Is implicitly trusting authority the hacker spirit?
> Apple claims iMessage is E2EE, do we have proof they aren't siphoning the messages from the client once it's been decrypted?
The answer here is no. Yes, making a wild claim afterwards is lazy, but the fact remains: there is no system in place to get anywhere close to "proof".
The best we have is researchers reporting trust violations when they find them, escalating those violations in the media, and sometimes forcing the company to change behavior. Relying on (ever more skilled!) unpaid volunteer work to verify the claims of the largest company in the world seems like an appeal to authority. It also doesn't scale as they make more claims and build more complex software.
Yes, breaking E2EE for everyone is so large that it would be impossible to do at scale without anyone noticing. Breaking it selectively to target individuals (the threat people are actually worried about!) is much harder to detect, no?
That's because it's a ridiculous premise. We don't have any evidence that Tim Cook isn't robbing banks in his spare time either. I'm not saying he does.. I'm just throwing it out there because he might be.
Not to mention the fact that you can't prove a negative anyway.
Apple added Contact Key Verification to eliminate one possible class of attack involving a lack of user transparency. Still trusting a whole lot of trust in the stack, but is an improvement.
What you think of as a ridiculous premise I think of as a goal to aspire to