3 ms·
Seems like Apple is tacitly acknowledging that sophisticated actors have successfully been man-in-the-middling iMessage users. I wonder if they have clear evide
by varenc 3y ago
Seems like Apple is tacitly acknowledging that sophisticated actors have successfully been man-in-the-middling iMessage users. I wonder if they have clear evidence of that since I haven’t seen any coverage on this.
- dannyw 3y agoI don’t get that impression. Given that iMessage is such a high value target, I wouldn’t be surprised either way, but adding more security features is not a tacit admission of compromise.
- jrockway 3y agoThe attack is that anyone can make an iMessage account and pretend to be your friend ("new phone who this"); this feature is how you prevent that.
- dannyw 3y agoI don’t think that’s the attack this feature aims to prevent. Rather, it aims to prevent someone who compromised iMessage infrastructure, from pulling a dodgy around keys.
- varenc 3y agoAgreed with the sibling comment. To quote Apple, this feature can "detect sophisticated threats against iMessage servers". Essentially it's to protect against state-sponsored attacks MITMing you. Doing that also probably requires the attackers also have access to some root CA private keys so it's a very small pool.
- deleted 3y ago[deleted]
- AceJohnny2 3y agoOr! they're trying to get ahead of legislation (looking at the UK) by presenting a fait-accompli