5 ms·

You can receive messages on multiple devices. So it would be easy for Apple to simply add a new device without showing you.

by gsich 9y ago

jtbayly 9y ago
What’s your point? The question at hand is whether any major company would allow consumers to send messages the company can’t harvest for data. The answer is yes. Apple does. Are you saying they don’t? —That they actually have backdoored their E2E messaging app already? If you are just saying that it’s not entirely impossible for them to do backdoor, I don’t see what bearing that has on the discussion.
- gsich 9y ago
  Why backdoor the messaging app, when you can just add a new device. Apple does, but as far as trust goes, they are on the same level as WhatsApp (also E2E).
  - briandear 9y ago
    WhatsApp is part of Facebook. Claiming Apple is on the same level as a Facebook-owned entity is absurd. Apple can’t see who your contacts are (it’s encrypted in iCloud) but Facebook can.
    - gsich 9y ago
      So Apple delivers your messages via magic? You are logged in from one endpoint. So Apple knows that you are you. It does also know who your other chat partner is. At some point there is a transmission of data from A to B. I don't see a way to hide the metadata if the data is transmitted through Apples network. If it's P2P, then yes.
Angostura 9y ago
From: https://techcrunch.com/2014/02/27/apple-explains-exactly-how-secure-imessage-really-is/ https://techcrunch.com/2014/02/27/apple-explains-exactly-how... You’ve actually got one set of keys for each device you add to iCloud, and each iMessage is encrypted independently for each device. So if you have two devices — say, an iPad and an iPhone — each message sent to you is actually encrypted (AES-128) and stored on Apple’s servers twice. Once for each device. When you pull down a message, it’s specifically encrypted for the device you’re on.
- gsich 9y ago
  Yes. This does not contradict the parent post.
  - 1inuxoid 9y ago
    Why is this being downvoted? Is there something that guarantees visibility of unknown devices linked to an iCloud-account?
    - vxNsr 9y ago
      Because it's missing the point that a sibling makes.
briandear 9y ago
Not true. They would have to have access to your iCloud credentials and you would have to confirm the new device from one of your old devices.
- zwily 9y ago
  Or they could push out a (targeted) software update that lets them do that silently. I don’t think they would, but they could.
  - newscracker 9y ago
    I don't think there's any messaging platform in the world that's immune to this kind of an attack. So singling out Apple is pointless in that context.
    - zwily 9y ago
      Agreed. See https://news.ycombinator.com/item?id=16903916 https://news.ycombinator.com/item?id=16903916.
nothrabannosir 9y ago
Your comment is close to hitting the weak point: you have to trust Apple. If you can’t, then this single / multiple devices detail doesn’t matter: they could find a million ways to silently subvert the encryption in a closed source app on a closed source OS. But if you can, then waxing on details doesn’t matter either: you trust them, so you trust them. The thing is: it is valid to trust a company to keep their explicit word. That’s a different issue from trusting a company who never explicitly said they wouldn’t listen to your data: companies can be held liable for these sorts of public statements. If Facebook silently (knowingly) subverts Whatsapp E2E, they’re in trouble. But reading regular Facebook messages for ads? Storing them plain text? They never said they wouldn’t. This is why Apple explicitly stating they E2E iMessage is a data point with value. It is valid to trust Apple more now, simply because they’ve upped the stakes for themselves. Compare this to a bar bet: someone makes a claim, I am sceptical. They say, honest! Still sceptical. They say ok, bet you £300. I suddenly am much more inclined to believe them. No money changed hands :)
newscracker 9y ago
Whenever a new device (AppleID/phone number) is associated with Messages/iMessage, a notification appears on other devices saying something like "Your phone number is now being used for iMessage on <device>", along with some more text. Apple also sends an email about that to the email address associated with the iCloud account. So I don't understand what you mean by "it would be easy for Apple to simply add a new device without showing you". If that refers to Apple circumventing this kind of warning for specific users for some reason, then I guess other popular messaging platforms/apps cannot be trusted either.

You can receive messages on multiple devices. So it would be easy for Apple to simply add a new device without showing you.

by gsich 9y ago

You can receive messages on multiple devices. So it would be easy for Apple to simply add a new device without showing you.

jtbayly 9y ago

What’s your point? The question at hand is whether any major company would allow consumers to send messages the company can’t harvest for data. The answer is yes. Apple does. Are you saying they don’t? —That they actually have backdoored their E2E messaging app already? If you are just saying that it’s not entirely impossible for them to do backdoor, I don’t see what bearing that has on the discussion.

gsich 9y ago
Why backdoor the messaging app, when you can just add a new device. Apple does, but as far as trust goes, they are on the same level as WhatsApp (also E2E).
- briandear 9y ago
  WhatsApp is part of Facebook. Claiming Apple is on the same level as a Facebook-owned entity is absurd. Apple can’t see who your contacts are (it’s encrypted in iCloud) but Facebook can.
  - gsich 9y ago
    So Apple delivers your messages via magic? You are logged in from one endpoint. So Apple knows that you are you. It does also know who your other chat partner is. At some point there is a transmission of data from A to B. I don't see a way to hide the metadata if the data is transmitted through Apples network. If it's P2P, then yes.

Angostura 9y ago

From: https://techcrunch.com/2014/02/27/apple-explains-exactly-how-secure-imessage-really-is/ https://techcrunch.com/2014/02/27/apple-explains-exactly-how... You’ve actually got one set of keys for each device you add to iCloud, and each iMessage is encrypted independently for each device. So if you have two devices — say, an iPad and an iPhone — each message sent to you is actually encrypted (AES-128) and stored on Apple’s servers twice. Once for each device. When you pull down a message, it’s specifically encrypted for the device you’re on.

gsich 9y ago
Yes. This does not contradict the parent post.
- 1inuxoid 9y ago
  Why is this being downvoted? Is there something that guarantees visibility of unknown devices linked to an iCloud-account?
  - vxNsr 9y ago
    Because it's missing the point that a sibling makes.

briandear 9y ago

Not true. They would have to have access to your iCloud credentials and you would have to confirm the new device from one of your old devices.

zwily 9y ago
Or they could push out a (targeted) software update that lets them do that silently. I don’t think they would, but they could.
- newscracker 9y ago
  I don't think there's any messaging platform in the world that's immune to this kind of an attack. So singling out Apple is pointless in that context.
  - zwily 9y ago
    Agreed. See https://news.ycombinator.com/item?id=16903916 https://news.ycombinator.com/item?id=16903916.

nothrabannosir 9y ago

Your comment is close to hitting the weak point: you have to trust Apple. If you can’t, then this single / multiple devices detail doesn’t matter: they could find a million ways to silently subvert the encryption in a closed source app on a closed source OS. But if you can, then waxing on details doesn’t matter either: you trust them, so you trust them. The thing is: it is valid to trust a company to keep their explicit word. That’s a different issue from trusting a company who never explicitly said they wouldn’t listen to your data: companies can be held liable for these sorts of public statements. If Facebook silently (knowingly) subverts Whatsapp E2E, they’re in trouble. But reading regular Facebook messages for ads? Storing them plain text? They never said they wouldn’t. This is why Apple explicitly stating they E2E iMessage is a data point with value. It is valid to trust Apple more now, simply because they’ve upped the stakes for themselves. Compare this to a bar bet: someone makes a claim, I am sceptical. They say, honest! Still sceptical. They say ok, bet you £300. I suddenly am much more inclined to believe them. No money changed hands :)

newscracker 9y ago

Whenever a new device (AppleID/phone number) is associated with Messages/iMessage, a notification appears on other devices saying something like "Your phone number is now being used for iMessage on <device>", along with some more text. Apple also sends an email about that to the email address associated with the iCloud account. So I don't understand what you mean by "it would be easy for Apple to simply add a new device without showing you". If that refers to Apple circumventing this kind of warning for specific users for some reason, then I guess other popular messaging platforms/apps cannot be trusted either.