3 ms·

End to end encryption isn't super useful if one or both endpoints are compromised.

by Phlarp 8y ago

m0zg 8y ago
Exactly my point. If someone else other than Sanchez had access to her phone, E2E encryption won't do shit. But to say that anyone is able to magically "intercept" E2E encrypted communications out of thin air is total bullshit. If I were Bezos, I'd refuse to pay for this "investigation".
- Twirrim 8y ago
  > Our investigators and several experts concluded with high confidence that the Saudis had access to Bezos’ phone, and gained private information. As of today, it is unclear to what degree, if any, AMI was aware of the details. Note the words "Had access to Bezos' phone". E2E encryption means bugger all when someone has access to one end. There's other comments in the article that give the impression Bezos' phone was compromised.
  - m0zg 8y ago
    How did they "gain access" to it? I want to know the details, not some bullshit a reporter made up on the spot. Read the iOS security whitepaper. It does not seem possible to "gain access" to iOS devices unless you have physical access, and are able to unlock the device. There's layer upon layer of security, some of which go all the way down to a tamper-proof chip. Every app encrypts its files with different keys, so cross-contamination between apps is not possible. Everything is encrypted, with multiple distinct keys, managed by dedicated hardware. Not even the FBI and NSA can "gain" unauthorized access to it. Heck, not even Apple can. You are being fed a narrative. You should recognize this when it happens if you don't want to continue being a sucker.
    - Twirrim 8y ago
      > not some bullshit a reporter made up on the spot This article wasn't written by a reporter, which doesn't bode well for your reading comprehension skills. > You are being fed a narrative. You should recognize this when it happens if you don't want to continue being a sucker. You're making a really big assumption about what I am, or am not, taking from the article.
    - Phlarp 8y ago
      You seem really invested in this either not being the Saudi's or being Sanchez (or her brother-in-law as has been speculated). Given the political situation surrounding this whole story is best summarized as "a double shit sandwich, extra runny" I'm wondering if your feelings on the politics are clouding your technical judgement? Of if you are outright trying to spread disinformation. We have pretty ample evidence that FBI can indeed get into iPhones when needed[0] and I don't think it's a leap to assume that if the FBI can do it, CIA and NSA won't have issues with it either. I suspect Saudi intel services are capable of throwing money at the same vendors that the FBI uses. Apple takes great care to make things as secure as possible but even the most sophisticated encryption schemes are broken when you can arbitrarily, remotely and silently screenshot the data in question. Bezos is the richest man in the world, he's not hiring some fly-by-night security consultancy. He personally employs some of the smartest information security consultants on the planet through Amazon. They also provide cloud services directly to the military and intelligence agencies. He's got plenty of knowledgeable contacts to consult with. [0] https://thehackernews.com/2017/10/apple-fbi-iphone-unlock.html https://thehackernews.com/2017/10/apple-fbi-iphone-unlock.ht...
- johnwyles 8y ago
  Wait. Even if you have access to the device how do you get app-to-app access of the underlying texts unless there is a hack unknown to Apple. I know there are barriers Apple has built in where developers cannot access the text messages because of many obvious reasons for abuse. Perhaps Pegasus knows of a "0 day" or multiple and use this? However, E2E encryption PLUS Apples security model around text messaging in iOS should prevent it.
  - Phlarp 8y ago
    Or a screenshot

End to end encryption isn't super useful if one or both endpoints are compromised.

by Phlarp 8y ago

End to end encryption isn't super useful if one or both endpoints are compromised.

m0zg 8y ago

Exactly my point. If someone else other than Sanchez had access to her phone, E2E encryption won't do shit. But to say that anyone is able to magically "intercept" E2E encrypted communications out of thin air is total bullshit. If I were Bezos, I'd refuse to pay for this "investigation".

Twirrim 8y ago
> Our investigators and several experts concluded with high confidence that the Saudis had access to Bezos’ phone, and gained private information. As of today, it is unclear to what degree, if any, AMI was aware of the details. Note the words "Had access to Bezos' phone". E2E encryption means bugger all when someone has access to one end. There's other comments in the article that give the impression Bezos' phone was compromised.
- m0zg 8y ago
  How did they "gain access" to it? I want to know the details, not some bullshit a reporter made up on the spot. Read the iOS security whitepaper. It does not seem possible to "gain access" to iOS devices unless you have physical access, and are able to unlock the device. There's layer upon layer of security, some of which go all the way down to a tamper-proof chip. Every app encrypts its files with different keys, so cross-contamination between apps is not possible. Everything is encrypted, with multiple distinct keys, managed by dedicated hardware. Not even the FBI and NSA can "gain" unauthorized access to it. Heck, not even Apple can. You are being fed a narrative. You should recognize this when it happens if you don't want to continue being a sucker.
  - Twirrim 8y ago
    > not some bullshit a reporter made up on the spot This article wasn't written by a reporter, which doesn't bode well for your reading comprehension skills. > You are being fed a narrative. You should recognize this when it happens if you don't want to continue being a sucker. You're making a really big assumption about what I am, or am not, taking from the article.
  - Phlarp 8y ago
    You seem really invested in this either not being the Saudi's or being Sanchez (or her brother-in-law as has been speculated). Given the political situation surrounding this whole story is best summarized as "a double shit sandwich, extra runny" I'm wondering if your feelings on the politics are clouding your technical judgement? Of if you are outright trying to spread disinformation. We have pretty ample evidence that FBI can indeed get into iPhones when needed[0] and I don't think it's a leap to assume that if the FBI can do it, CIA and NSA won't have issues with it either. I suspect Saudi intel services are capable of throwing money at the same vendors that the FBI uses. Apple takes great care to make things as secure as possible but even the most sophisticated encryption schemes are broken when you can arbitrarily, remotely and silently screenshot the data in question. Bezos is the richest man in the world, he's not hiring some fly-by-night security consultancy. He personally employs some of the smartest information security consultants on the planet through Amazon. They also provide cloud services directly to the military and intelligence agencies. He's got plenty of knowledgeable contacts to consult with. [0] https://thehackernews.com/2017/10/apple-fbi-iphone-unlock.html https://thehackernews.com/2017/10/apple-fbi-iphone-unlock.ht...
johnwyles 8y ago
Wait. Even if you have access to the device how do you get app-to-app access of the underlying texts unless there is a hack unknown to Apple. I know there are barriers Apple has built in where developers cannot access the text messages because of many obvious reasons for abuse. Perhaps Pegasus knows of a "0 day" or multiple and use this? However, E2E encryption PLUS Apples security model around text messaging in iOS should prevent it.
- Phlarp 8y ago
  Or a screenshot