| It doesn’t really matter how Apple is doing because the rules of cryptography are set in stone. - To ensure that you message is unreadable, you must correctly encrypt the data symmetrically or asymmetrically with a key. Well we can assume Apple or Meta can do this properly. - Second, as the sender or recipient, you MUST verify the authenticity of the key, whether you are using asymmetric or symmetric encryption. In TLS/SSL, key verification is handled by third parties called certificate authorities. In SSH, key verification is handled by comparing the key signature that the SSH client displays. Most of these services right now do not do either (trusted third party or display of a key), therefore it cannot be verified overall.
(That said, some people said they are doing what SSH is doing soon.) I’m happy Apple is doing those things to exchange your own key between your own devices. This is already way better than most services. However, that problem is orthogonal to the problem of key exchange between you and a recipient. |