8 ms·

A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

161 points by luu 1y ago

modeless 1y ago
All that security, and then by default Apple literally just sends themselves a copy of your encryption keys to store in iCloud backup, the only cloud backup solution Apple allows you to use. "to help you recover your data" [1] (oh and also to send law enforcement your message history in plaintext on request, but we don't talk about that). [1] https://support.apple.com/en-us/102651#:~:text=in%20iCloud%2C-,your%20backup%20includes%20a%20copy%20of%20the%20Messages%20in%20iCloud%20encryption%20key%20to%20help%20you%20recover%20your%20data,-. https://support.apple.com/en-us/102651#:~:text=in%20iCloud%2...
- ls612 1y ago
  The more charitable interpretation is that for most people losing their photos and messages is a bigger threat than the government spying on them. For those who might have a different tradeoff there is Advanced Data Protection.
  - modeless 1y ago
    I'm glad ADP exists now, but you have to make sure everyone you message has it enabled too, or your messages are still Apple's to read whenever they choose. Meanwhile Google's equivalent backup feature (whatever other faults it may have) has been end-to-end encrypted by default for everyone since long before ADP was even available at all. The risk of losing access is practically nonexistent because the password is your screen lock code, the same one you enter on your lock screen literally every day. Also, is government spying the only reason Apple decrypts messages? We don't know. They don't disclose that they do it for the government, but we know they do from other sources. What other purposes might they not be disclosing?
    - ls612 1y ago
      The concern is if you lose your devices with E2EE enabled then you are locked out permanently. Grandma won't know how to use a Yubikey (which is the alternative Apple provides for this eventuality with ADP enabled) and will be out of luck.
      - modeless 1y ago
        This is not a requirement with Google's solution. After losing all your devices you only need your lock screen code to decrypt your backup, as I said. This is achieved using a secure element on the datacenter side to protect against brute-force attacks on the screen lock code.
    - londons_explore 1y ago
      > the password is your screen lock code You mean the one that by default is a 4 digit number and therefore trivially brute forcable? And neither android hardware nor the google servers have any kind of secure element enforcing brute force protections like '3 tries then we wipe the keys'.
      - modeless 1y ago
        > neither android hardware nor the google servers have any kind of secure element enforcing brute force protections I don't know why you would say this when it is obviously false. https://security.googleblog.com/2018/10/google-and-android-have-your-back-by.html https://security.googleblog.com/2018/10/google-and-android-h...
        londons_explore 1y ago
        do they actually enforce these limits? I couldn't find any google UI which says "2 tries left or your data will be permanently erased". One can't implement brute force protections without such a UI... "You need to wait 5 minutes" isn't sufficient for a 4 digit pin...
        1y ago
  - deleted 1y ago
    [deleted]
  - xvector 1y ago
    ADP is a total joke if it doesn't also disable plaintext backups for the people you're talking to
    - Jtsummers 1y ago
      > ADP is a total joke if it doesn't also disable plaintext backups for the people you're talking to Do you consider all security to be a joke then? If you send me a message, how will you actually guarantee that I do not make a copy of it once it's on my own computer?
      - modeless 1y ago
        There's no guarantee, but some apps intended for security actually make at least a minimal effort to be excluded from plaintext backups, rather than intentionally sending their encryption keys to the backup service that just happens to be run by the same company...
        Jtsummers 1y ago
        Ok. So you concede that there is no way for you to ensure that messages you send me, that I can decrypt, are left unreadable by anyone but me. So what secure communication system should we be using given that none of them can guarantee that the recipient doesn't leak information to another country by choosing to use a compromised version of the client?
        modeless 1y ago
        My complaint is not about guarantees, it's about defaults. Default non-e2e-encrypted backups of message encryption keys are the problem here. No system can guarantee absolute security, but that doesn't mean they're all equivalently bad. Some are definitely more secure than others, and defaults have a lot to do with it!
        Jtsummers 1y ago
- IceHegel 1y ago
  [flagged]
  - fsflover 1y ago
    Speak for yourself. Sent from my Librem 5 GNU/Linux smartphone.
  - Hilift 1y ago
    iOS is a second class operating system platform, with Android not far behind. iMessage has been the subject of multiple device takeover zero days, no user intervention required. "20 zero-days patched by Apple in 2023". https://www.infosecurity-magazine.com/news/apple-update-extremely/ https://www.infosecurity-magazine.com/news/apple-update-extr... https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...
- snowwrestler 1y ago
  Only if you have “Messages in iCloud” turned on, which is optional.
  - modeless 1y ago
    This is false. If you turn off the "Messages in iCloud" feature then your messages are included in your regular iCloud backup which Apple has the keys to decrypt, as disclosed. Of course iCloud backup is itself optional. But Apple gives you and the people you're messaging no other option for cloud backups. ADP actually encrypts your backups, but since it defaults to off your messages are almost certainly still readable by Apple thanks to the keys stored in other peoples' backups.
    - fmajid 1y ago
      And of course ADP is off in the U.K., where I live. And iMessage sometimes randomly falls back to unencrypted SMS/MMS even when you ticked the checkbox disallowing this in System Settings.
    - snowwrestler 1y ago
      > If you turn off the "Messages in iCloud" feature then your messages are included in your regular iCloud backup which Apple has the keys to decrypt, as disclosed. No, if you do not use “Messages in iCloud” then your iMessage private key does not leave your device.
      - modeless 1y ago
        If you turn off Messages in iCloud then the messages are instead stored in your iCloud backup and encrypted "In transit & on server" with key storage by Apple, not just on your devices, as specified in the fourth row of the "Data categories and encryption" table in the Apple support article I linked. "In transit & on server" means not e2ee. That is, Apple can decrypt the messages at will without notice or consent. If the messages were still protected by e2ee with key storage only on your devices then it would specify that in the table. Some other data types like keychain passwords and Memoji are in fact protected by e2ee even when ADP is not enabled, and the table reflects that. Messages do not fall in the category of e2ee without ADP.
- conradev 1y ago
  Not if you have "Advanced Data Protection" turned on: https://support.apple.com/en-us/108756 https://support.apple.com/en-us/108756
  - charliebwrites 1y ago
    Do we have any guarantee that enabling ADP utilizes a new key that isn’t already in a previous non-ADP back up? Would be a shame if they claimed they can’t decrypt but an old back up had the keys to the kingdom
    - conradev 1y ago
      You're trusting a whole lot of trust in the first place. But I imagine that they did not do that. I can't sign into Apple Music on Android because it doesn't support security keys – small price to pay.
  - modeless 1y ago
    Unlike Google's comparable backup encryption feature, ADP is off by default. And ADP protects your messages from Apple only to the extent that everyone you message also turns on this non-default option; otherwise your messages are still Apple's to read as they please with no notification to you.
    - commandersaki 1y ago
      To be clear, ADP default on would mean a massive influx in support requests for people that lose their data because they don't have the recovery key. Same reason FileVault isn't on by default on macs.
      - matthewdgreen 1y ago
        On the one hand: yes. On the other hand, the ADP setting is located in the moral equivalent of the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.’ Apple could do a lot to promote this feature to more advanced users, but they don’t. I don’t believe for a second this decision is unrelated to the government pressure they’ve been receiving from the UK.
- isodev 1y ago
  I think the story around privacy and security in general has become diluted in marketing talk. Every single default on both iOS and macOS effectively makes one’s data, well, accessible and not private. The gap between perception and reality when it comes to Apple as a “privacy champion” has never been so big as it is today.
  - 9dev 1y ago
    Most customers do want it this way, but Apple still allows to exchange comfort for privacy, if you want to. I actually think it's a pretty sensible approach to capture both the big segment of people who don't care, and those who do and know which knobs to tweak. You can still turn everything compromising off and end up with a device secured to paranoid levels. That's definitely more than an empty promise, or what other vendors provide.
    - StopDisinfo910 1y ago
      > Most customers do want it this way, but Apple still allows to exchange comfort for privacy […] more than an empty promise, or what other vendors provide. That’s pretty much exactly what all the other vendors in the market provide: insecure and spying by default. I don’t really understand why Apple should somehow get good points for their stance on privacy when they are actually doing pretty much the same thing than everyone else.
      - arghwhat 1y ago
        While I'm not on the Apple bandwagon, there is a difference between insecure by default and active spying. Even as a Pixel user, I'm fairly confident that my data would be (ab)used less on the Apple side. Users want convenience, and security always brings inconveniences (e.g., inter-client sync, no chat data before a client logged in first time, etc.). Some vendors might provide convenience because they want to have your data. Others might provide you the convenience because you as a user want it, but see the resulting data as nothing but a liability. Some providers are known to have the majority of their business be based around such data, whereas others might have little to no presence in that field.
- int_19h 1y ago
  > the only cloud backup solution Apple allows you to use Not quite. You can still have automatic local backups set up for iOS and macOS devices to your own NAS. And that NAS can then do cloud backups of whatever is on it in any way you want. It's certainly more effort than the stock iCloud solution, but it's still an option.
  - ysleepy 1y ago
    How? Genuine Question, this is something I really want. macOS yes, but iOS?
    - miki123211 1y ago
      via USB (or possibly local Wi-Fi) and your computer. iTunes (or Mac OS's built-in iPhone sync) is the recommended way to do this, although the protocol has been reverse-engineered to hell and back and third-party software exists for it. iMazing is the most notable one, although there are probably others, and you could hack something on top of libimobiledevice if you really wanted to. Getting those backups from your computer to the NAS is an exercise for the reader.
  - modeless 1y ago
    OK, if you have or buy a $599+ Mac from Apple in addition to your iOS device, and first connect your iOS device with a USB cable, and then enable the optional Wi-Fi sync, and regularly connect the Mac and the iOS device to the same Wi-Fi network while the Mac is not sleeping, and configure an e2ee cloud backup on the Mac to include the iOS backup, then that is actually a way to achieve a third-party e2ee cloud backup. Though it's stretching the definition a bit due to the requirement to have the Mac connected to the same Wi-Fi for the backup to occur, I'd consider a true cloud backup solution to work on any network connection or even cellular. I'm willing to bet that the number of people who have ever set all of that up as described is in the triple digits worldwide. A rounding error.
    - int_19h 1y ago
      I'm pretty sure your estimate is wrong by at least several orders of magnitude. Lots of iPhone users also own MacBooks, for starters, and iPhone will nudge you to set backup when you connect it to any Mac. And of course they are going to be on the same Wi-Fi network most of the time, too, when that person is at home. I'm not sure how sleep plays into it exactly, but MacBooks do wake up on their own to do their backups and things like app updates, so I wouldn't be surprised if an iPhone can actually wake up a sleeping MacBook to back up to it. So the only case that is relatively unusual is having the Mac back up to a local NAS, but that's only because NAS themselves are a power user thing. Still, turnkey ones like Synology etc are much more common than "triple digits worldwide", and if you have a Mac and a NAS, why wouldn't you set up Time Machine to backup to said NAS?
- bayindirh 1y ago
  You can remove said keys from your backups and devices, if you want, at least when you're outside UK.
- miki123211 1y ago
  Most users demand: 1. That their messages won't be lost when they migrate between devices. 2. That their messages won't be lost when their device is stolen and they set up the new one from nothing but a password. 3. That Apple's password recovery flows work like any other password recovery flows, AKA that forgetting your password is a minor inconvenience, to be overcome at the Apple Store at worst, not a data loss disaster. 4. That they don't have to spend $$$ on some strange device called a "Yoobby Key", which they don't understand and will lose anyway. There's no way to satisfy those demands and have your desired level of security, hence why iCloud backup encryption is a strictly opt-in feature. There are tradeoffs to be made here, and Signal made different tradeoffs, which makes it significantly more secure but also significantly more annoying to use for somebody whose main life interest isn't figuring out why tech works the way it does. Apple does the best it can under the constraints they are given.
  - matthewdgreen 1y ago
    Apple has the opportunity to add “extra security” features like disappearing messages, or to treat certain chats the same way they treat your web history (back this chat up, but require my passcode.) For the latter feature one can argue that it’s too advanced for the ordinary Apple user. But disappearing messages are a common security feature in virtually every messaging app, and Apple still won’t deploy those. I used to think this was because they were intimidated by law enforcement, but they claimed otherwise. The recent UK attempt to backdoor Advanced Data Protection has made me believe them a bit less.
    - trollbridge 1y ago
      You can set messages to auto-delete. (I do this so I won’t get into the bad habit of relying on finding ancient messages.) But it’s all or nothing and has to be applied to the entire account.
      - matthewdgreen 1y ago
        Yes, but that setting is different from what disappearing messages offers, since it only applies to your account and not the accounts of your conversation partners. Disappearing messages is a really nice feature that’s widely supported across many messengers. Apple is really the exception for not offering it.
- dostick 1y ago
  What about the “Advanced Data Protection” end to end encryption? Or by “sending copy of keys to iCloud” you mean those? It even says that “Apple will not be able to help you recover if you switch to End to end advanced data protection”.
  - modeless 1y ago
    ADP is overkill. Apple already end-to-end encrypts keychain passwords, health data, and other stuff even if you don't enable ADP. They need to do the same with iMessage, or otherwise they need to stop falsely advertising iMessage as a strong e2ee system when it literally uploads its encryption keys to Apple by default. Also, even if you enable ADP Apple can likely still read the vast majority of your messages in other people's default-non-e2ee backups. The bad default is the problem here.
    - CharlesW 1y ago
      > ADP is overkill. "No, not like that." :O) But seriously, you can also just turn off iCloud Backups for Messages. (iCloud > Storage > Messages > Turn Off and Delete from iCloud) > …otherwise they need to stop falsely advertising iMessage as a strong e2ee system when it literally uploads its encryption keys to Apple by default. iMessage is E2EE, but iCloud Backup is not, which I understand is a distinction probably not well understood by most HN readers, much less your average consumer.
      - modeless 1y ago
        I'm sorry, a messaging app that in its most common configuration has its encryption keys stored on its developer's servers in a way that allows them to decrypt messages at will cannot be reasonably called e2ee. I don't care if it's technically a different OS process doing the uploading. It's all Apple software on Apple software and Apple's responsibility to match user expectations based on the claims Apple makes. No reasonable person would expect that Apple intentionally retains the ability to decrypt the majority of iMessage communications given their marketing of iMessage as e2ee.
- eddyg 1y ago
  More people need to watch Ivan Krstic's Black Hat presentation to understand the efforts Apple goes through to ensure sensitive data (like the User Escrow Keys which get stored in Apple's Cloud Key Vault) is protected from adversarial attacks... even from inside Apple. https://www.youtube.com/watch?v=BLGFriOKz6U&t=26m50s https://www.youtube.com/watch?v=BLGFriOKz6U&t=26m50s (Be sure to watch through the section from 34m to 36m...)
  - dogleash 1y ago
    The problem isn't that the technical challenges aren't addressed. The problem is that no amount of tech can un-do a design that forces in a "just trust me bro" control relationship. For some people it isn't a concern and that's fine, just so long as we acknowledge that it is a real and legitimate concern for other people, and that's also fine.
  - rasz 1y ago
    > even from inside Apple sure, reminder 'Apple pays millions to woman after explicit photos posted online' 'Technicians posted the private photos and video from her iPhone after she sent it to Apple for repair, according to legal documents' https://www.telegraph.co.uk/business/2021/06/06/apple-pays-millions-woman-explicit-photos-posted-online/ https://www.telegraph.co.uk/business/2021/06/06/apple-pays-m...
  - modeless 1y ago
    Rogue insider threats are far from the only thing e2ee protects against.
- jwr 1y ago
  You can turn it off.
- deleted 1y ago
  [deleted]
methuselah_in 1y ago
[flagged]
- frontfor 1y ago
  Both of us know this is a non-starter for most people, even technically inclined ones.
  - methuselah_in 1y ago
    well, if not there are hundreds of servers(public you can choose from). And Encryption is there as well. So server administrator can't even read your texts, if you are not so tech savy.
- azinman2 1y ago
  What are the issues?
- 9dev 1y ago
  Nice! That way you can chat with yourself at all times! I mean, everyone else will continue using a different messenger, but they don't have anything interesting to say anyway!
  - ezst 1y ago
    Not OP, so I don't have to bear the snark, but also, let's not pretend that iMessage is some virtuous and ethical standard worth recommending in general. It's nothing but a tool by the monopolist Apple to execute vendor lock-in and subjugate its users into a closed ecosystem. Of course, that says nothing about the quality of said ecosystem (or that of XMPP, for that matter), only about a well-placed sense of priorities that I find laudable.
  - methuselah_in 1y ago
    If you are not dumb enough to let other people how companies sucking your data and giving and fixing you in their own silos. its about personal choice.
contact9879 1y ago
This is a revision of a paper that first appeared as an eprint back in September when PQ3 was announced. https://eprint.iacr.org/2024/1395 https://eprint.iacr.org/2024/1395
dang 1y ago
Related. Others? iMessage with PQ3 Cryptographic Protocol - https://news.ycombinator.com/item?id=39453660 https://news.ycombinator.com/item?id=39453660 - Feb 2024 (267 comments)
cornelisjohann 1y ago
[dead]
cornelisjohann 1y ago
[dead]

161 points by luu 1y ago

All that security, and then by default Apple literally just sends themselves a copy of your encryption keys to store in iCloud backup, the only cloud backup solution Apple allows you to use. "to help you recover your data" [1] (oh and also to send law enforcement your message history in plaintext on request, but we don't talk about that). [1] https://support.apple.com/en-us/102651#:~:text=in%20iCloud%2C-,your%20backup%20includes%20a%20copy%20of%20the%20Messages%20in%20iCloud%20encryption%20key%20to%20help%20you%20recover%20your%20data,-. https://support.apple.com/en-us/102651#:~:text=in%20iCloud%2...

ls612 1y ago
The more charitable interpretation is that for most people losing their photos and messages is a bigger threat than the government spying on them. For those who might have a different tradeoff there is Advanced Data Protection.
- modeless 1y ago
  I'm glad ADP exists now, but you have to make sure everyone you message has it enabled too, or your messages are still Apple's to read whenever they choose. Meanwhile Google's equivalent backup feature (whatever other faults it may have) has been end-to-end encrypted by default for everyone since long before ADP was even available at all. The risk of losing access is practically nonexistent because the password is your screen lock code, the same one you enter on your lock screen literally every day. Also, is government spying the only reason Apple decrypts messages? We don't know. They don't disclose that they do it for the government, but we know they do from other sources. What other purposes might they not be disclosing?
  - ls612 1y ago
    The concern is if you lose your devices with E2EE enabled then you are locked out permanently. Grandma won't know how to use a Yubikey (which is the alternative Apple provides for this eventuality with ADP enabled) and will be out of luck.
    - modeless 1y ago
      This is not a requirement with Google's solution. After losing all your devices you only need your lock screen code to decrypt your backup, as I said. This is achieved using a secure element on the datacenter side to protect against brute-force attacks on the screen lock code.
  - londons_explore 1y ago
    > the password is your screen lock code You mean the one that by default is a 4 digit number and therefore trivially brute forcable? And neither android hardware nor the google servers have any kind of secure element enforcing brute force protections like '3 tries then we wipe the keys'.
    - modeless 1y ago
      > neither android hardware nor the google servers have any kind of secure element enforcing brute force protections I don't know why you would say this when it is obviously false. https://security.googleblog.com/2018/10/google-and-android-have-your-back-by.html https://security.googleblog.com/2018/10/google-and-android-h...
      - londons_explore 1y ago
        do they actually enforce these limits? I couldn't find any google UI which says "2 tries left or your data will be permanently erased". One can't implement brute force protections without such a UI... "You need to wait 5 minutes" isn't sufficient for a 4 digit pin...
        1y ago
- deleted 1y ago
  [deleted]
- xvector 1y ago
  ADP is a total joke if it doesn't also disable plaintext backups for the people you're talking to
  - Jtsummers 1y ago
    > ADP is a total joke if it doesn't also disable plaintext backups for the people you're talking to Do you consider all security to be a joke then? If you send me a message, how will you actually guarantee that I do not make a copy of it once it's on my own computer?
    - modeless 1y ago
      There's no guarantee, but some apps intended for security actually make at least a minimal effort to be excluded from plaintext backups, rather than intentionally sending their encryption keys to the backup service that just happens to be run by the same company...
      - Jtsummers 1y ago
        Ok. So you concede that there is no way for you to ensure that messages you send me, that I can decrypt, are left unreadable by anyone but me. So what secure communication system should we be using given that none of them can guarantee that the recipient doesn't leak information to another country by choosing to use a compromised version of the client?
        modeless 1y ago
        My complaint is not about guarantees, it's about defaults. Default non-e2e-encrypted backups of message encryption keys are the problem here. No system can guarantee absolute security, but that doesn't mean they're all equivalently bad. Some are definitely more secure than others, and defaults have a lot to do with it!
        Jtsummers 1y ago
IceHegel 1y ago
[flagged]
- fsflover 1y ago
  Speak for yourself. Sent from my Librem 5 GNU/Linux smartphone.
- Hilift 1y ago
  iOS is a second class operating system platform, with Android not far behind. iMessage has been the subject of multiple device takeover zero days, no user intervention required. "20 zero-days patched by Apple in 2023". https://www.infosecurity-magazine.com/news/apple-update-extremely/ https://www.infosecurity-magazine.com/news/apple-update-extr... https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...
snowwrestler 1y ago
Only if you have “Messages in iCloud” turned on, which is optional.
- modeless 1y ago
  This is false. If you turn off the "Messages in iCloud" feature then your messages are included in your regular iCloud backup which Apple has the keys to decrypt, as disclosed. Of course iCloud backup is itself optional. But Apple gives you and the people you're messaging no other option for cloud backups. ADP actually encrypts your backups, but since it defaults to off your messages are almost certainly still readable by Apple thanks to the keys stored in other peoples' backups.
  - fmajid 1y ago
    And of course ADP is off in the U.K., where I live. And iMessage sometimes randomly falls back to unencrypted SMS/MMS even when you ticked the checkbox disallowing this in System Settings.
  - snowwrestler 1y ago
    > If you turn off the "Messages in iCloud" feature then your messages are included in your regular iCloud backup which Apple has the keys to decrypt, as disclosed. No, if you do not use “Messages in iCloud” then your iMessage private key does not leave your device.
    - modeless 1y ago
      If you turn off Messages in iCloud then the messages are instead stored in your iCloud backup and encrypted "In transit & on server" with key storage by Apple, not just on your devices, as specified in the fourth row of the "Data categories and encryption" table in the Apple support article I linked. "In transit & on server" means not e2ee. That is, Apple can decrypt the messages at will without notice or consent. If the messages were still protected by e2ee with key storage only on your devices then it would specify that in the table. Some other data types like keychain passwords and Memoji are in fact protected by e2ee even when ADP is not enabled, and the table reflects that. Messages do not fall in the category of e2ee without ADP.
conradev 1y ago
Not if you have "Advanced Data Protection" turned on: https://support.apple.com/en-us/108756 https://support.apple.com/en-us/108756
- charliebwrites 1y ago
  Do we have any guarantee that enabling ADP utilizes a new key that isn’t already in a previous non-ADP back up? Would be a shame if they claimed they can’t decrypt but an old back up had the keys to the kingdom
  - conradev 1y ago
    You're trusting a whole lot of trust in the first place. But I imagine that they did not do that. I can't sign into Apple Music on Android because it doesn't support security keys – small price to pay.
- modeless 1y ago
  Unlike Google's comparable backup encryption feature, ADP is off by default. And ADP protects your messages from Apple only to the extent that everyone you message also turns on this non-default option; otherwise your messages are still Apple's to read as they please with no notification to you.
  - commandersaki 1y ago
    To be clear, ADP default on would mean a massive influx in support requests for people that lose their data because they don't have the recovery key. Same reason FileVault isn't on by default on macs.
    - matthewdgreen 1y ago
      On the one hand: yes. On the other hand, the ADP setting is located in the moral equivalent of the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.’ Apple could do a lot to promote this feature to more advanced users, but they don’t. I don’t believe for a second this decision is unrelated to the government pressure they’ve been receiving from the UK.
isodev 1y ago
I think the story around privacy and security in general has become diluted in marketing talk. Every single default on both iOS and macOS effectively makes one’s data, well, accessible and not private. The gap between perception and reality when it comes to Apple as a “privacy champion” has never been so big as it is today.
- 9dev 1y ago
  Most customers do want it this way, but Apple still allows to exchange comfort for privacy, if you want to. I actually think it's a pretty sensible approach to capture both the big segment of people who don't care, and those who do and know which knobs to tweak. You can still turn everything compromising off and end up with a device secured to paranoid levels. That's definitely more than an empty promise, or what other vendors provide.
  - StopDisinfo910 1y ago
    > Most customers do want it this way, but Apple still allows to exchange comfort for privacy […] more than an empty promise, or what other vendors provide. That’s pretty much exactly what all the other vendors in the market provide: insecure and spying by default. I don’t really understand why Apple should somehow get good points for their stance on privacy when they are actually doing pretty much the same thing than everyone else.
    - arghwhat 1y ago
      While I'm not on the Apple bandwagon, there is a difference between insecure by default and active spying. Even as a Pixel user, I'm fairly confident that my data would be (ab)used less on the Apple side. Users want convenience, and security always brings inconveniences (e.g., inter-client sync, no chat data before a client logged in first time, etc.). Some vendors might provide convenience because they want to have your data. Others might provide you the convenience because you as a user want it, but see the resulting data as nothing but a liability. Some providers are known to have the majority of their business be based around such data, whereas others might have little to no presence in that field.
int_19h 1y ago
> the only cloud backup solution Apple allows you to use Not quite. You can still have automatic local backups set up for iOS and macOS devices to your own NAS. And that NAS can then do cloud backups of whatever is on it in any way you want. It's certainly more effort than the stock iCloud solution, but it's still an option.
- ysleepy 1y ago
  How? Genuine Question, this is something I really want. macOS yes, but iOS?
  - miki123211 1y ago
    via USB (or possibly local Wi-Fi) and your computer. iTunes (or Mac OS's built-in iPhone sync) is the recommended way to do this, although the protocol has been reverse-engineered to hell and back and third-party software exists for it. iMazing is the most notable one, although there are probably others, and you could hack something on top of libimobiledevice if you really wanted to. Getting those backups from your computer to the NAS is an exercise for the reader.
- modeless 1y ago
  OK, if you have or buy a $599+ Mac from Apple in addition to your iOS device, and first connect your iOS device with a USB cable, and then enable the optional Wi-Fi sync, and regularly connect the Mac and the iOS device to the same Wi-Fi network while the Mac is not sleeping, and configure an e2ee cloud backup on the Mac to include the iOS backup, then that is actually a way to achieve a third-party e2ee cloud backup. Though it's stretching the definition a bit due to the requirement to have the Mac connected to the same Wi-Fi for the backup to occur, I'd consider a true cloud backup solution to work on any network connection or even cellular. I'm willing to bet that the number of people who have ever set all of that up as described is in the triple digits worldwide. A rounding error.
  - int_19h 1y ago
    I'm pretty sure your estimate is wrong by at least several orders of magnitude. Lots of iPhone users also own MacBooks, for starters, and iPhone will nudge you to set backup when you connect it to any Mac. And of course they are going to be on the same Wi-Fi network most of the time, too, when that person is at home. I'm not sure how sleep plays into it exactly, but MacBooks do wake up on their own to do their backups and things like app updates, so I wouldn't be surprised if an iPhone can actually wake up a sleeping MacBook to back up to it. So the only case that is relatively unusual is having the Mac back up to a local NAS, but that's only because NAS themselves are a power user thing. Still, turnkey ones like Synology etc are much more common than "triple digits worldwide", and if you have a Mac and a NAS, why wouldn't you set up Time Machine to backup to said NAS?
bayindirh 1y ago
You can remove said keys from your backups and devices, if you want, at least when you're outside UK.
miki123211 1y ago
Most users demand: 1. That their messages won't be lost when they migrate between devices. 2. That their messages won't be lost when their device is stolen and they set up the new one from nothing but a password. 3. That Apple's password recovery flows work like any other password recovery flows, AKA that forgetting your password is a minor inconvenience, to be overcome at the Apple Store at worst, not a data loss disaster. 4. That they don't have to spend $$$ on some strange device called a "Yoobby Key", which they don't understand and will lose anyway. There's no way to satisfy those demands and have your desired level of security, hence why iCloud backup encryption is a strictly opt-in feature. There are tradeoffs to be made here, and Signal made different tradeoffs, which makes it significantly more secure but also significantly more annoying to use for somebody whose main life interest isn't figuring out why tech works the way it does. Apple does the best it can under the constraints they are given.
- matthewdgreen 1y ago
  Apple has the opportunity to add “extra security” features like disappearing messages, or to treat certain chats the same way they treat your web history (back this chat up, but require my passcode.) For the latter feature one can argue that it’s too advanced for the ordinary Apple user. But disappearing messages are a common security feature in virtually every messaging app, and Apple still won’t deploy those. I used to think this was because they were intimidated by law enforcement, but they claimed otherwise. The recent UK attempt to backdoor Advanced Data Protection has made me believe them a bit less.
  - trollbridge 1y ago
    You can set messages to auto-delete. (I do this so I won’t get into the bad habit of relying on finding ancient messages.) But it’s all or nothing and has to be applied to the entire account.
    - matthewdgreen 1y ago
      Yes, but that setting is different from what disappearing messages offers, since it only applies to your account and not the accounts of your conversation partners. Disappearing messages is a really nice feature that’s widely supported across many messengers. Apple is really the exception for not offering it.
dostick 1y ago
What about the “Advanced Data Protection” end to end encryption? Or by “sending copy of keys to iCloud” you mean those? It even says that “Apple will not be able to help you recover if you switch to End to end advanced data protection”.
- modeless 1y ago
  ADP is overkill. Apple already end-to-end encrypts keychain passwords, health data, and other stuff even if you don't enable ADP. They need to do the same with iMessage, or otherwise they need to stop falsely advertising iMessage as a strong e2ee system when it literally uploads its encryption keys to Apple by default. Also, even if you enable ADP Apple can likely still read the vast majority of your messages in other people's default-non-e2ee backups. The bad default is the problem here.
  - CharlesW 1y ago
    > ADP is overkill. "No, not like that." :O) But seriously, you can also just turn off iCloud Backups for Messages. (iCloud > Storage > Messages > Turn Off and Delete from iCloud) > …otherwise they need to stop falsely advertising iMessage as a strong e2ee system when it literally uploads its encryption keys to Apple by default. iMessage is E2EE, but iCloud Backup is not, which I understand is a distinction probably not well understood by most HN readers, much less your average consumer.
    - modeless 1y ago
      I'm sorry, a messaging app that in its most common configuration has its encryption keys stored on its developer's servers in a way that allows them to decrypt messages at will cannot be reasonably called e2ee. I don't care if it's technically a different OS process doing the uploading. It's all Apple software on Apple software and Apple's responsibility to match user expectations based on the claims Apple makes. No reasonable person would expect that Apple intentionally retains the ability to decrypt the majority of iMessage communications given their marketing of iMessage as e2ee.
eddyg 1y ago
More people need to watch Ivan Krstic's Black Hat presentation to understand the efforts Apple goes through to ensure sensitive data (like the User Escrow Keys which get stored in Apple's Cloud Key Vault) is protected from adversarial attacks... even from inside Apple. https://www.youtube.com/watch?v=BLGFriOKz6U&t=26m50s https://www.youtube.com/watch?v=BLGFriOKz6U&t=26m50s (Be sure to watch through the section from 34m to 36m...)
- dogleash 1y ago
  The problem isn't that the technical challenges aren't addressed. The problem is that no amount of tech can un-do a design that forces in a "just trust me bro" control relationship. For some people it isn't a concern and that's fine, just so long as we acknowledge that it is a real and legitimate concern for other people, and that's also fine.
- rasz 1y ago
  > even from inside Apple sure, reminder 'Apple pays millions to woman after explicit photos posted online' 'Technicians posted the private photos and video from her iPhone after she sent it to Apple for repair, according to legal documents' https://www.telegraph.co.uk/business/2021/06/06/apple-pays-millions-woman-explicit-photos-posted-online/ https://www.telegraph.co.uk/business/2021/06/06/apple-pays-m...
- modeless 1y ago
  Rogue insider threats are far from the only thing e2ee protects against.
jwr 1y ago
You can turn it off.
deleted 1y ago
[deleted]

methuselah_in 1y ago

[flagged]

frontfor 1y ago
Both of us know this is a non-starter for most people, even technically inclined ones.
- methuselah_in 1y ago
  well, if not there are hundreds of servers(public you can choose from). And Encryption is there as well. So server administrator can't even read your texts, if you are not so tech savy.
azinman2 1y ago
What are the issues?
9dev 1y ago
Nice! That way you can chat with yourself at all times! I mean, everyone else will continue using a different messenger, but they don't have anything interesting to say anyway!
- ezst 1y ago
  Not OP, so I don't have to bear the snark, but also, let's not pretend that iMessage is some virtuous and ethical standard worth recommending in general. It's nothing but a tool by the monopolist Apple to execute vendor lock-in and subjugate its users into a closed ecosystem. Of course, that says nothing about the quality of said ecosystem (or that of XMPP, for that matter), only about a well-placed sense of priorities that I find laudable.
- methuselah_in 1y ago
  If you are not dumb enough to let other people how companies sucking your data and giving and fixing you in their own silos. its about personal choice.

contact9879 1y ago

This is a revision of a paper that first appeared as an eprint back in September when PQ3 was announced. https://eprint.iacr.org/2024/1395 https://eprint.iacr.org/2024/1395

dang 1y ago

Related. Others? iMessage with PQ3 Cryptographic Protocol - https://news.ycombinator.com/item?id=39453660 https://news.ycombinator.com/item?id=39453660 - Feb 2024 (267 comments)

cornelisjohann 1y ago

[dead]

cornelisjohann 1y ago

[dead]