3 ms·
> Why should users believe that (closed source) iMessage encryption is free from backdoors That's an easy one: the encryption happens client side and thus any
by est31 7y ago
> Why should users believe that (closed source) iMessage encryption is free from backdoors
That's an easy one: the encryption happens client side and thus any backdoor has to sit on the clients and, if it exists, would be available to security researchers. There is no guarantee of it happening, but I believe some of those researchers reverse engineer whatever binary apple published and then check it for backdoors.
Of course there are still tricks that apple could pull, like adding backdoors only to targeted phones, changing the filesystem to present one version of the binary to the OS command that executes it and another to anyone else (like security researchers), extracting the unencrypted message contents using chips that sit on the memory bus (e.g. baseband), etc. But these tricks are harder to pull off and are still detectable as they happen on end-user devices.
They definitely won't say "yeah there is a backdoor". Ultimately, you need to trust them.
- Andrew_nenakhov 7y agoDoctored binaries (that leak private keys) can be sent to only select devices of a people under surveillance. So reverse-engineering generally available app will show nothing. Apple REALLY must be coerced into allowing app sideloading (and accept push notifications not only through APNS)
- est31 7y agoThe OS comes from apple, too. How does sideloading help when the OS is backdoored? How does installing your own OS help when there is a backdoor in the hardware?
- Andrew_nenakhov 7y agoSideloading helps to install the apps you want (or need), not the apps Apple allows you to use. Thing is, you buy a very expensive piece of hardware, and you don't even truly own it. Of course, Apple frames it as 'care to protect you from malware', but in reality, it's just a digital handcuff.
- est31 7y agoI agree with the points you make, but you are arguing in terms of freedom, not in terms of security.
- andromeduck 7y agoI wish they could take some middle ground here for example requiring that users read out loud a 1000 word statement describing the risks involved and limiting access to capabilities like background refresh, notifications, etc. if the user hasn't interacted with that app in a week. Or they could just beef up progressive web apps...