3 ms·
What is the process for verifying that FaceTime isn't leaking the encryption keys to Apple's servers?
by dane-pgp 6y ago
What is the process for verifying that FaceTime isn't leaking the encryption keys to Apple's servers?
- m3kw9 6y agoI don’t know, but as a black box it’s been extensively looked at. But nothing is unhackable even E2E.
- Fice 6y agoHow would one know that this black box works the same for every user? What would stop Apple from distributing a compromised update to everyone or to selected users?
- m3kw9 6y agoYep any protocol and any app can have this problem.
- dane-pgp 6y agoThe protection against this problem is to have the app (or the platform it's running on) check before installing an update that the hash of the binary it has downloaded has been recorded in a public transparency log. With closed source software, though, this doesn't give as much confidence, since a company could create a version which they send to everyone but which contains an "if (userId == NSA_TARGET)" conditional branch.