Yesterday, researchers made a presentation at the Hack in the Box conference arguing that Apple's iMessage system could theoretically allow Apple or another party to intercept the encrypted messages. The concern stems in part from Apple's use of a private server for storing users' public keys used to encrypt messages, meaning that senders have no way of knowing whether a potentially false key has been inserted in order to intercept messages intended for a different recipient.
In a statement to AllThingsD, Apple once again denies that it can read iMessages, noting that it would require the service's systems to be re-engineered and that the company has no interest in doing so.
Apple says that QuarksLab’s theory is just that — a theory, and one that would require a rearchitecting of iMessage for it ever to be a threat in the real world.
“iMessage is not architected to allow Apple to read messages,” said Apple spokeswoman Trudy Muller said in a statement to AllThingsD. “The research discussed theoretical vulnerabilities that would require Apple to re-engineer the iMessage system to exploit it, and Apple has no plans or intentions to do so.”
Apple's statement does not actually refute the original claim, simply confirming that as the service is currently configured it is impossible for Apple to intercept iMessages. The researchers' argument rests on the observation that changes could be made to Apple's systems to allow for iMessages to be intercepted without users being aware of the changes.
The result is that Apple is arguing users should trust that the company has no interest in making such changes, and if users take Apple at its word, the researchers' concerns remain merely theoretical. But some users may remained concerned that Apple could be quietly compelled to make changes by government security agencies, compromising Apple's touted "secure end-to-end encryption" for iMessage.
Top Rated Comments
Personally, I don't care if an Apple employee knows that I'm iMessaging my wife that I'm on my way home from work.
Why this Apple-centric bashing?
Facebook employes can read your posts, Citibank employees can see your bank transactions, Google employees can know what all your searches are.
This is no less secure than anything else done on the internet.
There is always a simple retort to a statement like this from the "Nothing to hide" brigade.
Do you have curtains in your home?
At least it's not Google!
I think Apple truly does care about our security. Look at all the trouble Apple went to for storing Touch ID fingerprints in ARM's Secure Enclave. Do you think HTC does that with there new HTC ONE with fingerprint slide recognition? To act like AAPL does not make a real attempt to protect our information is wrong. Do you see ads in your Apple email? Meanwhile GOOG will whore out your information as fast as they can and throw ads constantly in your face (even more aggressively now, due to the lowering profit margins from ads).