4 ms·
Based on the paper, the title should include "WAS" or "FIXED" or something like that. And in a side note, that's why I dislike that journalists have been train
by spdustin 10y ago
Based on the paper, the title should include "WAS" or "FIXED" or something like that.
And in a side note, that's why I dislike that journalists have been trained to remove so many words from headline copy by default.
- hannob 10y agoHave you read the article? The underlying problems have not been fixed. They added some band aids to prevent the specific attack Green found, yet the protocol is still a big mess, an ad-hoc design that is doing a couple of things that every cryptographer who knows a thing about modern crypto designs knows to avoid.
- r00fus 10y agoThe article suggests to replace iMessage with Signal protocol but fails to describe exactly how Signal is better. If that's the "fix" you can see why it hasn't been done and we instead have several mitigations instead.
- hannob 10y agoThe article explains in great length what the problem of iMessage is. It has no forward secrecy and uses no authenticated encryption. Signal does both. The flaw Matthew Green's team found is precisely due to the fact that iMessage is not using authenticated encryption (as are tons of other crypto flaws). As said: They added some band aid, they have not fixed the problem.
- ejcx 10y agoSignal would be an improvement, but the status of signal as open source, and the details of what you get security wise is not very transparent with all of these new "signal integrations" that open whisper is doing. Signal is definitely moving things in the right direction but I wish there was more research in this "signal integration" space. Do you know of any research here?