5 ms·

This should have been obvious to anyone who saw the code where it simply contained the raw literal string `FAIRPLAY_PRIVATE_KEY = b64decode(“…”)`. I suppose now

This should have been obvious to anyone who saw the code where it simply contained the raw literal string `FAIRPLAY_PRIVATE_KEY = b64decode(“…”)`. I suppose now we’ll see how accurate the commenter’s claim “if this becomes a problem, I know how to generate new keys” is. https://github.com/JJTech0130/pypush/blob/main/albert.py#L16 https://github.com/JJTech0130/pypush/blob/main/albert.py#L16

jiggawatts 3y ago
[flagged]
- vore 3y ago
  Because "private" here is regarding the cryptography and not regarding the disclosure? How are users supposed to obtain this key to use the service without it being published?
  - jiggawatts 3y ago
    “How can people get into my locked door if I don’t tape a key to it for them to use?” If the private key is public, it does nothing by definition and it may as well not exist! Just use plain text, HTTP, or whatever and stop fooling yourself. It’s like calling an open field a “secure facility”. The name is not the thing, the map is not the territory. Private keys are only private if they’re not public.
    - riwsky 3y ago
      This isn't about taping a key to _your_ front door—you're taping a key to Apple's.
      - noirbot 3y ago
        Yea, and like anyone who found out that someone taped the key to their door to their door, they changed the locks, and now everyone's mad at them.
    - seizethegdgap 3y ago
      You're not sharing the key to your house, you're sharing the key to one of the biggest skyscrapers in the world.
      - jiggawatts 3y ago
        And now everyone is up in arms that they changed the locks. Get it? Get it?
        vore 3y ago
        This is a private key to access Apple's service for a proof of concept. How is someone without access to an Apple device going to obtain such a key without it being distributed somehow? Nobody is surprised that Apple is able to revoke this key, by the way.
        dang 3y ago
        Please make your substantive points without swipes (like "What are you talking about" and "your schtick"), no matter how bad another comment is or you feel it is. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        vore 3y ago
        Edited.
        dang 3y ago
        Can you please not post in the flamewar style? It's not what we're going for here, and you can make your substantive points without that. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Edit: it looks like we've had to warn you about this multiple times before: https://news.ycombinator.com/item?id=32039759 https://news.ycombinator.com/item?id=32039759 (July 2022) https://news.ycombinator.com/item?id=27225044 https://news.ycombinator.com/item?id=27225044 (May 2021) https://news.ycombinator.com/item?id=22938445 https://news.ycombinator.com/item?id=22938445 (April 2020) https://news.ycombinator.com/item?id=21808005 https://news.ycombinator.com/item?id=21808005 (Dec 2019) We have to eventually ban accounts that keep breaking the rules like this. I don't want to ban you, so if you'd please review them and stick to them from now on, we'd appreciate it.
- Mogzol 3y ago
  In this case it makes sense, the key is a "private key" in the cryptographic sense, but it's not "private" in regards to the pypush app, it's needed for the app to work, so it needs to be public information or else the app would be useless for anyone who didn't have that key.
- wyldfire 3y ago
  > how publishing a private key makes the slightest bit of sense. From what I gather, the private key was private until it was leaked to / stolen by the team who published it for this use case. I don't have enough context to say, because I have to admit that once published, the keypair corresponding to the private key is likely to be revoked/discarded.
  - jiggawatts 3y ago
    > the keypair corresponding to the private key is likely to be revoked/discarded. That's precisely it! Publishing a private key -- anyone's -- invalidates the security of the private-public key pair, making it worthless as security. There's going to be some consequence to this, such as the third party "changing the locks" and locking out you, or your users. Similarly, it might allow hackers to intercept the comms, break into your code, or whatever. The essential, fundamental point I'm trying to get across here is that it never ever makes sense to publish a private key, and then rely on it for any purpose.
    - redserk 3y ago
      I think I'm on board with your POV here. I guess it would have been more difficult for Apple to find the key/device ID used in this scheme had these not been available on the first few pages linked by a lot of articles claiming iMessage is broken. Had this not been publicly posted, someone would've been forced to at least open a log file.
- ezfe 3y ago
  The private key is that of the operating system, unknown to the user. It is not the private key of the project.
- Shawnj2 3y ago
  In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people of that age
  - jiggawatts 3y ago
    Perfectly understandable, at that age I only had the vaguest notion of how cryptography works. Unfortunately, nobody else seems to either, which is why my comment is getting downvoted. "Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence. It doesn't matter who's key it is, how it was generated, how it was obtained, etc... The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks. Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.
    - admax88qqq 3y ago
      Your understanding in of cryptography appears to be "private means private" > A published private key by definition is worthless. If I publish the AACS _private_ key, is it now worthless?
      - jiggawatts 3y ago
        Yes! It becomes worthless for copy protection. Public-private key pairs only work if the private key is secret. If it’s not secret it doesn’t work. This is a simple fact of how cryptography works. Or passwords, keys, or any secret like an API key, etc… If you publish such things on GitHub, they instantly become “not what you’ve labelled it as”.
        admax88qqq 3y ago
        > It becomes worthless for... So you admit it's not completely worthless at that point only for specific use cases.
mintplant 3y ago
What's the link between this repo and Beeper?
- gabeio 3y ago
  > What's the link between this repo and Beeper? https://news.ycombinator.com/item?id=38531759 https://news.ycombinator.com/item?id=38531759
  - jaktet 3y ago
    I might be missing it but still don’t see how that answers the question about how that repo is related to beeper mini. Did they use this directly or the same methodology?
    - FoeNyx 3y ago
      In https://news.ycombinator.com/item?id=38531759 https://news.ycombinator.com/item?id=38531759 its OP states "A team member has published an open source Python iMessage protocol PoC on Github: https://github.com/JJTech0130/pypush https://github.com/JJTech0130/pypush."
      - jaktet 3y ago
        Maybe there’s an easy way to just read all their replies but I see now that in the linked blog post it links https://blog.beeper.com/p/how-beeper-mini-works https://blog.beeper.com/p/how-beeper-mini-works which goes over the technical details and mentions the python repo. Thanks
        FoeNyx 3y ago
        Oh, it wasn't lost among all their replies, it was in the 4th paragraph of the header text section of that Show HN post.
    - yurishimo 3y ago
      Beeper Mini's implementation was built on top of this repo. I'm sure it was cleaned up and modified for the production release, but the gist is largely still the same.

jiggawatts 3y ago

[flagged]

vore 3y ago
Because "private" here is regarding the cryptography and not regarding the disclosure? How are users supposed to obtain this key to use the service without it being published?
- jiggawatts 3y ago
  “How can people get into my locked door if I don’t tape a key to it for them to use?” If the private key is public, it does nothing by definition and it may as well not exist! Just use plain text, HTTP, or whatever and stop fooling yourself. It’s like calling an open field a “secure facility”. The name is not the thing, the map is not the territory. Private keys are only private if they’re not public.
  - riwsky 3y ago
    This isn't about taping a key to _your_ front door—you're taping a key to Apple's.
    - noirbot 3y ago
      Yea, and like anyone who found out that someone taped the key to their door to their door, they changed the locks, and now everyone's mad at them.
  - seizethegdgap 3y ago
    You're not sharing the key to your house, you're sharing the key to one of the biggest skyscrapers in the world.
    - jiggawatts 3y ago
      And now everyone is up in arms that they changed the locks. Get it? Get it?
      - vore 3y ago
        This is a private key to access Apple's service for a proof of concept. How is someone without access to an Apple device going to obtain such a key without it being distributed somehow? Nobody is surprised that Apple is able to revoke this key, by the way.
        dang 3y ago
        Please make your substantive points without swipes (like "What are you talking about" and "your schtick"), no matter how bad another comment is or you feel it is. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        vore 3y ago
        Edited.
      - dang 3y ago
        Can you please not post in the flamewar style? It's not what we're going for here, and you can make your substantive points without that. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Edit: it looks like we've had to warn you about this multiple times before: https://news.ycombinator.com/item?id=32039759 https://news.ycombinator.com/item?id=32039759 (July 2022) https://news.ycombinator.com/item?id=27225044 https://news.ycombinator.com/item?id=27225044 (May 2021) https://news.ycombinator.com/item?id=22938445 https://news.ycombinator.com/item?id=22938445 (April 2020) https://news.ycombinator.com/item?id=21808005 https://news.ycombinator.com/item?id=21808005 (Dec 2019) We have to eventually ban accounts that keep breaking the rules like this. I don't want to ban you, so if you'd please review them and stick to them from now on, we'd appreciate it.
Mogzol 3y ago
In this case it makes sense, the key is a "private key" in the cryptographic sense, but it's not "private" in regards to the pypush app, it's needed for the app to work, so it needs to be public information or else the app would be useless for anyone who didn't have that key.
wyldfire 3y ago
> how publishing a private key makes the slightest bit of sense. From what I gather, the private key was private until it was leaked to / stolen by the team who published it for this use case. I don't have enough context to say, because I have to admit that once published, the keypair corresponding to the private key is likely to be revoked/discarded.
- jiggawatts 3y ago
  > the keypair corresponding to the private key is likely to be revoked/discarded. That's precisely it! Publishing a private key -- anyone's -- invalidates the security of the private-public key pair, making it worthless as security. There's going to be some consequence to this, such as the third party "changing the locks" and locking out you, or your users. Similarly, it might allow hackers to intercept the comms, break into your code, or whatever. The essential, fundamental point I'm trying to get across here is that it never ever makes sense to publish a private key, and then rely on it for any purpose.
  - redserk 3y ago
    I think I'm on board with your POV here. I guess it would have been more difficult for Apple to find the key/device ID used in this scheme had these not been available on the first few pages linked by a lot of articles claiming iMessage is broken. Had this not been publicly posted, someone would've been forced to at least open a log file.
ezfe 3y ago
The private key is that of the operating system, unknown to the user. It is not the private key of the project.
Shawnj2 3y ago
In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people of that age
- jiggawatts 3y ago
  Perfectly understandable, at that age I only had the vaguest notion of how cryptography works. Unfortunately, nobody else seems to either, which is why my comment is getting downvoted. "Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence. It doesn't matter who's key it is, how it was generated, how it was obtained, etc... The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks. Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.
  - admax88qqq 3y ago
    Your understanding in of cryptography appears to be "private means private" > A published private key by definition is worthless. If I publish the AACS _private_ key, is it now worthless?
    - jiggawatts 3y ago
      Yes! It becomes worthless for copy protection. Public-private key pairs only work if the private key is secret. If it’s not secret it doesn’t work. This is a simple fact of how cryptography works. Or passwords, keys, or any secret like an API key, etc… If you publish such things on GitHub, they instantly become “not what you’ve labelled it as”.
      - admax88qqq 3y ago
        > It becomes worthless for... So you admit it's not completely worthless at that point only for specific use cases.

mintplant 3y ago

What's the link between this repo and Beeper?

gabeio 3y ago
> What's the link between this repo and Beeper? https://news.ycombinator.com/item?id=38531759 https://news.ycombinator.com/item?id=38531759
- jaktet 3y ago
  I might be missing it but still don’t see how that answers the question about how that repo is related to beeper mini. Did they use this directly or the same methodology?
  - FoeNyx 3y ago
    In https://news.ycombinator.com/item?id=38531759 https://news.ycombinator.com/item?id=38531759 its OP states "A team member has published an open source Python iMessage protocol PoC on Github: https://github.com/JJTech0130/pypush https://github.com/JJTech0130/pypush."
    - jaktet 3y ago
      Maybe there’s an easy way to just read all their replies but I see now that in the linked blog post it links https://blog.beeper.com/p/how-beeper-mini-works https://blog.beeper.com/p/how-beeper-mini-works which goes over the technical details and mentions the python repo. Thanks
      - FoeNyx 3y ago
        Oh, it wasn't lost among all their replies, it was in the 4th paragraph of the header text section of that Show HN post.
  - yurishimo 3y ago
    Beeper Mini's implementation was built on top of this repo. I'm sure it was cleaned up and modified for the production release, but the gist is largely still the same.