3 ms·

> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. I'm surprised by this statement. After recent

by hannob 11y ago

> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. I'm surprised by this statement. After recent events I'd say the imessage protocoll is a weird ad-hoc construction that failed to follow basic modern crypto constructions like authenticated encryption and forward secrecy. I don't expect anything alike from the signal protocol.

pilif 11y ago
The one thing iMessage and WhatsApp have in common is that they both end-to-end encrypt without giving the user control over the keys being used. So ignoring actual protocol and implementation flaws (I agree with you that WhisperSystems will probably be ahead of Apple there), both rely on the key management being done in a thrustworthy manner. And this is where I trust Apple more than Facebook, especially in light of the recent FBI events. If Apple says they are not maliciously injecting fake public keys for the purpose of surveillance and marketing, I tend to believe Apple. If Facebook is silent about this, I assume they are doing it.
- ianmiers 11y ago
  WhatsApp allows you to verify keys. Apple doesn't. This makes a pretty big difference. Also, iMessage's crypto protocol is cryptographically broken. It's been patched together in ways that prevent the obvious attack, but don't actually fix the underlying issue. Doing so involves replacing the protocol. In the mean time, those patches are not fool proof and someone may get around them.
  - pilif 11y ago
    > Whats App allows you to verify keys. Apple doesn't. This makes a pretty big difference. Does it? It allows me to verify a key. It doesn't give me any ability to control what other keys it's working with. This only helps me to make sure that the message I just got, I actually got from the person it's claiming to be. It doesn't give me any other protection though. I agree about the broken iMessage crypto and I hope to see Apple upgrade the protocol in a future OS release. With their quick uptake of new OSes, a fix could propagate relatively quickly.

by hannob 11y ago

pilif 11y ago

The one thing iMessage and WhatsApp have in common is that they both end-to-end encrypt without giving the user control over the keys being used. So ignoring actual protocol and implementation flaws (I agree with you that WhisperSystems will probably be ahead of Apple there), both rely on the key management being done in a thrustworthy manner. And this is where I trust Apple more than Facebook, especially in light of the recent FBI events. If Apple says they are not maliciously injecting fake public keys for the purpose of surveillance and marketing, I tend to believe Apple. If Facebook is silent about this, I assume they are doing it.

ianmiers 11y ago
WhatsApp allows you to verify keys. Apple doesn't. This makes a pretty big difference. Also, iMessage's crypto protocol is cryptographically broken. It's been patched together in ways that prevent the obvious attack, but don't actually fix the underlying issue. Doing so involves replacing the protocol. In the mean time, those patches are not fool proof and someone may get around them.
- pilif 11y ago
  > Whats App allows you to verify keys. Apple doesn't. This makes a pretty big difference. Does it? It allows me to verify a key. It doesn't give me any ability to control what other keys it's working with. This only helps me to make sure that the message I just got, I actually got from the person it's claiming to be. It doesn't give me any other protection though. I agree about the broken iMessage crypto and I hope to see Apple upgrade the protocol in a future OS release. With their quick uptake of new OSes, a fix could propagate relatively quickly.