5 ms·

That article does not say that Apple is encrypting the per-message key with an Apple public key (alongside the device-specific keys), just that it could. Yes, t

by zwily 9y ago

That article does not say that Apple is encrypting the per-message key with an Apple public key (alongside the device-specific keys), just that it could. Yes, there are many ways Apple could bypass its own E2E encryption, but we haven’t seen any evidence that it is or has.

_o_ 9y ago
Well, the point of E2E encryption is that you cant bypass it. That only the recipient is able to read it. Believe me that if I start making e2e encryption, no one will bypass it and I doubt the engineers at Apple are not able to do it, unless instructed otherwise. I will tell you another case: Skype. It had a p2p protocol, highly encrypted and obfuscated, also the application was armored. The communication wasn't going through Skype servers but directly between devices. Once Microsoft bought it, the next version was using Microsoft servers and p2p was gone. Interesting, right?
- zwily 9y ago
  I'd be curious to hear a proposal on how Apple could implement an E2E encrypted messaging service in a way that it would be impossible for them to circumvent it in the future via a software update. I suspect it's not possible, and therefore, either you accept some trust in Apple and take their model as "good enough" or you don't trust them at all (meaning you don't use iOS or macOS). There are, of course, lots of people that do that. But for most the population of iOS users, I think the iMessage model is very much good enough.
  - jhasse 9y ago
    > I'd be curious to hear a proposal on how Apple could implement an E2E encrypted messaging service in a way that it would be impossible for them to circumvent it in the future via a software update. Open source. And for really impossible also open hardware.
    - newscracker 9y ago
      How would anyone validate what exactly is running on the servers at any point in time so that you can trust it every single second? At some point, it comes down to trusting someone or the other.
      - jhasse 9y ago
        Sure, but it's better if I don't have to trust Apple but let's say Mozilla IMHO.

by zwily 9y ago

_o_ 9y ago

Well, the point of E2E encryption is that you cant bypass it. That only the recipient is able to read it. Believe me that if I start making e2e encryption, no one will bypass it and I doubt the engineers at Apple are not able to do it, unless instructed otherwise. I will tell you another case: Skype. It had a p2p protocol, highly encrypted and obfuscated, also the application was armored. The communication wasn't going through Skype servers but directly between devices. Once Microsoft bought it, the next version was using Microsoft servers and p2p was gone. Interesting, right?

zwily 9y ago
I'd be curious to hear a proposal on how Apple could implement an E2E encrypted messaging service in a way that it would be impossible for them to circumvent it in the future via a software update. I suspect it's not possible, and therefore, either you accept some trust in Apple and take their model as "good enough" or you don't trust them at all (meaning you don't use iOS or macOS). There are, of course, lots of people that do that. But for most the population of iOS users, I think the iMessage model is very much good enough.
- jhasse 9y ago
  > I'd be curious to hear a proposal on how Apple could implement an E2E encrypted messaging service in a way that it would be impossible for them to circumvent it in the future via a software update. Open source. And for really impossible also open hardware.
  - newscracker 9y ago
    How would anyone validate what exactly is running on the servers at any point in time so that you can trust it every single second? At some point, it comes down to trusting someone or the other.
    - jhasse 9y ago
      Sure, but it's better if I don't have to trust Apple but let's say Mozilla IMHO.