3 ms·
> 7. iMessage allows undetectable key insertion attacks. https://security.apple.com/blog/imessage-contact-key-verification/ https://security.apple.com/blog/ime
by astrange 3y ago
> 7. iMessage allows undetectable key insertion attacks.
https://security.apple.com/blog/imessage-contact-key-verification/ https://security.apple.com/blog/imessage-contact-key-verific...
- maqp 3y agoWhoa, nice to see there's some progression finally! It's weird the blog appears to discuss key insertion, but not MITM attacks. Is there an official source that explicitly states it protects from those too? Also if it's for MITM too, is there a TOFU warning or is it only for a changing fingerprint, and is the warning soft (BTW the fingerprint just changed) or hard (please accept the new keys/fingerprint)? Can you mark the fingerprints verified like in Signal? https://restoreprivacy.com/apple-to-introduce-contact-key-verification-on-the-imessage-app/ https://restoreprivacy.com/apple-to-introduce-contact-key-ve... apparently states that but I'd rather have something official. Also it seems to be opt-in, at least for now https://9to5mac.com/2023/10/27/turn-on-contact-key-verification-imessage-iphone/ https://9to5mac.com/2023/10/27/turn-on-contact-key-verificat...
- astrange 3y agoUnfortunately I have no idea, or else I would've written a longer comment!