7 ms·

How do you think they would spin Messages interoperability as security or performance?

by andrewmutz 3y ago

macintux 3y ago
End to end encryption can only be guaranteed if you control both ends.
- tomrod 3y ago
  How does PGP solve this?
  - danaris 3y ago
    PGP isn't an end-to-end encryption service; it's a public-key encryption package. To clarify macintux's statement, you can only guarantee end-to-end encryption will both remain secure and allow your messages to be read if you control both ends. If you do not control the other end, but you give it the ability to decrypt your messages (and thus let them be read), then whoever does control the other end can save the plaintext, post it elsewhere, and generally do whatever they want with it. To be "end-to-end encrypted", something has to actually be a service you are using, not merely a method of encryption. An end-to-end encrypted service could use PGP if it wanted (AFAIK), but PGP, in itself, is just a way for you to encrypt your messages, and then, optionally, share your public key to allow them to be decrypted by those you give it to, while also guaranteeing that those messages came from you (as long as you have kept your private key safe). So I'm afraid your question, as it stands, doesn't really make sense, but I hope this has helped to answer the underlying questions for you.
    - Drew_ 3y ago
      No, his question makes perfect sense and your response doesn't really make any. End-to-end encryption doesn't imply encryption from one end of the universe to the other. It is what it says on the tin: encryption from one end to another. Your message is insecure beyond the the other end. That is true both for PGP encrypted messages as well as iMessage messages. There's nothing on iPhones or Macs actually protecting your decrypted messages. Most of the on device security is optional and your messages, photos and files can be copied and shared anywhere in plain text.
      - danaris 3y ago
        PGP makes no claims of being an "end-to-end encrypted service", because it's not a service. It's an end-user product. It doesn't have to "solve this" problem, because that's not what it's for.
        Drew_ 3y ago
        You keep saying "service" when no one asked anything about services. The question in this thread is whether iMessage can offer secure interop. The answer is yes. They just need to use an open protocol and that protocol can use tools like PGP to encrypt messages end-to-end. Your claim that both the sending and receiving application need to be "controlled" by some entity for it to have "real" end-to-end security is non-sense.
        danaris 3y ago
        The statement, from macintux, was "End to end encryption can only be guaranteed if you control both ends.". The question, from tomrod, was "How does PGP solve this?" Nothing to do with iMessage. I was answering a specific question on a tangent thread. If you want to argue with me about iMessage, go to one of the posts I've made about that on this article. This thread is about PGP.
        Drew_ 3y ago
        Well you sure know how to dodge being wrong I'll give you that. Even ignoring the thread context, your comments on end to end encryption and PGP are woefully misinformed so we can just leave it there.
        danaris 3y ago
        Ah, so now "not talking about what you wanted me to be talking about, because that wasn't the subject of this subthread" is "dodging being wrong."
- __loam 3y ago
  Is the internet not built on public key encryption between two parties?
gnicholas 3y ago
I think they'll claim security for Messages. I don't have nearly enough information to know if they can win that particular issue, and it sounds like there are reasonable arguments on both sides. But they don't have a monopoly on messaging — WhatsApp is huge, Signal and others exist. I don't think Apple lets you use Siri to send messages via other services, or at least they didn't used to let you. But other than that they are granted near parity on iOS.
- kemayo 3y ago
  Siri does let you send messages with other services these days. (I think it got added in the last year or two, and those apps need to be updated to support it, but it's there!)
toast0 3y ago
The messaging claim seemed to be about carrier based messaging; SMS and MMS, and I guess in theory RCS (but is that really carrier based if Google has taken it upon themselves to enroll most Android users on a Google server) Apps that read inbound SMS may be malicious and use that ability to steal verification codes. Or they may not be actively malicious, and meerly handle the data in an insecure way that makes messages available to others. Performance, I dunno. Maybe they could argue something about how time between user requesting an SMS be sent and it actually getting sent is very important, and similar for display, and that they're more likely to do that right. I've certainly seen some Android manufacturer provided SMS clients that do much better than others on that, although I have no recent performance notes since I no longer get massive floods of SMS from too simple monitoring systems.
- FireBeyond 3y ago
  In the Epic lawsuit it was shown that Apple really actually more cared about this than "security": > “The #1 most difficult [reason] to leave the Apple universe app is iMessage ... iMessage amounts to serious lock-in,” was how one unnamed former Apple employee put it in an email in 2016, prompting Schiller to respond that, “moving iMessage to Android will hurt us more than help us, this email illustrates why.” > “iMessage on Android would simply serve to remove [an] obstacle to iPhone families giving their kids Android phones,” was Federighi’s concern
- dqv 3y ago
  > Apps that read inbound SMS may be malicious and use that ability to steal verification codes. Or they may not be actively malicious, and meerly handle the data in an insecure way that makes messages available to others. Apple can't make that argument since they allow apps that scan SMS messages for spam.
dagmx 3y ago
Security: there’s no cross platform E2E messaging standard they could have adopted. Given that the DoJ is already breathing down their neck for working with Google on search, using Google’s RCS extensions and servers might also be problematic. I don’t think the government could force them to adopt RCS without new legislation or bring iMessage to other platforms.
- afavour 3y ago
  > there’s no cross platform E2E messaging standard they could have adopted. Could they not have made their own? I don't think they'd be required to use open standards for the argument to be made, they just need to release an iMessage app for Android.
  - bink 3y ago
    It seems weird to force a company to support their competitors products if there is no financial interest in them doing so.
    - metabagel 3y ago
      It seems weird to degrade their own users' experience (when receiving texts from friends with Android phones), but Apple does it deliberately as a nudge to get people to use Apple products. There's no valid technical or security reason to do this. It's a tactical decision on Apple's part.
      - endemic 3y ago
        Why not both?
      - bombcar 3y ago
        If iMessages have benefits (they do) then there is a technical reason to show you the bubble colors - so you know the benefits apply. If sending video to a blue contact is better than sending it to green, there's a reason to know. Does it ACTUALLY matter? Maybe not? But people really do complain about a non-iPhone "degrading" a group chat, so it is indicating something. At the time they made iMessage at first? It was likely a real advance and only because they could control both ends. But now? They may be large enough that it's unfair use of their monopoly in one area to affect another, and get slapped or forced to interoperate.

How do you think they would spin Messages interoperability as security or performance?

macintux 3y ago

End to end encryption can only be guaranteed if you control both ends.

tomrod 3y ago
How does PGP solve this?
- danaris 3y ago
  PGP isn't an end-to-end encryption service; it's a public-key encryption package. To clarify macintux's statement, you can only guarantee end-to-end encryption will both remain secure and allow your messages to be read if you control both ends. If you do not control the other end, but you give it the ability to decrypt your messages (and thus let them be read), then whoever does control the other end can save the plaintext, post it elsewhere, and generally do whatever they want with it. To be "end-to-end encrypted", something has to actually be a service you are using, not merely a method of encryption. An end-to-end encrypted service could use PGP if it wanted (AFAIK), but PGP, in itself, is just a way for you to encrypt your messages, and then, optionally, share your public key to allow them to be decrypted by those you give it to, while also guaranteeing that those messages came from you (as long as you have kept your private key safe). So I'm afraid your question, as it stands, doesn't really make sense, but I hope this has helped to answer the underlying questions for you.
  - Drew_ 3y ago
    No, his question makes perfect sense and your response doesn't really make any. End-to-end encryption doesn't imply encryption from one end of the universe to the other. It is what it says on the tin: encryption from one end to another. Your message is insecure beyond the the other end. That is true both for PGP encrypted messages as well as iMessage messages. There's nothing on iPhones or Macs actually protecting your decrypted messages. Most of the on device security is optional and your messages, photos and files can be copied and shared anywhere in plain text.
    - danaris 3y ago
      PGP makes no claims of being an "end-to-end encrypted service", because it's not a service. It's an end-user product. It doesn't have to "solve this" problem, because that's not what it's for.
      - Drew_ 3y ago
        You keep saying "service" when no one asked anything about services. The question in this thread is whether iMessage can offer secure interop. The answer is yes. They just need to use an open protocol and that protocol can use tools like PGP to encrypt messages end-to-end. Your claim that both the sending and receiving application need to be "controlled" by some entity for it to have "real" end-to-end security is non-sense.
        danaris 3y ago
        The statement, from macintux, was "End to end encryption can only be guaranteed if you control both ends.". The question, from tomrod, was "How does PGP solve this?" Nothing to do with iMessage. I was answering a specific question on a tangent thread. If you want to argue with me about iMessage, go to one of the posts I've made about that on this article. This thread is about PGP.
        Drew_ 3y ago
        Well you sure know how to dodge being wrong I'll give you that. Even ignoring the thread context, your comments on end to end encryption and PGP are woefully misinformed so we can just leave it there.
        danaris 3y ago
        Ah, so now "not talking about what you wanted me to be talking about, because that wasn't the subject of this subthread" is "dodging being wrong."
__loam 3y ago
Is the internet not built on public key encryption between two parties?

gnicholas 3y ago

I think they'll claim security for Messages. I don't have nearly enough information to know if they can win that particular issue, and it sounds like there are reasonable arguments on both sides. But they don't have a monopoly on messaging — WhatsApp is huge, Signal and others exist. I don't think Apple lets you use Siri to send messages via other services, or at least they didn't used to let you. But other than that they are granted near parity on iOS.

kemayo 3y ago
Siri does let you send messages with other services these days. (I think it got added in the last year or two, and those apps need to be updated to support it, but it's there!)

toast0 3y ago

The messaging claim seemed to be about carrier based messaging; SMS and MMS, and I guess in theory RCS (but is that really carrier based if Google has taken it upon themselves to enroll most Android users on a Google server) Apps that read inbound SMS may be malicious and use that ability to steal verification codes. Or they may not be actively malicious, and meerly handle the data in an insecure way that makes messages available to others. Performance, I dunno. Maybe they could argue something about how time between user requesting an SMS be sent and it actually getting sent is very important, and similar for display, and that they're more likely to do that right. I've certainly seen some Android manufacturer provided SMS clients that do much better than others on that, although I have no recent performance notes since I no longer get massive floods of SMS from too simple monitoring systems.

FireBeyond 3y ago
In the Epic lawsuit it was shown that Apple really actually more cared about this than "security": > “The #1 most difficult [reason] to leave the Apple universe app is iMessage ... iMessage amounts to serious lock-in,” was how one unnamed former Apple employee put it in an email in 2016, prompting Schiller to respond that, “moving iMessage to Android will hurt us more than help us, this email illustrates why.” > “iMessage on Android would simply serve to remove [an] obstacle to iPhone families giving their kids Android phones,” was Federighi’s concern
dqv 3y ago
> Apps that read inbound SMS may be malicious and use that ability to steal verification codes. Or they may not be actively malicious, and meerly handle the data in an insecure way that makes messages available to others. Apple can't make that argument since they allow apps that scan SMS messages for spam.

dagmx 3y ago

Security: there’s no cross platform E2E messaging standard they could have adopted. Given that the DoJ is already breathing down their neck for working with Google on search, using Google’s RCS extensions and servers might also be problematic. I don’t think the government could force them to adopt RCS without new legislation or bring iMessage to other platforms.

afavour 3y ago
> there’s no cross platform E2E messaging standard they could have adopted. Could they not have made their own? I don't think they'd be required to use open standards for the argument to be made, they just need to release an iMessage app for Android.
- bink 3y ago
  It seems weird to force a company to support their competitors products if there is no financial interest in them doing so.
  - metabagel 3y ago
    It seems weird to degrade their own users' experience (when receiving texts from friends with Android phones), but Apple does it deliberately as a nudge to get people to use Apple products. There's no valid technical or security reason to do this. It's a tactical decision on Apple's part.
    - endemic 3y ago
      Why not both?
    - bombcar 3y ago
      If iMessages have benefits (they do) then there is a technical reason to show you the bubble colors - so you know the benefits apply. If sending video to a blue contact is better than sending it to green, there's a reason to know. Does it ACTUALLY matter? Maybe not? But people really do complain about a non-iPhone "degrading" a group chat, so it is indicating something. At the time they made iMessage at first? It was likely a real advance and only because they could control both ends. But now? They may be large enough that it's unfair use of their monopoly in one area to affect another, and get slapped or forced to interoperate.