4 ms·
iMessage doesn't share private keys between devices. Each device has its own secret key, and when you send a message to a person with multiple devices, you encr
by snotrockets 5y ago
iMessage doesn't share private keys between devices. Each device has its own secret key, and when you send a message to a person with multiple devices, you encrypt multiple copies, one for each (source: https://support.apple.com/guide/security/how-imessage-sends-and-receives-messages-sec70e68c949/1/web/1 https://support.apple.com/guide/security/how-imessage-sends-...)
An issue here is that the software doesn't show the user the list of keys used to encrypt a given message. If an attacker can inject their own keys into the identity service records for a given user, they would then receive a copy of all messages sent to that user.
- maqp 5y agoIt's true iMessage is not safe from such attacks, but you don't have to look further than Signal to see it's possible to create multi-device E2EE with seamless sync. iMessage and its bad design can only serve the function of red herring here, let's leave it out from the discussion.