3 ms·

Please explain what’s “horribly insecure” about iMessage [1]. [1]: https://support.apple.com/en-nz/guide/security/secd9764312f/web https://support.apple.com/en

Please explain what’s “horribly insecure” about iMessage [1]. [1]: https://support.apple.com/en-nz/guide/security/secd9764312f/web https://support.apple.com/en-nz/guide/security/secd9764312f/...

smoldesu 4y ago
The fact that the FBI can attain lawful access to anyone's encrypted messages [1]? [1] https://news.yahoo.com/fbi-gain-limited-access-private-145441680.html https://news.yahoo.com/fbi-gain-limited-access-private-14544...
- alwillis 4y ago
  A nitpick: the iMessage protocol isn’t insecure, which was implied. We know the FBI doesn’t have unlimited access to iMessage content from the San Bernardino shooter case where they needed NSO to hack the shooter’s iPhone when law enforcement couldn’t buy their own copies of those tools years ago. The FBI needs a search warrant (probable cause required) to search a device and to get backed up messages from iCloud. Anyone concerned shouldn’t use iCloud and certainly not for iMessage backup. That’s very different from being “horribly insecure” since it’s end-to-end encrypted.
  - smoldesu 4y ago
    End-to-end encryption means very little when the FBI can ask for a copy of your encryption keys and attain it with little effort. If anyone besides you has that power, your system is not secure. Not your keys, not your crypto.
    - alwillis 4y ago
      Except that the FBI can’t ask Apple for the private keys because they don’t have them; they never leave the device, which is the whole point [1]. Knowing they can’t get the private keys, the FBI wants to confront a suspect and grab the unlocked iPhone out of his/her hand. If you think you’re going to have your iPhone taken by law enforcement, there’s a quick way to lock it [2]. When a user turns on iMessage on a device, the device generates encryption and signing pairs of keys for use with the service. For encryption, there is an encryption RSA 1280-bit key as well as an encryption EC 256-bit key on the NIST P-256 curve. For signatures, Elliptic Curve Digital Signature Algorithm (ECDSA) 256-bit signing keys are used. The private keys are saved in the device’s keychain and only available after first unlock. The public keys are sent to Apple Identity Service (IDS), where they are associated with the user’s phone number or email address, along with the device’s APNs address. [1]: https://support.apple.com/en-nz/guide/security/secd9764312f/web https://support.apple.com/en-nz/guide/security/secd9764312f/... [2]: “How to Temporarily Disable Face ID or Touch ID, and Require a Passcode to Unlock Your iPhone or iPad”— https://daringfireball.net/2022/06/require_a_passcode_to_unlock_your_iphone https://daringfireball.net/2022/06/require_a_passcode_to_unl...

smoldesu 4y ago

The fact that the FBI can attain lawful access to anyone's encrypted messages [1]? [1] https://news.yahoo.com/fbi-gain-limited-access-private-145441680.html https://news.yahoo.com/fbi-gain-limited-access-private-14544...

alwillis 4y ago
A nitpick: the iMessage protocol isn’t insecure, which was implied. We know the FBI doesn’t have unlimited access to iMessage content from the San Bernardino shooter case where they needed NSO to hack the shooter’s iPhone when law enforcement couldn’t buy their own copies of those tools years ago. The FBI needs a search warrant (probable cause required) to search a device and to get backed up messages from iCloud. Anyone concerned shouldn’t use iCloud and certainly not for iMessage backup. That’s very different from being “horribly insecure” since it’s end-to-end encrypted.
- smoldesu 4y ago
  End-to-end encryption means very little when the FBI can ask for a copy of your encryption keys and attain it with little effort. If anyone besides you has that power, your system is not secure. Not your keys, not your crypto.
  - alwillis 4y ago
    Except that the FBI can’t ask Apple for the private keys because they don’t have them; they never leave the device, which is the whole point [1]. Knowing they can’t get the private keys, the FBI wants to confront a suspect and grab the unlocked iPhone out of his/her hand. If you think you’re going to have your iPhone taken by law enforcement, there’s a quick way to lock it [2]. When a user turns on iMessage on a device, the device generates encryption and signing pairs of keys for use with the service. For encryption, there is an encryption RSA 1280-bit key as well as an encryption EC 256-bit key on the NIST P-256 curve. For signatures, Elliptic Curve Digital Signature Algorithm (ECDSA) 256-bit signing keys are used. The private keys are saved in the device’s keychain and only available after first unlock. The public keys are sent to Apple Identity Service (IDS), where they are associated with the user’s phone number or email address, along with the device’s APNs address. [1]: https://support.apple.com/en-nz/guide/security/secd9764312f/web https://support.apple.com/en-nz/guide/security/secd9764312f/... [2]: “How to Temporarily Disable Face ID or Touch ID, and Require a Passcode to Unlock Your iPhone or iPad”— https://daringfireball.net/2022/06/require_a_passcode_to_unlock_your_iphone https://daringfireball.net/2022/06/require_a_passcode_to_unl...