4 ms·
The attack is that anyone can make an iMessage account and pretend to be your friend ("new phone who this"); this feature is how you prevent that.
by jrockway 3y ago
The attack is that anyone can make an iMessage account and pretend to be your friend ("new phone who this"); this feature is how you prevent that.
- dannyw 3y agoI don’t think that’s the attack this feature aims to prevent. Rather, it aims to prevent someone who compromised iMessage infrastructure, from pulling a dodgy around keys.
- varenc 3y agoAgreed with the sibling comment. To quote Apple, this feature can "detect sophisticated threats against iMessage servers". Essentially it's to protect against state-sponsored attacks MITMing you. Doing that also probably requires the attackers also have access to some root CA private keys so it's a very small pool.