Macrumors - the summary above needs to be upgraded to actually make sense. As it is it's useless. I read the MacWorld article and here is what happens:
1 - Your iOS device pulls the public key of the recipient from Apple's servers
2 - Your iOS device then encrypts the message with the public key
3 - At this point, the message is encrypted, only the recipient with their own private key can decrypt it. Note a private key is never sent to Apple, or anyone - nobody knows your private key, only your device does.
The researchers take offense in the fact that in step 1, you need to trust Apple to do the right thing. If they wanted to, they could send you a public key for the NSA, or for Apple, or whoever, and you'd never know. Then you'd encrypt your message and once it hits Apple's servers, the NSA or Apple or whoever could decrypt it, then encrypt it with the actual recipient's key, and send it along. That's the man in the middle attack.
It's all based on the fact that you need to trust Apple as a public key authority, and somewhat worsened by the fact that your message also passes through Apple's servers.
So yeah if Tim Cook wanted to, he could task engineering with setting up an intercept system on Apple's servers, and read all messages.
But if Apple did not build such an intercept system - and why would they - then nobody can read those messages, just as Apple stated.
So is it a lie? No it's not, at least not unless Apple decides to put a hole in their own system. My opinion is that those security researchers are full of it.
I am using GPG on my Mac OS X machine right now and what these security researchers are proposing - that the public key system be made transparent - is not really possible without giving up privacy data. Also nobody would bother to check - GPG is way better than it used to be, but it still takes a lot of work to be completely secure.
Apple's system automagically manages multiple iOS devices - they all have different private keys of course, so messages need to be encrypted with a different public key for each one. And it manages people adding and removing devices from iMessage AND it never, ever bothers the user with the details. It's utterly impressive Apple has managed to make security this simple. It's also much more secure because more people will use it.
PS: Addendum: Imagine the NSA puts a bunch of secret court orders on Apple to build an intercept facility into iMessage. Apple could comply but take a very long time to implement it - it's a very complex system, implementing an intercept is something only Apple can do, and they could just take 5 years to do it... then it might not work... there's a million ways Apple could stall this ...
----------
I just googled it and apparently there's no way to turn off iCloud backing up iMessage. Not only that, apparently it keeps a copy of every attachment you've ever sent or received and you can't delete it unless you use a program to access the file system.
Just turn off iCloud backup!
I back everything up on my computer. Works well.
If you wanted to you could also use a service like SpiderOak to back up your iOS backups. SpiderOak uses public key encryption and stores all your data encrypted with your private key. Even if they get a court order, they can't decrypt anything.
Seriously why would you hand the contents of your iOS device to the NSA? Of course they have access.
