iMessage is probably not as secure as you thought

Ben Thompson had a good comparison of messaging apps [1, $] yesterday. He ranked them as follows:

1. Signal Signal encrypts your messages end-to-end, and does not back up your messages to either iCloud or its own servers. This is the most secure option (and also the option most likely to lead to data loss or getting locked out of your own account — it’s a tradeoff!).

2. WhatsApp WhatsApp encrypts your messages end-to-end (with the same protocol as Signal), and does not back up your messages to its own servers. By default it does not back up messages to iCloud either, but that is an option. If you enable that option then your messages can be accessed by Apple (who has the keys for iCloud backups) and, by extension, law enforcement with a warrant.

3. (tie) Telegram Telegram does not end-to-end encrypt messages by default; they are stored on Telegram’s servers where they are secured by Telegram’s keys, which means they can also be accessed by law enforcement with a warrant. However, you can turn on end-to-end encryption for one-to-one conversations (but not for channels).

4. (tie) Facebook Messenger Messenger does not end-to-end encrypt messages by default; they are stored on Facebook’s servers and can be accessed by Facebook and, by extension, law enforcement. However, like Telegram, you can enable end-to-end encryption for one-to-one conversations.

5. iMessage iMessage encrypts messages end-to-end by default; however, if you have iCloud backup turned on, your messages can be accessed by Apple (who has the keys for iCloud backups) and, by extension, law enforcement with a warrant. Unlike WhatsApp, though, this is both on by default and cannot be turned off on a granular basis.

[1] https://stratechery.com/2021/the-whatsapp-kerfuffle-comparin...

Not to mention iMessage leaves an unencrypted database containing all texts on your computer if you use that computer to backup your iPhone (or if you have the computer linked to your iCloud account so that you can send/receive messages from it). The only reason I know this is because I deleted someone's phone number once after getting upset with them, and then I regretted it, so I did a deep dive. Found it :)