iMessage security risk

[akouris]

Is anyone concerned by the fact that Apple seems to keep all iMessage chat history archived on their servers, for an indefinite amount of time?

I recently realized that Apple will keep copies of messages sent weeks earlier and will try to "sync" them to a device that has been registered in the past as an iMessage device, and you have just turned on.

Example:
On my Apple ID I have an iPhone, iPad, two iMacs, and a MacbookAir.

All devices are registered for iMessage use, under the same Apple ID.

For the past few months I rarely use MacbookAir because iPad has become my primary mobile computing device.

Yesterday I turned on my MacBookAir after several weeks of inactivity. As soon as I logged in, iMessage started "downloading" conversations that have ended and have been deleted from all my other devices, many weeks ago.

So my questions are:
1. Why does Apple keep a copy of all the iMessage conversations for an indefinite amount of time?
2. Why is this not mentioned anywhere?
3. Why does not Apple give you the option to delete all that archived history of iMessages from their servers?

Wouldn't it be more logical that Apple tries to sync messages for a specific amount of time (as the SMS protocol does), and if after that period the message is not delivered, it should be deleted from their servers?

 

[dontpannic]

No, I'm not. In fact I think it works exactly how I want it to work. If I turn on a device and want to look back at a message conversation, I don't want to have to remember which device I had on when I was sending those messages. I'd much prefer all the messages to appear everywhere.

Is it a security risk? Someone would have to log in to YOUR iMessage account in order to sync those messages. When you do log on to an iMessage account on a new device, old messages aren't synced.

They're not accessible by anyone else - they're encrypted. Not even Apple can see them. In fact, its much more secure than the SMS protocol.

 

[Blipp]

I guess I'm surprised by your surprise. This was the exact behavior I was expecting and value about iMessage. Maybe it makes me a push over or even a tinfoil hatter but I long ago accepted that all of my digital communication was being recorded somewhere by someone with or without my consent. I might as well get some use out of it all I guess...

 

[CB1234]

Why only iMessage a security risk?

I am sure phone calls we make, emails we send, every bit of information across the web is somehow monitored by someone somewhere.....

It's only a risk, if your messages are out in general domain for everyone to see OR if you are a terrorist planning something major and you are worried someone will cotton on.....

 

[akouris]

I am surprised that you do not consider a risk or a privacy concern the fact that Apple stores all your iMessage conversations for an indefinite amount of time.

Since I do not live in the US, it concerns me that a US based company is keeping a record of all my conversations, without actually notifying me or giving me the option to delete those conversations.

Do they ever delete these conversations, even after they deliver them to my devices? You don't know, but it seems that they actually do.

Let me point that this was the reason why Blackberry service was prohibited from operating in many countries around the world; local authorities felt that there was a security and privacy concern when their citizen's messages were routed and stored in another country, beyond their legislation.

 

[Daveoc64]

The major problem with iMessage is that it has few options to configure it.

If you're worried about Apple storing your messages (I can understand that), I suggest that you just turn it off.

 

[Small White Car]

I am surprised that you do not consider a risk or a privacy concern the fact that Apple stores all your iMessage conversations for an indefinite amount of time.

And google keeps your email. And dropbox has your files. And AT&T knows who you called and how long you spoke to them and what you texted them.

If this stuff bothers you (and it's fine if it does) then I'm kind of surprised you have an iPhone at all. What's the point in owning a device like this if you're not going to use any online services? There are cheaper devices if all you want to do is watch videos.

 

[mrapplegate]

I am surprised that you do not consider a risk or a privacy concern the fact that Apple stores all your iMessage conversations for an indefinite amount of time.

Since I do not live in the US, it concerns me that a US based company is keeping a record of all my conversations, without actually notifying me or giving me the option to delete those conversations.

Do they ever delete these conversations, even after they deliver them to my devices? You don't know, but it seems that they actually do.

Let me point that this was the reason why Blackberry service was prohibited from operating in many countries around the world; local authorities felt that there was a security and privacy concern when their citizen's messages were routed and stored in another country, beyond their legislation.

I believe countries such as India and Saudi Arabia were upset Blackberry did not hand over encryption keys to the countries, not that they were worried about messages being routed elsewhere. I could be wrong though.
Also where does Apple say it stores the messages indefinitely? Do you have a link to their policy?

 

[MonkeySee....]

I am surprised that you do not consider a risk or a privacy concern the fact that Apple stores all your iMessage conversations for an indefinite amount of time.

Since I do not live in the US, it concerns me that a US based company is keeping a record of all my conversations, without actually notifying me or giving me the option to delete those conversations.

Do they ever delete these conversations, even after they deliver them to my devices? You don't know, but it seems that they actually do.

Let me point that this was the reason why Blackberry service was prohibited from operating in many countries around the world; local authorities felt that there was a security and privacy concern when their citizen's messages were routed and stored in another country, beyond their legislation.

All you messages are stored somewhere whether you like it or not. Just ask the police

 

[akouris]

And google keeps your email. And dropbox has your files. And AT&T knows who you called and how long you spoke to them and what you texted them.

If this stuff bothers you (and it's fine if it does) then I'm kind of surprised you have an iPhone at all. What's the point in owning a device like this if you're not going to use any online services? There are cheaper devices if all you want to do is watch videos.

You expect Google to keep your mails, because you actually see them everytime you log into their service. They do give you the option to delete everything, including your profile/identity, and they go to great lengths to ensure that this is done.

Would you feel "ok" if you realized that since you have been using AT&T's network to speak, they have actually stored all your voice conversations (without ever telling you that) and they will be keeping them stored for an indefinite amount of time?

 

[dontpannic]

Jesus. Tin foil hat brigade or what! I live in the UK and I couldn't care less where my messages are stored. If ever anyone were to look at them they'd just see banter between mates and when and where I'm picking someone up from.

Unless you're plotting a terrorist attack then I wouldn't worry!

 

[akouris]

Also where does Apple say it stores the messages indefinitely? Do you have a link to their policy?

Apple does not appear to have a specific policy regarding iMessage - and that is the main concern.

 

[Small White Car]

Would you feel "ok" if you realized that since you have been using AT&T's network to speak, they have actually stored all your voice conversations (without ever telling you that) and they will be keeping them stored for an indefinite amount of time?

Honestly I somewhat expect that this could be happening already. I also don't really believe Gmail can be totally erased.

It's funny that people are calling you a tin-foil hat wearer when it seems that you trust all these companies far MORE than I do.

 

[mrapplegate]

Apple does not appear to have a specific policy regarding iMessage - and that is the main concern.

They might have a policy. Better yet, ask them.

 

[akouris]

Honestly I somewhat expect that this could be happening already. I also don't really believe Gmail can be totally erased.

It's funny that people are calling you a tin-foil hat wearer when it seems that you trust all these companies far MORE than I do.

The issue is not what you somewhat expect, but what is legally or illegally happening, and whether the company that offers you the service notifies you about it.

I am pretty sure that most people using iMessage expect that they have the same privacy level as they do when they use the antiquated SMS (or better), when that apparently is not true.

 

[mrapplegate]

The issue is not what you somewhat expect, but what is legally or illegally happening, and whether the company that offers you the service notifies you about it.

I am pretty sure that most people using iMessage expect that they have the same privacy level as they do when they use the antiquated SMS (or better), when that apparently is not true.

Who expects privacy using SMS? Any official with a warrant from a judge can compel a phone company to release SMS messages. There is no such thing as privacy these days.

 

[aristobrat]

So my questions are:
1. Why does Apple keep a copy of all the iMessage conversations for an indefinite amount of time?
2. Why is this not mentioned anywhere?
3. Why does not Apple give you the option to delete all that archived history of iMessages from their servers?

Here's a link where you can ask Apple directly:
http://www.apple.com/privacy/contact/

Let us know what they say.

----------

But to answer your question, when you start up your iOS device for the first time, you have to click the button that says you agree to the Terms of Service.

This is what the Terms of Service you agreed to says about iMessage.

(e) iMessage. The messaging feature of the iOS Software (“iMessage”) may not be available in all countries or regions. Your use of iMessage is subject to your compliance with Section 2(e) above. In order to set up iMessage, and to initiate and receive iMessages between you and other iOS Device users, certain unique identifiers for your iOS Device and account are needed. These unique identifiers may include your email address(es), the Apple ID information you provide, a hardware identifier for your iOS Device, and your iPhone’s telephone number. By using the iOS Software, you agree that Apple may transmit, collect, maintain, process and use these identifiers for the purpose of providing and improving the iMessage service. The iMessage service requires a Wi-Fi or cellular data connection. To facilitate delivery of your iMessages and to enable you to maintain conversations across your devices, Apple may hold your iMessages in encrypted form for a limited period of time. If your message cannot be sent as an iMessage, your message may be sent as an SMS or MMS message, for which carrier messaging rates may apply. You understand that your iPhone’s telephone number will be displayed to the other party (even if you have a blocked number) or your email address will be shown, depending on what setting you choose. You may turn off the iMessage service by going to the Messages setting on your iOS Device.

http://images.apple.com/legal/sla/docs/iOS6.pdf

 

[Rigby]

Who expects privacy using SMS? Any official with a warrant from a judge can compel a phone company to release SMS messages. There is no such thing as privacy these days.

Well, some countries (especially in Europe) have far stricter privacy and data retention laws than the US. In Germany, for example, telecom operators are not allowed to store communication data longer than necessary for operational reasons (e.g. for billing purposes). I think there are good reasons to be concerned about Apple's privacy policies, especially considering that not just the government, but also hackers could get access to your information (remember the Honan hack?).

 

[mrapplegate]

Well, some countries (especially in Europe) have far stricter privacy and data retention laws than the US. In Germany, for example, telecom operators are not allowed to store communication data longer than necessary for operational reasons (e.g. for billing purposes). I think there are good reasons to be concerned about Apple's privacy policies, especially considering that not just the government, but also hackers could get access to your information (remember the Honan hack?).

I don't claim to understand privacy policies in other countries. I was making a general claim that these days there is not much privacy. Most governments can request access to data and get it with court approval or maybe with no court approval. Even with strict policy, who defines what operational reasons are, 30 days then data is deleted?
I compare SMS, iMessage and email to a post card. If you don't want people to read it or force a company to reveal it, encrypt it using PGP or something else.

 

[ggmissmolly]

Who are you, David Patraeus? All of your e-mails, web sites, and third party storage files are saved by somebody. Where have you been? Use the regular mail and then hope the receiver doesn't retain you letters for future blackmail. There never was any privacy. Get over it. As long as you are just an ant in the hill nobody cares.

 

[scaredpoet]

I am surprised that you do not consider a risk or a privacy concern the fact that Apple stores all your iMessage conversations for an indefinite amount of time.

You have not established this as fact. You have conjecture based on observation, but no actual proof that messages are held indefinitely.

How do we know, for instance, that Apple isn't just polling data from your other iDevices and using the messages stored there to re-sync your dis-used MacBook Air? Apple might not be storing ANY messages. It could well be just using the messages YOU have stored yourself to populate the other devices sharing the same account.

Since I do not live in the US, it concerns me that a US based company is keeping a record of all my conversations, without actually notifying me or giving me the option to delete those conversations.

Your concerns are very easily allayed:

Let me point that this was the reason why Blackberry service was prohibited from operating in many countries around the world; local authorities felt that there was a security and privacy concern when their citizen's messages were routed and stored in another country, beyond their legislation.

You grossly misinterpret the motives of those local authorities. The "privacy and security" of their citizens played no part in those prohibitions, at all. Their concerns were not altruistic, that their poor, poor citizens could have their privacy violated by this evil foreign corporation. Quite the contrary: having messages encrypted and routed on servers outside of their legal jurisdiction meant it was harder for them to gain access to and read those messages for themselves. The fact that RIM capitulated in many instances by establishing servers in those countries has actually made BBM less secure, as those local authorities you hold in such high esteem now hold the keys to decrypt and eavesdrop on any traffic that passes through those locally-hosted servers.

When one wears a tinfoil hat, it's amazing how many holes they're willing to poke into it, and point those holes in all the wrong places.

 

[stoneland]

And google keeps your email. And dropbox has your files. And AT&T knows who you called and how long you spoke to them and what you texted them.

If this stuff bothers you (and it's fine if it does) then I'm kind of surprised you have an iPhone at all. What's the point in owning a device like this if you're not going to use any online services? There are cheaper devices if all you want to do is watch videos.

Agree...pretty much everything is logged in some way, shape, or form. That's just the way things are going.

 

[Rigby]

And google keeps your email. And dropbox has your files. And AT&T knows who you called and how long you spoke to them and what you texted them.

AT&T does not store the content of your text messages:

http://www.wired.com/threatlevel/2011/09/cellular-customer-data/

They do keep records of who, when and from where you text or call for several years though (which would be illegal in most EU countries).

If this stuff bothers you (and it's fine if it does) then I'm kind of surprised you have an iPhone at all. What's the point in owning a device like this if you're not going to use any online services? There are cheaper devices if all you want to do is watch videos.

Using online services doesn't mean we have to give up our privacy. These things can be regulated.

 

[Jare]

How about you stop sending naughty / embarrassing iMessages. If you're not doing that, what the **** are you worried about? Who cares if they store it. Oh no, Apple knows you texted Bob at 4:19pm "I'm hungry". TINFOIL HAT!

 

[Small White Car]

AT&T does not store the content of your text messages:

http://www.wired.com/threatlevel/2011/09/cellular-customer-data/

Once I got a text message from someone 24 hours after they sent it. So for 24 hours that data was living in AT&T's computers.

So they say it's not saved at all and I say it can stay on their servers at least a day, apparently. So now that we know the statement isn't true who's to say where the truth really lies? 2 days? 3? A week? A month?

No way to know, unfortunately, since we know that what they're telling you is a lie.