4 ms·

Sorry, let's be explicit here, as you seem intent on muddying the issue. Where, other than the endpoints, is the message decrypted when people use iMessage? You

Sorry, let's be explicit here, as you seem intent on muddying the issue. Where, other than the endpoints, is the message decrypted when people use iMessage? Your succinct answer to that will clear this up for everyone.

lern_too_spel 7y ago
On GCBD's servers in China. Possibly on Apple's servers in the US if they are running a wiretap. Due to the way key distribution works for iMessage, it is trivial for Apple and GCBD to do so. https://news.ycombinator.com/item?id=22755903 https://news.ycombinator.com/item?id=22755903
- peteretep 7y ago
  Your message, through several layers of indirection, relies on a security conference paper from 7 years ago[0] + the assumption that Apple haven't updated the protocol in 7 those years. [0] https://blog.quarkslab.com/imessage-privacy.html https://blog.quarkslab.com/imessage-privacy.html
  - lern_too_spel 7y ago
    No, my message relies on the fact that people have been looking at iMessage for years, and nobody, least of all Apple, has said that the implementation changed in any way to prevent Apple from viewing the messages. Here is another article from 2016, which shows that Apple patched iMessage to prevent attackers who don't have access to Apple's servers from reading the messages but still kept the ability to read the messages themselves. https://blog.cryptographyengineering.com/category/imessage/ https://blog.cryptographyengineering.com/category/imessage/ Apple was aware that people knew it could decrypt iMessage messages this entire time, but Apple made no changes that would fix that. That should give you some idea of whether Apple intends to ever fix that.
- giantDinosaur 7y ago
  Apple can, of course, do whatever it likes, up to simply recording the screen and sending that to weird & wonderful government agencies. Like almost everything in mainstream security, it comes down to who you trust. It doesn't mean it isn't E2E though.
  - lern_too_spel 7y ago
    > It doesn't mean it isn't E2E though. E2E encryption simply means that messages are only decrypted at the endpoints. That certainly isn't true of iMessage in China, and it might not even be true for some users in the US — we have no way of knowing because the protocol makes no guarantee against it.
    - hunter2_ 7y ago
      So basically the first and second parties themselves need to do all encryption and decryption without any help from the third party running the service. Which is the age old usability issue famously holding back the casual adoption of PGP. Hard enough with text... To do it with video conferencing would be quite the feat. Someday, though.
modeless 7y ago
I have linked it several times in this thread. Here it is again: "If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices." https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- peteretep 7y ago
  Sorry, and where exactly outside the endpoints are the messages being decrypted?
  - modeless 7y ago
    Only Apple can know exactly when or where or how often they decrypt people's messages from their backups, because once they have the keys they have the means to do it at any place and time, for any reason, without anyone's knowledge or consent. What we know is that they can and do decrypt iMessages from iCloud backups in response to law enforcement requests[1]. This proves that they hold the keys, if their own support pages weren't enough evidence for you. [1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
    - hunter2_ 7y ago
      And even if none of that were the case, couldn't they just push out an update to the app or OS (just to the target, so other researchers debugging or watching traffic wouldn't know) which would cause the device to exfiltrate the cleartext anyway? Or always have had said feature?

lern_too_spel 7y ago

On GCBD's servers in China. Possibly on Apple's servers in the US if they are running a wiretap. Due to the way key distribution works for iMessage, it is trivial for Apple and GCBD to do so. https://news.ycombinator.com/item?id=22755903 https://news.ycombinator.com/item?id=22755903

peteretep 7y ago
Your message, through several layers of indirection, relies on a security conference paper from 7 years ago[0] + the assumption that Apple haven't updated the protocol in 7 those years. [0] https://blog.quarkslab.com/imessage-privacy.html https://blog.quarkslab.com/imessage-privacy.html
- lern_too_spel 7y ago
  No, my message relies on the fact that people have been looking at iMessage for years, and nobody, least of all Apple, has said that the implementation changed in any way to prevent Apple from viewing the messages. Here is another article from 2016, which shows that Apple patched iMessage to prevent attackers who don't have access to Apple's servers from reading the messages but still kept the ability to read the messages themselves. https://blog.cryptographyengineering.com/category/imessage/ https://blog.cryptographyengineering.com/category/imessage/ Apple was aware that people knew it could decrypt iMessage messages this entire time, but Apple made no changes that would fix that. That should give you some idea of whether Apple intends to ever fix that.
giantDinosaur 7y ago
Apple can, of course, do whatever it likes, up to simply recording the screen and sending that to weird & wonderful government agencies. Like almost everything in mainstream security, it comes down to who you trust. It doesn't mean it isn't E2E though.
- lern_too_spel 7y ago
  > It doesn't mean it isn't E2E though. E2E encryption simply means that messages are only decrypted at the endpoints. That certainly isn't true of iMessage in China, and it might not even be true for some users in the US — we have no way of knowing because the protocol makes no guarantee against it.
  - hunter2_ 7y ago
    So basically the first and second parties themselves need to do all encryption and decryption without any help from the third party running the service. Which is the age old usability issue famously holding back the casual adoption of PGP. Hard enough with text... To do it with video conferencing would be quite the feat. Someday, though.

modeless 7y ago

I have linked it several times in this thread. Here it is again: "If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices." https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

peteretep 7y ago
Sorry, and where exactly outside the endpoints are the messages being decrypted?
- modeless 7y ago
  Only Apple can know exactly when or where or how often they decrypt people's messages from their backups, because once they have the keys they have the means to do it at any place and time, for any reason, without anyone's knowledge or consent. What we know is that they can and do decrypt iMessages from iCloud backups in response to law enforcement requests[1]. This proves that they hold the keys, if their own support pages weren't enough evidence for you. [1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - hunter2_ 7y ago
    And even if none of that were the case, couldn't they just push out an update to the app or OS (just to the target, so other researchers debugging or watching traffic wouldn't know) which would cause the device to exfiltrate the cleartext anyway? Or always have had said feature?