3 ms·
> how publishing a private key makes the slightest bit of sense. From what I gather, the private key was private until it was leaked to / stolen by the team wh
by wyldfire 3y ago
> how publishing a private key makes the slightest bit of sense.
From what I gather, the private key was private until it was leaked to / stolen by the team who published it for this use case.
I don't have enough context to say, because I have to admit that once published, the keypair corresponding to the private key is likely to be revoked/discarded.
- jiggawatts 3y ago> the keypair corresponding to the private key is likely to be revoked/discarded. That's precisely it! Publishing a private key -- anyone's -- invalidates the security of the private-public key pair, making it worthless as security. There's going to be some consequence to this, such as the third party "changing the locks" and locking out you, or your users. Similarly, it might allow hackers to intercept the comms, break into your code, or whatever. The essential, fundamental point I'm trying to get across here is that it never ever makes sense to publish a private key, and then rely on it for any purpose.
- redserk 3y agoI think I'm on board with your POV here. I guess it would have been more difficult for Apple to find the key/device ID used in this scheme had these not been available on the first few pages linked by a lot of articles claiming iMessage is broken. Had this not been publicly posted, someone would've been forced to at least open a log file.