4 ms·

I hope they really do this. All too often Companies will say this then when the law is passed they back down. Why, stockholders. Has Apple really removed iMe

by jmclnx 3y ago

I hope they really do this. All too often Companies will say this then when the law is passed they back down. Why, stockholders. Has Apple really removed iMessage and FaceTime anywere else ? Are these available with 100% full encryption in China ? If so then they are just blowing wind :(

epcoa 3y ago
> Are these available with 100% full encryption in China ? If so then they are just blowing wind :( Talk less, read more.
- garyNeedsa 3y ago
  [dead]
- jmclnx 3y ago
  Well here is something for you to read, if you are a Chinese Citizen living in China, then these messages can be seen by the Government because iCloud data must be stored in China. https://www.reddit.com/r/ios/comments/cskufy/imessage_encryption_when_sending_msgs_to_chinese/ https://www.reddit.com/r/ios/comments/cskufy/imessage_encryp...
  - decentsafety 3y ago
    I was looking around to see what china has access to after seeing this post... However, people mention their messages can only be visible if icloud backups are enabled? Seems risky to trust either way.
    - epcoa 3y ago
      People should read actual documentation and expert or academic writing rather than a bunch of terminally online nerds on Reddit. I’ve seen nothing credible that the E2E for iMessage and FaceTime isn’t as advertised. If you backup to the cloud you’re electing to disclose your data outside the boundaries of encryption.
      - smoldesu 3y ago
        > People should read actual documentation Then they should read the leaked government documents from around the world that contradict what Apple says themselves. Failing that, they should at least be able to read the actual code to corroborate its security, but that's not an option either.
        epcoa 3y ago
        > Then they should read the leaked government documents from around the world that contradict what Apple says themselves. On what specifically? > they should at least be able to read the actual code to corroborate its security, but that's not an option either. Why does that matter? You're already trusting Apple hardware. Public access to source code doesn't make security systems safer. I'm not sure what a journalist or even 99% of webshits on this forum would do with trying to audit crypto.
        smoldesu 3y ago
        > On what specifically? For starters, PRISM and XKeyscore. Both are damning indictments of the state of surveillance a decade ago, and are so damaging that pretty much every FAANG company denies knowledge of their existence. PRISM was about the outreach the US government has with domestic companies, and XKeyscore showed just how far those connections could be abused. Simply the fact that these leaked documents exist and Apple denying them is a contradiction. Everything else is speculation, but my brain can imagine a lot happening over those past 9 years. > Why does that matter? Accountability purposes. > You're already trusting Apple hardware. Ideally I don't do that either. I'm not a fan of closed firmware interfaces and if possible, I'd like to audit the code for those as well. > Public access to source code doesn't make security systems safer. The majority of networked servers online today beg to differ. Over time the industry actually found that it's much safer to use an open and transparent OS than it is to trust a black-box with UB that may-or-may-not be fixed. > I'm not sure what a journalist or even 99% of webshits on this forum would do with trying to audit crypto. This speaks to a lack of either experience or imagination, I can't tell which.
  - isykt 3y ago
    Can a Chinese person not use iMessage without iCloud? This is possible in the US. In fact, it’s the default.
  - epcoa 3y ago
    Yeah, ok, try harder than a Reddit thread where supposedly authoritative commenters can’t even spell encrypt. The idiot pmendes is wrong (if he was correct then no one knowledgeable on the subject would classify that system as E2EE - something more to read about). The encryption keys are not managed in iCloud which you can read yourself: https://support.apple.com/guide/security/how-imessage-sends-and-receives-messages-sec70e68c949/web https://support.apple.com/guide/security/how-imessage-sends-... https://www.apple.com/legal/privacy/data/en/messages/#:~:text=Messages%20are%20backed%20up%20in,share%20your%20name%20and%20photo https://www.apple.com/legal/privacy/data/en/messages/#:~:tex.... iCloud backup is an opt in feature - you use it full well knowing it effectively damages the affordance of E2E regardless of locale if ADP is not available. “Read more” did not mean social media.
    - philsnow 3y ago
      > The idiot pmendes is wrong (if he was correct then no one knowledgeable on the subject would classify that system as E2EE What exactly is pmendes wrong about? Are you referring to this comment: > In iMessage the message contents are in fact end to end encripted. Each device encripts the message using the recipient keys and then sends the message. The problem is that iCloud manages the keys by itself so you have no way of knowing who is the exact owner of the key. Addionaly, on group chats, they don't even need to be a man in the middle. They can just add their key to the list of encription keys for that chat, and receive a copy of each message. What's wrong there, aside from spelling? The nit I would pick is that in "iCloud manages the keys", I would change "iCloud" to "Apple" or "Apple's IDS". How, specifically, does iCloud backup damage the affordance of E2E? This doesn't make any sense. If you have somebody's GPG public key, you can encrypt a file to that public key and then put up the encrypted file on a public FTP site [0], whence they can download and decrypt it. iMessage does nearly exactly that, except that 1) Apple's identity service effectively solved the key distribution problem, 2) the messages are, even though already encrypted, themselves also transmitted by encrypted channels to Apple's servers during transit. [0] Well, I wouldn't do this if I were at all concerned about the contents because it doesn't allow for forward secrecy.
      - deleted 3y ago
        [deleted]
kotaKat 3y ago
FaceTime was banned in the UAE up until ~2021 when it suddenly started working again for non-UAE phones[1]. For the longest time iOS/macOS has had feature and region flags at a lower hardware level that could dictate system policy for things like FaceTime as well as the camera shutter sound required in Korea/Japan. [1] https://apnews.com/article/dubai-middle-east-united-arab-emirates-eb2461eda153f3bc6ec281e7d1039db9 https://apnews.com/article/dubai-middle-east-united-arab-emi...

by jmclnx 3y ago

epcoa 3y ago

> Are these available with 100% full encryption in China ? If so then they are just blowing wind :( Talk less, read more.

garyNeedsa 3y ago
[dead]
jmclnx 3y ago
Well here is something for you to read, if you are a Chinese Citizen living in China, then these messages can be seen by the Government because iCloud data must be stored in China. https://www.reddit.com/r/ios/comments/cskufy/imessage_encryption_when_sending_msgs_to_chinese/ https://www.reddit.com/r/ios/comments/cskufy/imessage_encryp...
- decentsafety 3y ago
  I was looking around to see what china has access to after seeing this post... However, people mention their messages can only be visible if icloud backups are enabled? Seems risky to trust either way.
  - epcoa 3y ago
    People should read actual documentation and expert or academic writing rather than a bunch of terminally online nerds on Reddit. I’ve seen nothing credible that the E2E for iMessage and FaceTime isn’t as advertised. If you backup to the cloud you’re electing to disclose your data outside the boundaries of encryption.
    - smoldesu 3y ago
      > People should read actual documentation Then they should read the leaked government documents from around the world that contradict what Apple says themselves. Failing that, they should at least be able to read the actual code to corroborate its security, but that's not an option either.
      - epcoa 3y ago
        > Then they should read the leaked government documents from around the world that contradict what Apple says themselves. On what specifically? > they should at least be able to read the actual code to corroborate its security, but that's not an option either. Why does that matter? You're already trusting Apple hardware. Public access to source code doesn't make security systems safer. I'm not sure what a journalist or even 99% of webshits on this forum would do with trying to audit crypto.
        smoldesu 3y ago
        > On what specifically? For starters, PRISM and XKeyscore. Both are damning indictments of the state of surveillance a decade ago, and are so damaging that pretty much every FAANG company denies knowledge of their existence. PRISM was about the outreach the US government has with domestic companies, and XKeyscore showed just how far those connections could be abused. Simply the fact that these leaked documents exist and Apple denying them is a contradiction. Everything else is speculation, but my brain can imagine a lot happening over those past 9 years. > Why does that matter? Accountability purposes. > You're already trusting Apple hardware. Ideally I don't do that either. I'm not a fan of closed firmware interfaces and if possible, I'd like to audit the code for those as well. > Public access to source code doesn't make security systems safer. The majority of networked servers online today beg to differ. Over time the industry actually found that it's much safer to use an open and transparent OS than it is to trust a black-box with UB that may-or-may-not be fixed. > I'm not sure what a journalist or even 99% of webshits on this forum would do with trying to audit crypto. This speaks to a lack of either experience or imagination, I can't tell which.
- isykt 3y ago
  Can a Chinese person not use iMessage without iCloud? This is possible in the US. In fact, it’s the default.
- epcoa 3y ago
  Yeah, ok, try harder than a Reddit thread where supposedly authoritative commenters can’t even spell encrypt. The idiot pmendes is wrong (if he was correct then no one knowledgeable on the subject would classify that system as E2EE - something more to read about). The encryption keys are not managed in iCloud which you can read yourself: https://support.apple.com/guide/security/how-imessage-sends-and-receives-messages-sec70e68c949/web https://support.apple.com/guide/security/how-imessage-sends-... https://www.apple.com/legal/privacy/data/en/messages/#:~:text=Messages%20are%20backed%20up%20in,share%20your%20name%20and%20photo https://www.apple.com/legal/privacy/data/en/messages/#:~:tex.... iCloud backup is an opt in feature - you use it full well knowing it effectively damages the affordance of E2E regardless of locale if ADP is not available. “Read more” did not mean social media.
  - philsnow 3y ago
    > The idiot pmendes is wrong (if he was correct then no one knowledgeable on the subject would classify that system as E2EE What exactly is pmendes wrong about? Are you referring to this comment: > In iMessage the message contents are in fact end to end encripted. Each device encripts the message using the recipient keys and then sends the message. The problem is that iCloud manages the keys by itself so you have no way of knowing who is the exact owner of the key. Addionaly, on group chats, they don't even need to be a man in the middle. They can just add their key to the list of encription keys for that chat, and receive a copy of each message. What's wrong there, aside from spelling? The nit I would pick is that in "iCloud manages the keys", I would change "iCloud" to "Apple" or "Apple's IDS". How, specifically, does iCloud backup damage the affordance of E2E? This doesn't make any sense. If you have somebody's GPG public key, you can encrypt a file to that public key and then put up the encrypted file on a public FTP site [0], whence they can download and decrypt it. iMessage does nearly exactly that, except that 1) Apple's identity service effectively solved the key distribution problem, 2) the messages are, even though already encrypted, themselves also transmitted by encrypted channels to Apple's servers during transit. [0] Well, I wouldn't do this if I were at all concerned about the contents because it doesn't allow for forward secrecy.
    - deleted 3y ago
      [deleted]

kotaKat 3y ago

FaceTime was banned in the UAE up until ~2021 when it suddenly started working again for non-UAE phones[1]. For the longest time iOS/macOS has had feature and region flags at a lower hardware level that could dictate system policy for things like FaceTime as well as the camera shutter sound required in Korea/Japan. [1] https://apnews.com/article/dubai-middle-east-united-arab-emirates-eb2461eda153f3bc6ec281e7d1039db9 https://apnews.com/article/dubai-middle-east-united-arab-emi...