5 ms·

To Apple's non-credit, it's still tying iMessage backups to iCloud backups despite years of criticism over this. That means everyone who uses iCloud backups (en

by mtgx 9y ago

To Apple's non-credit, it's still tying iMessage backups to iCloud backups despite years of criticism over this. That means everyone who uses iCloud backups (enabled by default on iPhones) don't actually benefit from iMessage's "end-to-end encryption" (which isn't that safe against sophisticated hackers or oppressive authorities to begin with). I'd say people may as well forget about Apple's "privacy stance". It's nothing but smokescreen at this point (yes, even in the U.S.).

abalone 9y ago
> iMessage's "end-to-end encryption" (which isn't that safe against sophisticated hackers or oppressive authorities to begin with) Could you support this claim please? Re: iCloud backups you're correct. So far. They're about to release iMessages-in-iCloud though, which might obviate the need to include them in iCloud backups.
- vengefulduck 9y ago
  iMessage uses short RSA 1280-bit keys which could be cracked by a well funded attacker. [1]https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  - snuxoll 9y ago
    1280-bit keys are still mostly sufficient for now, this isn’t a website where every party is relying on the key of the server being heavily resistant to protects millions of users - every device has a unique key. Still, you are correct that a determined adversary, potentially one capable of purchasing a quantum computer with enough quibits could factor the device key. It would be nice to see Apple move to a large enough ECC key which would improve security against quantum computing attacks in particular.
    - fossuser 9y ago
      I don’t think there any quantum computers yet? The last I heard there was one example of factoring 15 and I think it assumed the factors? Did something change?
      - snuxoll 9y ago
        True ones are still off in the near future, ones with enough quibits for Shor’s algorithm are far enough away for now as well - which is why I generally feel safe with the current level of cryptography Apple uses with iMessage. I won’t underestimate the rate at which they are developed though, it takes 2x the key size as the number of quibits to run Shor’s algorithm - ~2600 is a lot smaller than 4096, and even then who knows how much time we have until that happens.
madeofpalk 9y ago
My understanding is that Apple recently enabled end to end encryption for iOS backups using your password?
- abalone 9y ago
  Just keychain backups. However they could extend that mechanism to other data. I’m excited to see what they do with iMessage-on-iCloud which is very close to release.
ztjio 9y ago
So don't use iCloud backups. You're never required to. You can trivially back up through iTunes, even automatically via Wi-Fi assuming you have them on the same network regularly. Anyone concerned about privacy, the first thing they should be ensuring is they are NOT using iCloud backup.
- jzoch 9y ago
  You're correct, though its Apple's MO to supply security in an intuitive manner. IF you tout all these parts of your platform as secure and have one insecure piece that interfaces with it then it isnt a secure platform. The onus should be on Apple to secure iCloud. To their credit, I think they know that and will be. Those who are knowledgeable and care about security will continue to stay ahead of those who aren't, but Apple is making the division smaller.
- ballenf 9y ago
  Given that Apple recently removed the ability to buy apps from iTunes, I think the writings's on the wall for the ability to locally backup iOS devices. Which is a huge shame. My guess is they're waiting for more complete coverage in terms of iCloud functionality and maybe security. But Apple has been known to pull the plug on "pro" functionality like this and/or remove functionality before the replacement was quite ready yet.
  - r00fus 9y ago
    What was the use case for buying apps on iTunes as opposed to any one of your iOS devices?
    - tluyben2 9y ago
      Legacy maybe? You could only buy from iTunes in the beginning.
  - thisacctforreal 9y ago
    For many years it has been possible to backup iOS devices using the native protocols, thanks to libimobiledevice. http://www.libimobiledevice.org http://www.libimobiledevice.org On macOS (I also use it on Linux, haven't tried on Windows): brew install libimobiledevice ## to disable iCloud backups idevicebackup2 cloud off ## if you want encrypted backups (native encryption) idevicebackup2 encryption on -i ## backup to a folder idevicebackup2 backup backup-folder ## restore from a backup idevicebackup2 restore backup-folder This uses the same format as iTunes, which stores them in ~/Library/Application Support/MobileSync/Backup There are more utilities included: idevice_id idevicedebugserverproxy idevicenotificationproxy idevicebackup idevicediagnostics idevicepair idevicebackup2 ideviceenterrecovery ideviceprovision idevicecrashreport ideviceimagemounter idevicescreenshot idevicedate ideviceinfo idevicesyslog idevicedebug idevicename iproxy You can also mount your iPhone's filesystem using ifuse (the only one in a separate package): brew cask install osxfuse brew install ifuse ## mount your iPhone ifuse mount-point ## unmount, or eject using Finder umount mount-point Parts of these protocols have been around since the first iPhones, I find it highly unlikely Apple will remove these anytime soon.

by mtgx 9y ago

abalone 9y ago

> iMessage's "end-to-end encryption" (which isn't that safe against sophisticated hackers or oppressive authorities to begin with) Could you support this claim please? Re: iCloud backups you're correct. So far. They're about to release iMessages-in-iCloud though, which might obviate the need to include them in iCloud backups.

vengefulduck 9y ago
iMessage uses short RSA 1280-bit keys which could be cracked by a well funded attacker. [1]https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- snuxoll 9y ago
  1280-bit keys are still mostly sufficient for now, this isn’t a website where every party is relying on the key of the server being heavily resistant to protects millions of users - every device has a unique key. Still, you are correct that a determined adversary, potentially one capable of purchasing a quantum computer with enough quibits could factor the device key. It would be nice to see Apple move to a large enough ECC key which would improve security against quantum computing attacks in particular.
  - fossuser 9y ago
    I don’t think there any quantum computers yet? The last I heard there was one example of factoring 15 and I think it assumed the factors? Did something change?
    - snuxoll 9y ago
      True ones are still off in the near future, ones with enough quibits for Shor’s algorithm are far enough away for now as well - which is why I generally feel safe with the current level of cryptography Apple uses with iMessage. I won’t underestimate the rate at which they are developed though, it takes 2x the key size as the number of quibits to run Shor’s algorithm - ~2600 is a lot smaller than 4096, and even then who knows how much time we have until that happens.

madeofpalk 9y ago

My understanding is that Apple recently enabled end to end encryption for iOS backups using your password?

abalone 9y ago
Just keychain backups. However they could extend that mechanism to other data. I’m excited to see what they do with iMessage-on-iCloud which is very close to release.

ztjio 9y ago

So don't use iCloud backups. You're never required to. You can trivially back up through iTunes, even automatically via Wi-Fi assuming you have them on the same network regularly. Anyone concerned about privacy, the first thing they should be ensuring is they are NOT using iCloud backup.

jzoch 9y ago
You're correct, though its Apple's MO to supply security in an intuitive manner. IF you tout all these parts of your platform as secure and have one insecure piece that interfaces with it then it isnt a secure platform. The onus should be on Apple to secure iCloud. To their credit, I think they know that and will be. Those who are knowledgeable and care about security will continue to stay ahead of those who aren't, but Apple is making the division smaller.
ballenf 9y ago
Given that Apple recently removed the ability to buy apps from iTunes, I think the writings's on the wall for the ability to locally backup iOS devices. Which is a huge shame. My guess is they're waiting for more complete coverage in terms of iCloud functionality and maybe security. But Apple has been known to pull the plug on "pro" functionality like this and/or remove functionality before the replacement was quite ready yet.
- r00fus 9y ago
  What was the use case for buying apps on iTunes as opposed to any one of your iOS devices?
  - tluyben2 9y ago
    Legacy maybe? You could only buy from iTunes in the beginning.
- thisacctforreal 9y ago
  For many years it has been possible to backup iOS devices using the native protocols, thanks to libimobiledevice. http://www.libimobiledevice.org http://www.libimobiledevice.org On macOS (I also use it on Linux, haven't tried on Windows): brew install libimobiledevice ## to disable iCloud backups idevicebackup2 cloud off ## if you want encrypted backups (native encryption) idevicebackup2 encryption on -i ## backup to a folder idevicebackup2 backup backup-folder ## restore from a backup idevicebackup2 restore backup-folder This uses the same format as iTunes, which stores them in ~/Library/Application Support/MobileSync/Backup There are more utilities included: idevice_id idevicedebugserverproxy idevicenotificationproxy idevicebackup idevicediagnostics idevicepair idevicebackup2 ideviceenterrecovery ideviceprovision idevicecrashreport ideviceimagemounter idevicescreenshot idevicedate ideviceinfo idevicesyslog idevicedebug idevicename iproxy You can also mount your iPhone's filesystem using ifuse (the only one in a separate package): brew cask install osxfuse brew install ifuse ## mount your iPhone ifuse mount-point ## unmount, or eject using Finder umount mount-point Parts of these protocols have been around since the first iPhones, I find it highly unlikely Apple will remove these anytime soon.