCloud data. There is currently no evidence that Apple decrypted or ever decrypted users’ messages and data using the keys they stored in iCloud, but that’s not the point. The point is that the company could do this if it wanted to, or, more likely, if it was forced to share this key and related data with law enforcement agencies . If there is ever a major iCloud data leak, hackers could gain access to your data in this way as well. This is not really a safe solution to the backup problem, but people are easily confused into thinking they are (I definitely thought they were before researching this article).

How to prevent Apple from reading your messages

Fortunately, there is a relatively simple solution to this problem: don’t use iCloud backup to store old texts. Apple Backup stores the key to unlock your messages, as well as the rest of the unencrypted data, so unless you have locked data, you can’t access it. This does not mean that you cannot create backup copies of your messages. Remember that messages in iCloud are end-to-end encrypted, which means that even if you save these messages to the cloud, Apple doesn’t have a key to decrypt them.

You can turn off iCloud Backup in Settings> Apple ID> iCloud> iCloud Backup. Make sure the toggle next to iCloud Backup is gray. When you turn off iCloud backup, your last backup will be kept in the cloud for 180 days. This means that you have to wait six months until you are sure that Apple no longer has the key to your messages on their servers. The good news, however, is that after disabling iCloud backup, a new key is generated for future messages; from now on, your new messages are protected.

If you’d like to use iCloud Secure Messages to back up and sync your conversations, you can check its status on the iCloud Settings page; the switch next to the messages should be green. If you need an alternative backup solution, try backing up your iPhone to your computer using Finder (macOS Catalina or later) or iTunes (Windows or macOS Mojave or earlier). Apple has an easy step-by-step guide if you’ve never done it before. You can even encrypt these backups, ensuring that all of your iPhone’s content is protected by anyone with access to your laptop.

You will never be fully protected with iMessage

You can take the steps above to make sure the messages on your end are encrypted, but you can’t control the actions of everyone you send text to. There is no way to know for sure if someone else has iCloud backup turned on; if they do, it will give Apple the key to all messages you’ve sent to that person. Of course, even if you know that the messages themselves never leave the devices of the people participating in the conversation (for example, using an application such as Signal), nothing prevents other people from taking photos of your conversations or transferring their device to the other party.

All you can do is make the best use of the data you can control and encourage others to use cybersecurity and privacy best practices.