12 ms·

Apple's iMessage encryption trips up feds' surveillance

215 points by donohoe 14y ago

archon 14y ago
So, if they're caught in other ways than via the surveillance, does that open up criminals using iMessage to further prosecution based on the notion that they used encryption to conceal a crime?
- webignition 14y ago
  My understanding is the messages app seamlessly transitions to using iMessage to send messages over a data connection where available. Assuming this to be the case, you wouldn't normally choose to use iMessage. It just happens if it can. If further penalty were to be considered, I expect the prosecutor would have to prove that the user intentionally took action to ensure iMessage was used for the delivery of messages instead of SMS. I suspect that would be hard to demonstrate.
rmrfrmrf 14y ago
Boo hoo?
pedrocr 14y ago
If I was the DEA and had a way to break the iMessage encryption, this is exactly the kind of article I'd try to have someone write.
- Wilya 14y ago
  I guess the real question is: Is this article a DEA PR piece or an Apple PR piece ?
  - youngerdryas 14y ago
    I doubt either but it does cast Google in a bad light. Does anyone know if Google reads your SMSs as well as email?
    - BHSPitMonkey 14y ago
      That depends on whether you mean * regular SMS/MMS messages sent from the Messaging app on Android, in which case: No, of course not. Those go directly to the cellular modem in the device. Or * messages sent/received using Google Voice, in which case: Probably. These are scraps of data that live on Google's servers, just like data within Gmail/GTalk/et al. They have mp3 audio and text transcriptions of all your incoming voicemail that comes in through GV.
      - youngerdryas 14y ago
        I would think Google Now would want access to your SMSs.
        skeletonjelly 14y ago
        I've never seen it mentioned. Definitely email (package tracking, flight bookings etc) but never read SMS is tracked.
    - mbq 14y ago
      Well, on Android you can install TextSecure and have even a more secure messaging. And replace the stock system with Cyanogen mod or similar and have a smartphone that won't be taking commands from the mothership.
- glurgh 14y ago
  Not really. The DEA is perfectly aware that such an article would be trivially identified as an inept ruse by anyone wearing cheap and easy-to-construct tinfoil headgear.
- lhnz 14y ago
  What do you have to gain by going onto Hacker News and posting conspiracies theories about DEA disinformation? Are you working for some kind of anti-US gov agency perhaps? Er
  - coldtea 14y ago
    >What do you have to gain by going onto Hacker News and posting conspiracies theories about DEA disinformation? Are you working for some kind of anti-US gov agency perhaps? For one, why assume he cares at all about US gov agencies? HN is international. There are people here who could not care less about US agencies. Not to mention there are people who despise their abuses and privacy breaches, including lots of Americans. Second, not everything is a "conspiracy theory". And not every "conspiracy theory" is laughable (e.g about aliens or illuminati). Real-life conspiracies (people, agencies etc, conspiring to do some stuff in secret to gain something) happen all the time. Actually conspiracy (covertly trying to spread misinformation or to gain state information or to steal trade secrets etc) is the very thing secret agencies do. As for your misguided surprise about how an agency could ever use the press to spread misinformation, you might want to read on this: http://en.wikipedia.org/wiki/Operation_Mockingbird http://en.wikipedia.org/wiki/Operation_Mockingbird
    - pyre 14y ago
      The problem is that every statement could be a 'government conspiracy.' E.g.: The DEA can break iMessage encryption Obviously they can't, and they want you to shy away from using iMessage! The DEA can't break iMessage encryption Obviously they can, and they want you to keep/start using it!
      - coldtea 14y ago
        Sure. But that's not an argument against it being possible (or actually true). I mean, in your example there are 3 cases: 1) Obviously that can't, and they want you to shy away from using iMessage! 2) Obviously they can, and they want you to keep/start using it! 3) They can't and they are frank about it. It could be either of the three. We cannot say that it can only be (3) because "(1) and (2) are conspiracies". We cannot even say that (3) is more possible because it doesn't involve a conspiracy. It depends on more information and context to decide. Some situations we know quite well that are unlikely to involve conspiracies ("Jack said he went to Spain for holidays"). Other situations, we know quite well that are more likely to involve conspiracies ("The other 2 co-founders of my startup had a private meeting with a VC without informing me"). Now, something involving state agencies, I'd say is quite likely to involve some kind of conspiracy.
- Spooky23 14y ago
  People said that about BlackBerry BBM messages, and Nextel DirectConnect too. But shortly thereafter, you started hearing about countries collaborating with BlackBerry to decrypt messages... first in palces like Saudi Arabia and Dubai, then in places like the UK. That tends to support the assertion that BBM was difficult/impossible to intercept.
dmix 14y ago
> "it is impossible to intercept iMessages between two Apple devices" even with a court order approved by a federal judge. And even more importantly, impossible with a warrantless wiretap as well. This new wide-spread adoption of encryption is law enforcements new enemy.
- archon 14y ago
  Maybe for warrantless wiretaps, yes. But for any legal surveillance, they'll just get a warrant and compel Apple/Microsoft/Twitter/Whoever to hand over any data they have.
  - shalmanese 14y ago
    end-to-end means Apple itself doesn't ever know what is being sent.
    - Nrsolis 14y ago
      Apple can get access to the keys because they control the platform. I have no doubt in my mind that Apple can produce end-user keys and traffic if they were served a warrant from any US court.
      - doe88 14y ago
        I think it's more complicated than that IMO, by controlling the platform i.e. by signing keys and authenticating users they certainly can impersonate clients to others clients, but I doubt they can collect users private keys generated on users devices (of course they could if their app was explicitly sending private key to their servers but I doubt they do and I don't see a reason why they'd do it, in any case they don't need to do it).
        Nrsolis 14y ago
        When IOS 6.1.4 gets pushed to your iPhone in the future, consider how difficult it would be for Apple to add code that copies your privately generated keys back to Apple for "key-escrow purposes".
Dylan16807 14y ago
All this worry about electronic messaging makes me wonder something. Can they get a warrant/order to intercept your physical mail and read it in transit? I'm wondering if they're actually less able to tap than in the past or if they're just whinging.
- DanBC 14y ago
  EFF say that physical mail is safer than anything else because the legal protections are so strong. But then you have to trust that 'they' are law abiding. Extraordinary rendition is both reassuring and alarming. 'They' will jump through hoops to look like they're obeying laws, but the end result is still people being water-boarded. The Hushmail thing shows that some companies will happily roll over when given valid law enforcement documentation. (Fair enough, I'm not sure what else they should do.) (https://ssd.eff.org/wire/protect https://ssd.eff.org/wire/protect)
  - betterunix 14y ago
    "The Hushmail thing shows that some companies will happily roll over when given valid law enforcement documentation. (Fair enough, I'm not sure what else they should do.)" Companies could design products that do not give them the ability to cooperate in that manner. Hushmail, for example, could have designed a system where customers were sold smartcards and not actually run the mail transport, so that Hushmail itself had no ability to access encrypted messages. While this would have made Hushmail a bit less convenient, it would also have made it many times more secure. Unfortunately, in the current right-wing political climate, there are few incentives for companies to actually develop or deploy such systems.
    - Dylan16807 14y ago
      From what I recall Hushmail had a downloadable applet that was safe. The problem is they stole certain user passwords by altering the web client.
      - betterunix 14y ago
zimbatm 14y ago
> They [the DEA] can also send a suspect malware, purchase a so-called zero day vulnerability to gain control of a target device and extract the contents Made me chuckle. Given that zero day are mostly available in black markets how can they justify to give money to criminals ?
- bobwaycott 14y ago
  I imagine they justify it with hand-waves to law enforcement, war on drugs/terror, national security, etc.
- troym 14y ago
  > how can they justify to give money to criminals ? Easy: they're both criminals.
- peterwwillis 14y ago
  Zero days are sold to the government by perfectly legitimate businesses, and the crap they don't buy is what ends up either in places like ZDI or eventually the black market.
- codesuela 14y ago
  Ever heard of Vupen? > VUPEN Exploits for Offensive Security As the world leader in vulnerability research, VUPEN provides extremely sophisticated and government-grade exploits specifically designed for the Intelligence and LEA community to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for exclusive and undisclosed vulnerabilities discovered by VUPEN researchers. Access to this service is restricted to organizations from countries members or partners of NATO, ANZUS and ASEAN. http://www.vupen.com/english/services/lea-index.php http://www.vupen.com/english/services/lea-index.php completely legitimate company
- csoghoian 14y ago
  Given that high-value zero days are mostly bought by governments from defense contractors and security companies. There. Fixed that for you.
- lawnchair_larry 14y ago
smackfu 14y ago
This article and the DEA doc is confusing. It seems to mainly be saying that having a warrant to intercept cell communications won't get iMessages because it doesn't go through the cell carrier. It's implied a bit that it is encrypted end-to-end and that Apple can't get the contents... but it doesn't seem to actually say that anywhere. This comment on StackExchange says the encryption is only from sender to Apple and Apple to recipient, so Apple has the plaintext: http://security.stackexchange.com/questions/18908/the-inner-workings-of-imessage-security http://security.stackexchange.com/questions/18908/the-inner-... Also, wouldn't the same issues have come up with BBM?
- declan 14y ago
  It's not implied; the article states outright the encryption is end-to-end. :) That's based on Apple press releases from 2011 and 2012. See, for example: http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS-Includes-Notification-Center-iMessage-Newsstand-Twitter-Integration-Among-200-New-Features.html http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS... "secure end-to-end encryption"
  - IheartApplesDix 14y ago
    Secure end to end encryption doesn't mean government agencies can't snoop on the coms. First of all, the CIA owns own one of the largest, if not the largest supercomputer. Also, the encryption could be using CIA's own root key. Example: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html
lucian1900 14y ago
The sad part is that iMessage's encryption appears to be of dubious quality. Even worse, the protocol is not public, so there's no way to audit it.
- klodolph 14y ago
  If you can't audit it, you can't be sure it is sound. But you seem to claim that it isn't sound, which also isn't possible without an audit. I think there are at least a few engineers at Apple capable of implementing this correctly. Not that I assume it's unbreakable, I'm just not as pessimistic.
  - revscat 14y ago
    When you're talking about encryption pessimism is the default. The whole point is lack of trust.
  - lucian1900 14y ago
    What has been inferred so far is worrying http://imfreedom.org/wiki/IMessage http://imfreedom.org/wiki/IMessage.
  - wwwtyro 14y ago
    > But you seem to claim that it isn't sound, which also isn't possible without an audit. That's not quite true, right? If encryption was successfully broken, then you wouldn't need an audit. Even if it wasn't broken, there's still things like this: http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/ http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/
nodata 14y ago
Dear criminals, Please use iMessage more, we promise we definitely can't read your messages. Lots of love, Feds xxx
- Ntrails 14y ago
  There's no advantage to them in people using iMessage. They can easily get your text messages already. You could go high-tinfoil and claim they would rather people iMessaged than using whatsapp or some other free message service? But anyone thinking about avoiding federal intercepts would use neither of these things rendering this piece worthless. So what do they actually have to gain? It seems more likely to me that this is a real problem than a PR piece.
  - TheAnimus 14y ago
    >It seems more likely to me that this is a real problem than a PR piece. You don't mean that a reputable tech news site would ever use 'Apple' and 'iSomething' in a headline for SEO bate?
  - declan 14y ago
    If I were the feds and I had an intimate relationship with AT&T (hi, warrantless wiretaps!) and VWZ and other wireless providers stretching back decades, and all of these other wireless providers sent SMS content in the clear, I'd very much want everyone in the world to continue to use SMS. Encrypting text messages with iMessage or a similar service simply makes my life more difficult. And remember Apple has been lobbying against a law that would extend CALEA to iMessage.
  - mgurlitz 14y ago
    This could encourage people to use an encrypted messaging program that is closed-source, has a large attack surface, and that might not be patched if a flaw is found. So they do have some incentive to get people to use iMessage over something like Cryptocat.
    - cinquemb 14y ago
runjake 14y ago
About a year ago, a SA from a certain three-letter agency who was pretty fluent in technology (our conversation largely centered around Bitcoin) mentioned that iMessage is not end-to-end encryption. That, to his understanding, it was client<-->apple<-->client TLS encryption. I think I might actually side with the tin-foils on this one. In any case, iMessage isn't a (well-)documented protocols implementation, so I wouldn't rely on it for security. Edit: Public scrutiny seems to back up the SA's claim [1]. 1. http://imfreedom.org/wiki/IMessage http://imfreedom.org/wiki/IMessage
- doe88 14y ago
  In the page you link to, it doesn't seem there is an example where one client try to send a message to another client? Am I missing something?
  - nicholassmith 14y ago
    Yeah I was looking for actual message content in there and couldn't spot it. Not saying that Apple isn't misrepresenting, but I couldn't spot proof that your messages are getting sent without encryption.
- declan 14y ago
  If true, that would be interesting because it means that Apple has been lying for years. See, for example: http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS.. http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS.... "secure end-to-end encryption" The article links to the iMessage examination, but where does it back up your TLA associate's claim that end-to-end is a lie?
  - runjake 14y ago
    Your URL is broken. The full URL is: http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS-Includes-Notification-Center-iMessage-Newsstand-Twitter-Integration-Among-200-New-Features.html http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS... From the URL: "iMessage also features delivery and read receipts, typing indication and secure end-to-end encryption." And thanks for the link!
blueprint 14y ago
It's a trap!
joshdick 14y ago
So what if DEA can't decrypt it? The real question is: Can the NSA decrypt it?
- pyre 14y ago
  Depends on what you are doing. I doubt that the NSA would tip their hand that they could decrypt such things even in the case of child pornographers. Anything that would be taken into open court would shine light onto where evidence, etc came from. The real danger from NSA decryption would be in their storage facilities. What you say now could come back to haunt you in the future depending on the political climate (e.g. the US falls into a police state where political prisoners are taken, etc).
- declan 14y ago
  Additional questions: Given that the DEA is more likely to reveal its methods in court intentionally or unintentionally (http://news.cnet.com/8301-10784_3-9741357-7.html http://news.cnet.com/8301-10784_3-9741357-7.html), even if the NSA can decrypt iMessage communications, why in the world would they share this knowledge with law enforcement? It's a modern version of the Ultra intercepts/Coventry blitz (now called into question). The NSA might risk revealing its methods if it would stop the next 9/11. To put a meth dealer in jail? Not a chance.
  - pi18n 14y ago
    > The NSA might risk revealing its methods if it would stop the next 9/11. I think the government would need to be in mortal peril otherwise before they reveal they broke RSA, assuming that they have. To stop a 9/11-type attack they would probably fake some information leak from the other side.
- logn 14y ago
  Well, drug dealers/users would care about that distinction.
- koenigdavidmj 14y ago
  The NSA can reveal exactly once that they can decrypt a given encryption algorithm. They're not going to waste that on something trivial.
yalogin 14y ago
The one thing that stands out from that article is that iMessage is the most popular encrypted chat program in history. Is this true? Isn't gchat encrypted as well?
- a2tech 14y ago
  Gchat isn't encrypted in any way-other than over SSL to and from your client to Google's servers. Your chat history is also stored in gmail.
anologwintermut 14y ago
As the end of the article hints,this is highly unlikely to be actually true and more so the result of incompetence on the part of Apple and the DEA. It is most likely more of the we need better law enforcement access to stuff FUD that is used to insert backdoors into systems that actually weaken security even if you trust the government, then an actual problem Apple appears to act as a certificate authority for IMessage [0]. At the very least Apple could man-in-the-middle any (and scarily) all their traffic. The article implies that they'd have to do this before the first message is ever sent between to parties. Presumably, we'd hope Apple has the ability to re-key the service since phones get stolen and lost, so they can forge that process to insert the bogus key. We'd probably also hope that your key is not shared across all of your devices, so it might(though its not as likely as the rekey protocol) also be possible to add a device as that is "the feds" Yes, both of these would require active work on Apple/ law enforcement's part to forward the messages to their intended recipient. However, this isn't that much work and 2) for actual wiretaps you typically need someone to monitor the tap so you don't record information not covered by the tap(we see this in The Wire). Lastly, there is precedent (all be it Canadian) for companies being forced to exploit vulnerabilities in their system. [1] Also, this ignores the fact that apple has device backups of most people's devices and can probably extract keys from them ( even for the encrypted ones, its likely with a poor password) [0]http://blog.cryptographyengineering.com/2012/08/dear-apple-please-set-imessage-free.html http://blog.cryptographyengineering.com/2012/08/dear-apple-p... [1] http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/
kunai 14y ago
tl;dr, government bureaucrats upset because they can't spy on innocent civilians.
ComputerGuru 14y ago
It's interesting how easy Apple's iMessage model would lend itself to being a mass-deployed, heavily-used, CA-based asymmetric encryption network. As I understand iMessage, when you attempt to text a number a background thread fires and checks with Apple's iMessage servers to see whether or not the number is associated with an iMessage account, then returns the end-user account details to your device so it may send a digital message addressed to that user to Apple's iMessage servers. Replace that digital ID with a public key. Private keys are generated and kept only on your iDevice. iMessage servers are your CA. Each iDevice has a unique public key. At this point you have a very secure, end-to-end encryption scheme. No warrantless snooping is possible, and even Apple is unaware of your message contents. Now depending on whether you want your design to be CALEA-compatible or not, Apple can issue a new private key to the government and add it to "your" list of public keys on their CA to allow the government to intercept future messages after they have obtained a warrant. If you think you can go toe-to-toe with the FBI and exempt yourself from CALEA by claiming the design of your infrastructure does not permit for message interception, you can tweak the CA around a bit. Only one public key per user, pass private key symmetrically encrypted with a password only the user knows from one device to the other via a "secure" side channel when adding new iDevice to user's iMessage account or other workaround. I'm absolutely not a security person, and none of what I say should be taken except as some ramblings that might have some hint of an idea beneath them. I already can think of a dozen weaknesses in this system, this kinda works only if you assume you can trust Apple to play within the rules of the framework they're making, i.e. not to try to intercept your private key, log your keystrokes, automatically add a second public key recipient to your messages, etc. Fact of the matter is, you are at their mercy. tptacek, please be gentle in gutting me. Edit: Thanks for that link, daniel. It is comforting to know that there is indeed some base level of security. If CALEA-compliance is achieved by adding the fed's public key to a list of destination public keys for a message, that implies you should actually be able to find out whether or not you're being monitored by simply checking for new/unknown/unexpected additions to your list of public keys. Of course, there are other methods of doing this that wouldn't be as easy to detect, e.g. maybe there is an out-of-band request for additional public keys to send to, maybe the fed's public key is already embedded in the device and is being used invisibly every time, etc. etc. etc. Edit2: For people wondering if syncing of old iMessages between devices means iMessage doesn't work like this, I don't think that's the case. I believe that's done via iCloud (i.e. backup of previously decrypted messages), as when you add a new Apple ID to iMessages on OS X, you don't get the old messages for that account, only new ones. So it's another attack vector, but not inherent weakness in the iMessage design.
josho 14y ago
Several years ago I worked with a senior tech that had previously worked for the NSA. For his personal private data he secured it using nothing less than 4096 bit encryption. Due to his confidentiality agreements he couldn't provide specifics about the NSA's capabilities, he only would share his own personal security practices. After that discussion I concluded that if the US Government wanted to know something about you they could find out. Not only by technical means, but by any channel you could likely imagine. These guys are smart, the idiots you hear about in the media are field agents, not the back office folks conducting the real security work. Since that time I've also assumed that the US has encryption technology that is at least 5 years ahead of public research. Today, I assume that means the US has access to a functional quantum computer and anything using today's encryption standards are left insecure if the right 3 letter agency wants to know.
- Jach 14y ago
  RSA-based encryption may be insecure right now; I strongly doubt any agency has access to a quantum computer powerful enough to break it. But if it is insecure, it doesn't really matter. The US can't do anything with the information it gains, because the US can't let anyone know they can break RSA-based crypto. Once it becomes known that powerful enough quantum computers are around, the entire crypto community will switch to one of the several algorithms that are immune to quantum attacks, so their capability is really only useful for a one-time thing. If I was a major criminal organization I might have already invested time to switch algorithms.
EGreg 14y ago
So the government wants to make laws to prevent people from securely talking to each other?
- rhizome 14y ago
  They'd rather not have to be so vulgar as to publicize it through legislation. Just giving them the power to read everything will be satisfactory enough.
  - EGreg 14y ago
    Well but the laws are for the providers...
mtgx 14y ago
I bet it doesn't even use OTR. You can't just rely on Apple to keep it secure. I do hope Google's upcoming Babel service is at least as secure, but I also hope it uses OTR.
runn1ng 14y ago
Is the code open for scrutiny? No? Then it's not secure enough for me, sorry.
shmerl 14y ago
OTR is better.
smoyer 14y ago
Smart Jabber users (those who want privacy) exchange public keys, encrypt each message with the recipient's public key and sign each message with their private key. Unless a private key is compromised, the recipient is guaranteed the message came from the sender and that the body is only readable by the recipient. I've been using keys with both Jabber and e-mail for a long time ... what we really need is the clients to use encryption as their default mode.
nsxwolf 14y ago
So, this article is untrue? Apple has the messages in plaintext on their servers, thus the DEA could in fact subpoena them? I'm getting mixed messages. Consensus?
Zimahl 14y ago
We don't want to have a system where you're needlessly imposing burdens on thriving industries or even budding industries Messaging is superfluous on the internet. Everything has it from Words With Friends to World of Warcraft. I understand that not all messaging systems are encrypted but being required to put in a backdoor for a government agency to spy on messages is a fair amount of work. Would you have to log all messaging too and for how long?
telecuda 14y ago
IF a court order (40+ page Title 3) were provided to surveil a criminal suspect, do you believe that Apple/iMessage and VoIP services should be required to respond to law enforcement intercept requests? If yes, then legal and technical frameworks are needed where service providers outside the traditional telcos can respond. This is the gap that has been widening since the introduction of the smartphone. It's not a huge problem right now since most criminal communication that police are interested in is still done over traditional voice, SMS, and email (where these providers are already interfaced with law enforcement).
- Zigurd 14y ago
  That point of view implies making client-based encryption illegal, or it's a very short hop to the same outcome, except that message contents are secured separately from the messaging application and infrastructure behind it.
fnayr 14y ago
Why shouldn't I work for the NSA? That's a tough one. But I'll take a shot. Say I'm workin' at the NSA and somebody puts a code on my desk, somethin' no one else can break. Maybe I take a shot at it and maybe I break it and I'm real happy with myself cause I did my job well, but maybe that code was the location of some rebel army in North Africa or the Middle East and once they have that location, they bomb the village where the rebels are hiding, fifteen hundred people I never met, never had no problem with get killed. Now the politicains are sayin' "Oh send in the marines to secure the area, cause they don't give a shit, won't be their kid over there gettin' shot just like it wasn't them when their number got called cause they were all pullin' a tour in the National Guard. It'll be some kid from Southy over there takin' shrapnel in the ass. He comes back to find that the plant he used to work at, got exported to the country he just got back from, and the guy that put the shrapnel in his ass got his old job cause he'll work for 15 cents a day and no bathroom breaks. Meanwhile, he realises the only reason he was over there in the first place was so that we could install a government that would sell us oil at a good price, and ofcourse the oil companies use a little skirmish over there to scare up domestic oil prices, a cute little ancilliary benefit for them, but it ain't helpin' my buddy at 2.50 a gallon. Their takin' their sweet time bringin' the oil back, of course maybe they even took the liberty of hiring an alcoholic skipper who likes to drink martini's and fuckin' play slolum with the icebergs. It ain't to long til he hits one, spills the oil, and kills all the sea life in the North Atlantic... so now my buddy's out of work, he can't afford to drive, so he's walkin' to the fuckin' job interviews which sucks cause the shrapnel in his ass is givin' him cronic hemroids and meanwhile, he's starvin' cause everytime he tries to get a bite to eat the only blue plate special their serving is North Atlantic scrod with Quaker State.... so what did I think? I'm holdin' out for somethin' better. I figure fuck it, while Im at it why not just shoot my buddy, take his job, give it to his sworn enemy, hike up gas prices, bomb a village, club a baby seal, hit the hash pipe, and join the National Guard. I could be elected President.
A1kmm 14y ago
Whether or not the software is secure from Apple is a moot point if Apple can, at any point in time, deploy an arbitrary software update that only affects a single device. I presume Apple has the ability to send a backdoored update to iMessage to any user they want, and probably to obfuscate it well enough to not tip anyone off. Therefore, if DEA can get a warrant requiring Apple to provide technical assistance, Apple has at least one route to get message plaintext.
mattbarrie 14y ago
Not for long.
mindcrime 14y ago
Good. Isn't that the point of encryption? F%!# the DEA anyway. Now we need to get more people educated on the importance of using strong crypto to protect their private communications.

215 points by donohoe 14y ago

So, if they're caught in other ways than via the surveillance, does that open up criminals using iMessage to further prosecution based on the notion that they used encryption to conceal a crime?

webignition 14y ago
My understanding is the messages app seamlessly transitions to using iMessage to send messages over a data connection where available. Assuming this to be the case, you wouldn't normally choose to use iMessage. It just happens if it can. If further penalty were to be considered, I expect the prosecutor would have to prove that the user intentionally took action to ensure iMessage was used for the delivery of messages instead of SMS. I suspect that would be hard to demonstrate.

rmrfrmrf 14y ago

Boo hoo?

pedrocr 14y ago

If I was the DEA and had a way to break the iMessage encryption, this is exactly the kind of article I'd try to have someone write.

Wilya 14y ago
I guess the real question is: Is this article a DEA PR piece or an Apple PR piece ?
- youngerdryas 14y ago
  I doubt either but it does cast Google in a bad light. Does anyone know if Google reads your SMSs as well as email?
  - BHSPitMonkey 14y ago
    That depends on whether you mean * regular SMS/MMS messages sent from the Messaging app on Android, in which case: No, of course not. Those go directly to the cellular modem in the device. Or * messages sent/received using Google Voice, in which case: Probably. These are scraps of data that live on Google's servers, just like data within Gmail/GTalk/et al. They have mp3 audio and text transcriptions of all your incoming voicemail that comes in through GV.
    - youngerdryas 14y ago
      I would think Google Now would want access to your SMSs.
      - skeletonjelly 14y ago
        I've never seen it mentioned. Definitely email (package tracking, flight bookings etc) but never read SMS is tracked.
  - mbq 14y ago
    Well, on Android you can install TextSecure and have even a more secure messaging. And replace the stock system with Cyanogen mod or similar and have a smartphone that won't be taking commands from the mothership.
glurgh 14y ago
Not really. The DEA is perfectly aware that such an article would be trivially identified as an inept ruse by anyone wearing cheap and easy-to-construct tinfoil headgear.
lhnz 14y ago
What do you have to gain by going onto Hacker News and posting conspiracies theories about DEA disinformation? Are you working for some kind of anti-US gov agency perhaps? Er
- coldtea 14y ago
  >What do you have to gain by going onto Hacker News and posting conspiracies theories about DEA disinformation? Are you working for some kind of anti-US gov agency perhaps? For one, why assume he cares at all about US gov agencies? HN is international. There are people here who could not care less about US agencies. Not to mention there are people who despise their abuses and privacy breaches, including lots of Americans. Second, not everything is a "conspiracy theory". And not every "conspiracy theory" is laughable (e.g about aliens or illuminati). Real-life conspiracies (people, agencies etc, conspiring to do some stuff in secret to gain something) happen all the time. Actually conspiracy (covertly trying to spread misinformation or to gain state information or to steal trade secrets etc) is the very thing secret agencies do. As for your misguided surprise about how an agency could ever use the press to spread misinformation, you might want to read on this: http://en.wikipedia.org/wiki/Operation_Mockingbird http://en.wikipedia.org/wiki/Operation_Mockingbird
  - pyre 14y ago
    The problem is that every statement could be a 'government conspiracy.' E.g.: The DEA can break iMessage encryption Obviously they can't, and they want you to shy away from using iMessage! The DEA can't break iMessage encryption Obviously they can, and they want you to keep/start using it!
    - coldtea 14y ago
      Sure. But that's not an argument against it being possible (or actually true). I mean, in your example there are 3 cases: 1) Obviously that can't, and they want you to shy away from using iMessage! 2) Obviously they can, and they want you to keep/start using it! 3) They can't and they are frank about it. It could be either of the three. We cannot say that it can only be (3) because "(1) and (2) are conspiracies". We cannot even say that (3) is more possible because it doesn't involve a conspiracy. It depends on more information and context to decide. Some situations we know quite well that are unlikely to involve conspiracies ("Jack said he went to Spain for holidays"). Other situations, we know quite well that are more likely to involve conspiracies ("The other 2 co-founders of my startup had a private meeting with a VC without informing me"). Now, something involving state agencies, I'd say is quite likely to involve some kind of conspiracy.
Spooky23 14y ago
People said that about BlackBerry BBM messages, and Nextel DirectConnect too. But shortly thereafter, you started hearing about countries collaborating with BlackBerry to decrypt messages... first in palces like Saudi Arabia and Dubai, then in places like the UK. That tends to support the assertion that BBM was difficult/impossible to intercept.

dmix 14y ago

> "it is impossible to intercept iMessages between two Apple devices" even with a court order approved by a federal judge. And even more importantly, impossible with a warrantless wiretap as well. This new wide-spread adoption of encryption is law enforcements new enemy.

archon 14y ago
Maybe for warrantless wiretaps, yes. But for any legal surveillance, they'll just get a warrant and compel Apple/Microsoft/Twitter/Whoever to hand over any data they have.
- shalmanese 14y ago
  end-to-end means Apple itself doesn't ever know what is being sent.
  - Nrsolis 14y ago
    Apple can get access to the keys because they control the platform. I have no doubt in my mind that Apple can produce end-user keys and traffic if they were served a warrant from any US court.
    - doe88 14y ago
      I think it's more complicated than that IMO, by controlling the platform i.e. by signing keys and authenticating users they certainly can impersonate clients to others clients, but I doubt they can collect users private keys generated on users devices (of course they could if their app was explicitly sending private key to their servers but I doubt they do and I don't see a reason why they'd do it, in any case they don't need to do it).
      - Nrsolis 14y ago
        When IOS 6.1.4 gets pushed to your iPhone in the future, consider how difficult it would be for Apple to add code that copies your privately generated keys back to Apple for "key-escrow purposes".

Dylan16807 14y ago

All this worry about electronic messaging makes me wonder something. Can they get a warrant/order to intercept your physical mail and read it in transit? I'm wondering if they're actually less able to tap than in the past or if they're just whinging.

DanBC 14y ago
EFF say that physical mail is safer than anything else because the legal protections are so strong. But then you have to trust that 'they' are law abiding. Extraordinary rendition is both reassuring and alarming. 'They' will jump through hoops to look like they're obeying laws, but the end result is still people being water-boarded. The Hushmail thing shows that some companies will happily roll over when given valid law enforcement documentation. (Fair enough, I'm not sure what else they should do.) (https://ssd.eff.org/wire/protect https://ssd.eff.org/wire/protect)
- betterunix 14y ago
  "The Hushmail thing shows that some companies will happily roll over when given valid law enforcement documentation. (Fair enough, I'm not sure what else they should do.)" Companies could design products that do not give them the ability to cooperate in that manner. Hushmail, for example, could have designed a system where customers were sold smartcards and not actually run the mail transport, so that Hushmail itself had no ability to access encrypted messages. While this would have made Hushmail a bit less convenient, it would also have made it many times more secure. Unfortunately, in the current right-wing political climate, there are few incentives for companies to actually develop or deploy such systems.
  - Dylan16807 14y ago
    From what I recall Hushmail had a downloadable applet that was safe. The problem is they stole certain user passwords by altering the web client.
    - betterunix 14y ago

zimbatm 14y ago

> They [the DEA] can also send a suspect malware, purchase a so-called zero day vulnerability to gain control of a target device and extract the contents Made me chuckle. Given that zero day are mostly available in black markets how can they justify to give money to criminals ?

bobwaycott 14y ago
I imagine they justify it with hand-waves to law enforcement, war on drugs/terror, national security, etc.
troym 14y ago
> how can they justify to give money to criminals ? Easy: they're both criminals.
peterwwillis 14y ago
Zero days are sold to the government by perfectly legitimate businesses, and the crap they don't buy is what ends up either in places like ZDI or eventually the black market.
codesuela 14y ago
Ever heard of Vupen? > VUPEN Exploits for Offensive Security As the world leader in vulnerability research, VUPEN provides extremely sophisticated and government-grade exploits specifically designed for the Intelligence and LEA community to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for exclusive and undisclosed vulnerabilities discovered by VUPEN researchers. Access to this service is restricted to organizations from countries members or partners of NATO, ANZUS and ASEAN. http://www.vupen.com/english/services/lea-index.php http://www.vupen.com/english/services/lea-index.php completely legitimate company
csoghoian 14y ago
Given that high-value zero days are mostly bought by governments from defense contractors and security companies. There. Fixed that for you.
lawnchair_larry 14y ago

smackfu 14y ago

This article and the DEA doc is confusing. It seems to mainly be saying that having a warrant to intercept cell communications won't get iMessages because it doesn't go through the cell carrier. It's implied a bit that it is encrypted end-to-end and that Apple can't get the contents... but it doesn't seem to actually say that anywhere. This comment on StackExchange says the encryption is only from sender to Apple and Apple to recipient, so Apple has the plaintext: http://security.stackexchange.com/questions/18908/the-inner-workings-of-imessage-security http://security.stackexchange.com/questions/18908/the-inner-... Also, wouldn't the same issues have come up with BBM?

declan 14y ago
It's not implied; the article states outright the encryption is end-to-end. :) That's based on Apple press releases from 2011 and 2012. See, for example: http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS-Includes-Notification-Center-iMessage-Newsstand-Twitter-Integration-Among-200-New-Features.html http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS... "secure end-to-end encryption"
- IheartApplesDix 14y ago
  Secure end to end encryption doesn't mean government agencies can't snoop on the coms. First of all, the CIA owns own one of the largest, if not the largest supercomputer. Also, the encryption could be using CIA's own root key. Example: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

lucian1900 14y ago

The sad part is that iMessage's encryption appears to be of dubious quality. Even worse, the protocol is not public, so there's no way to audit it.

klodolph 14y ago
If you can't audit it, you can't be sure it is sound. But you seem to claim that it isn't sound, which also isn't possible without an audit. I think there are at least a few engineers at Apple capable of implementing this correctly. Not that I assume it's unbreakable, I'm just not as pessimistic.
- revscat 14y ago
  When you're talking about encryption pessimism is the default. The whole point is lack of trust.
- lucian1900 14y ago
  What has been inferred so far is worrying http://imfreedom.org/wiki/IMessage http://imfreedom.org/wiki/IMessage.
- wwwtyro 14y ago
  > But you seem to claim that it isn't sound, which also isn't possible without an audit. That's not quite true, right? If encryption was successfully broken, then you wouldn't need an audit. Even if it wasn't broken, there's still things like this: http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/ http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/

nodata 14y ago

Dear criminals, Please use iMessage more, we promise we definitely can't read your messages. Lots of love, Feds xxx

Ntrails 14y ago
There's no advantage to them in people using iMessage. They can easily get your text messages already. You could go high-tinfoil and claim they would rather people iMessaged than using whatsapp or some other free message service? But anyone thinking about avoiding federal intercepts would use neither of these things rendering this piece worthless. So what do they actually have to gain? It seems more likely to me that this is a real problem than a PR piece.
- TheAnimus 14y ago
  >It seems more likely to me that this is a real problem than a PR piece. You don't mean that a reputable tech news site would ever use 'Apple' and 'iSomething' in a headline for SEO bate?
- declan 14y ago
  If I were the feds and I had an intimate relationship with AT&T (hi, warrantless wiretaps!) and VWZ and other wireless providers stretching back decades, and all of these other wireless providers sent SMS content in the clear, I'd very much want everyone in the world to continue to use SMS. Encrypting text messages with iMessage or a similar service simply makes my life more difficult. And remember Apple has been lobbying against a law that would extend CALEA to iMessage.
- mgurlitz 14y ago
  This could encourage people to use an encrypted messaging program that is closed-source, has a large attack surface, and that might not be patched if a flaw is found. So they do have some incentive to get people to use iMessage over something like Cryptocat.
  - cinquemb 14y ago

runjake 14y ago

About a year ago, a SA from a certain three-letter agency who was pretty fluent in technology (our conversation largely centered around Bitcoin) mentioned that iMessage is not end-to-end encryption. That, to his understanding, it was client<-->apple<-->client TLS encryption. I think I might actually side with the tin-foils on this one. In any case, iMessage isn't a (well-)documented protocols implementation, so I wouldn't rely on it for security. Edit: Public scrutiny seems to back up the SA's claim [1]. 1. http://imfreedom.org/wiki/IMessage http://imfreedom.org/wiki/IMessage

doe88 14y ago
In the page you link to, it doesn't seem there is an example where one client try to send a message to another client? Am I missing something?
- nicholassmith 14y ago
  Yeah I was looking for actual message content in there and couldn't spot it. Not saying that Apple isn't misrepresenting, but I couldn't spot proof that your messages are getting sent without encryption.
declan 14y ago
If true, that would be interesting because it means that Apple has been lying for years. See, for example: http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS.. http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS.... "secure end-to-end encryption" The article links to the iMessage examination, but where does it back up your TLA associate's claim that end-to-end is a lie?
- runjake 14y ago
  Your URL is broken. The full URL is: http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS-Includes-Notification-Center-iMessage-Newsstand-Twitter-Integration-Among-200-New-Features.html http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS... From the URL: "iMessage also features delivery and read receipts, typing indication and secure end-to-end encryption." And thanks for the link!

blueprint 14y ago

It's a trap!

joshdick 14y ago

So what if DEA can't decrypt it? The real question is: Can the NSA decrypt it?

pyre 14y ago
Depends on what you are doing. I doubt that the NSA would tip their hand that they could decrypt such things even in the case of child pornographers. Anything that would be taken into open court would shine light onto where evidence, etc came from. The real danger from NSA decryption would be in their storage facilities. What you say now could come back to haunt you in the future depending on the political climate (e.g. the US falls into a police state where political prisoners are taken, etc).
declan 14y ago
Additional questions: Given that the DEA is more likely to reveal its methods in court intentionally or unintentionally (http://news.cnet.com/8301-10784_3-9741357-7.html http://news.cnet.com/8301-10784_3-9741357-7.html), even if the NSA can decrypt iMessage communications, why in the world would they share this knowledge with law enforcement? It's a modern version of the Ultra intercepts/Coventry blitz (now called into question). The NSA might risk revealing its methods if it would stop the next 9/11. To put a meth dealer in jail? Not a chance.
- pi18n 14y ago
  > The NSA might risk revealing its methods if it would stop the next 9/11. I think the government would need to be in mortal peril otherwise before they reveal they broke RSA, assuming that they have. To stop a 9/11-type attack they would probably fake some information leak from the other side.
logn 14y ago
Well, drug dealers/users would care about that distinction.
koenigdavidmj 14y ago
The NSA can reveal exactly once that they can decrypt a given encryption algorithm. They're not going to waste that on something trivial.

yalogin 14y ago

The one thing that stands out from that article is that iMessage is the most popular encrypted chat program in history. Is this true? Isn't gchat encrypted as well?

a2tech 14y ago
Gchat isn't encrypted in any way-other than over SSL to and from your client to Google's servers. Your chat history is also stored in gmail.

anologwintermut 14y ago

As the end of the article hints,this is highly unlikely to be actually true and more so the result of incompetence on the part of Apple and the DEA. It is most likely more of the we need better law enforcement access to stuff FUD that is used to insert backdoors into systems that actually weaken security even if you trust the government, then an actual problem Apple appears to act as a certificate authority for IMessage [0]. At the very least Apple could man-in-the-middle any (and scarily) all their traffic. The article implies that they'd have to do this before the first message is ever sent between to parties. Presumably, we'd hope Apple has the ability to re-key the service since phones get stolen and lost, so they can forge that process to insert the bogus key. We'd probably also hope that your key is not shared across all of your devices, so it might(though its not as likely as the rekey protocol) also be possible to add a device as that is "the feds" Yes, both of these would require active work on Apple/ law enforcement's part to forward the messages to their intended recipient. However, this isn't that much work and 2) for actual wiretaps you typically need someone to monitor the tap so you don't record information not covered by the tap(we see this in The Wire). Lastly, there is precedent (all be it Canadian) for companies being forced to exploit vulnerabilities in their system. [1] Also, this ignores the fact that apple has device backups of most people's devices and can probably extract keys from them ( even for the encrypted ones, its likely with a poor password) [0]http://blog.cryptographyengineering.com/2012/08/dear-apple-please-set-imessage-free.html http://blog.cryptographyengineering.com/2012/08/dear-apple-p... [1] http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/

kunai 14y ago

tl;dr, government bureaucrats upset because they can't spy on innocent civilians.

ComputerGuru 14y ago

It's interesting how easy Apple's iMessage model would lend itself to being a mass-deployed, heavily-used, CA-based asymmetric encryption network. As I understand iMessage, when you attempt to text a number a background thread fires and checks with Apple's iMessage servers to see whether or not the number is associated with an iMessage account, then returns the end-user account details to your device so it may send a digital message addressed to that user to Apple's iMessage servers. Replace that digital ID with a public key. Private keys are generated and kept only on your iDevice. iMessage servers are your CA. Each iDevice has a unique public key. At this point you have a very secure, end-to-end encryption scheme. No warrantless snooping is possible, and even Apple is unaware of your message contents. Now depending on whether you want your design to be CALEA-compatible or not, Apple can issue a new private key to the government and add it to "your" list of public keys on their CA to allow the government to intercept future messages after they have obtained a warrant. If you think you can go toe-to-toe with the FBI and exempt yourself from CALEA by claiming the design of your infrastructure does not permit for message interception, you can tweak the CA around a bit. Only one public key per user, pass private key symmetrically encrypted with a password only the user knows from one device to the other via a "secure" side channel when adding new iDevice to user's iMessage account or other workaround. I'm absolutely not a security person, and none of what I say should be taken except as some ramblings that might have some hint of an idea beneath them. I already can think of a dozen weaknesses in this system, this kinda works only if you assume you can trust Apple to play within the rules of the framework they're making, i.e. not to try to intercept your private key, log your keystrokes, automatically add a second public key recipient to your messages, etc. Fact of the matter is, you are at their mercy. tptacek, please be gentle in gutting me. Edit: Thanks for that link, daniel. It is comforting to know that there is indeed some base level of security. If CALEA-compliance is achieved by adding the fed's public key to a list of destination public keys for a message, that implies you should actually be able to find out whether or not you're being monitored by simply checking for new/unknown/unexpected additions to your list of public keys. Of course, there are other methods of doing this that wouldn't be as easy to detect, e.g. maybe there is an out-of-band request for additional public keys to send to, maybe the fed's public key is already embedded in the device and is being used invisibly every time, etc. etc. etc. Edit2: For people wondering if syncing of old iMessages between devices means iMessage doesn't work like this, I don't think that's the case. I believe that's done via iCloud (i.e. backup of previously decrypted messages), as when you add a new Apple ID to iMessages on OS X, you don't get the old messages for that account, only new ones. So it's another attack vector, but not inherent weakness in the iMessage design.

josho 14y ago

Several years ago I worked with a senior tech that had previously worked for the NSA. For his personal private data he secured it using nothing less than 4096 bit encryption. Due to his confidentiality agreements he couldn't provide specifics about the NSA's capabilities, he only would share his own personal security practices. After that discussion I concluded that if the US Government wanted to know something about you they could find out. Not only by technical means, but by any channel you could likely imagine. These guys are smart, the idiots you hear about in the media are field agents, not the back office folks conducting the real security work. Since that time I've also assumed that the US has encryption technology that is at least 5 years ahead of public research. Today, I assume that means the US has access to a functional quantum computer and anything using today's encryption standards are left insecure if the right 3 letter agency wants to know.

Jach 14y ago
RSA-based encryption may be insecure right now; I strongly doubt any agency has access to a quantum computer powerful enough to break it. But if it is insecure, it doesn't really matter. The US can't do anything with the information it gains, because the US can't let anyone know they can break RSA-based crypto. Once it becomes known that powerful enough quantum computers are around, the entire crypto community will switch to one of the several algorithms that are immune to quantum attacks, so their capability is really only useful for a one-time thing. If I was a major criminal organization I might have already invested time to switch algorithms.

EGreg 14y ago

So the government wants to make laws to prevent people from securely talking to each other?

rhizome 14y ago
They'd rather not have to be so vulgar as to publicize it through legislation. Just giving them the power to read everything will be satisfactory enough.
- EGreg 14y ago
  Well but the laws are for the providers...

mtgx 14y ago

I bet it doesn't even use OTR. You can't just rely on Apple to keep it secure. I do hope Google's upcoming Babel service is at least as secure, but I also hope it uses OTR.

runn1ng 14y ago

Is the code open for scrutiny? No? Then it's not secure enough for me, sorry.

shmerl 14y ago

OTR is better.

smoyer 14y ago

Smart Jabber users (those who want privacy) exchange public keys, encrypt each message with the recipient's public key and sign each message with their private key. Unless a private key is compromised, the recipient is guaranteed the message came from the sender and that the body is only readable by the recipient. I've been using keys with both Jabber and e-mail for a long time ... what we really need is the clients to use encryption as their default mode.

nsxwolf 14y ago

So, this article is untrue? Apple has the messages in plaintext on their servers, thus the DEA could in fact subpoena them? I'm getting mixed messages. Consensus?

Zimahl 14y ago

We don't want to have a system where you're needlessly imposing burdens on thriving industries or even budding industries Messaging is superfluous on the internet. Everything has it from Words With Friends to World of Warcraft. I understand that not all messaging systems are encrypted but being required to put in a backdoor for a government agency to spy on messages is a fair amount of work. Would you have to log all messaging too and for how long?

telecuda 14y ago

IF a court order (40+ page Title 3) were provided to surveil a criminal suspect, do you believe that Apple/iMessage and VoIP services should be required to respond to law enforcement intercept requests? If yes, then legal and technical frameworks are needed where service providers outside the traditional telcos can respond. This is the gap that has been widening since the introduction of the smartphone. It's not a huge problem right now since most criminal communication that police are interested in is still done over traditional voice, SMS, and email (where these providers are already interfaced with law enforcement).

Zigurd 14y ago
That point of view implies making client-based encryption illegal, or it's a very short hop to the same outcome, except that message contents are secured separately from the messaging application and infrastructure behind it.

fnayr 14y ago

Why shouldn't I work for the NSA? That's a tough one. But I'll take a shot. Say I'm workin' at the NSA and somebody puts a code on my desk, somethin' no one else can break. Maybe I take a shot at it and maybe I break it and I'm real happy with myself cause I did my job well, but maybe that code was the location of some rebel army in North Africa or the Middle East and once they have that location, they bomb the village where the rebels are hiding, fifteen hundred people I never met, never had no problem with get killed. Now the politicains are sayin' "Oh send in the marines to secure the area, cause they don't give a shit, won't be their kid over there gettin' shot just like it wasn't them when their number got called cause they were all pullin' a tour in the National Guard. It'll be some kid from Southy over there takin' shrapnel in the ass. He comes back to find that the plant he used to work at, got exported to the country he just got back from, and the guy that put the shrapnel in his ass got his old job cause he'll work for 15 cents a day and no bathroom breaks. Meanwhile, he realises the only reason he was over there in the first place was so that we could install a government that would sell us oil at a good price, and ofcourse the oil companies use a little skirmish over there to scare up domestic oil prices, a cute little ancilliary benefit for them, but it ain't helpin' my buddy at 2.50 a gallon. Their takin' their sweet time bringin' the oil back, of course maybe they even took the liberty of hiring an alcoholic skipper who likes to drink martini's and fuckin' play slolum with the icebergs. It ain't to long til he hits one, spills the oil, and kills all the sea life in the North Atlantic... so now my buddy's out of work, he can't afford to drive, so he's walkin' to the fuckin' job interviews which sucks cause the shrapnel in his ass is givin' him cronic hemroids and meanwhile, he's starvin' cause everytime he tries to get a bite to eat the only blue plate special their serving is North Atlantic scrod with Quaker State.... so what did I think? I'm holdin' out for somethin' better. I figure fuck it, while Im at it why not just shoot my buddy, take his job, give it to his sworn enemy, hike up gas prices, bomb a village, club a baby seal, hit the hash pipe, and join the National Guard. I could be elected President.

A1kmm 14y ago

Whether or not the software is secure from Apple is a moot point if Apple can, at any point in time, deploy an arbitrary software update that only affects a single device. I presume Apple has the ability to send a backdoored update to iMessage to any user they want, and probably to obfuscate it well enough to not tip anyone off. Therefore, if DEA can get a warrant requiring Apple to provide technical assistance, Apple has at least one route to get message plaintext.

mattbarrie 14y ago

Not for long.

mindcrime 14y ago

Good. Isn't that the point of encryption? F%!# the DEA anyway. Now we need to get more people educated on the importance of using strong crypto to protect their private communications.