3 ms·
As the end of the article hints,this is highly unlikely to be actually true and more so the result of incompetence on the part of Apple and the DEA. It is most
by anologwintermut 14y ago
As the end of the article hints,this is highly unlikely to be actually true and more so the result of incompetence on the part of Apple and the DEA. It is most likely more of the we need better law enforcement access to stuff FUD that is used to insert backdoors into systems that actually weaken security even if you trust the government, then an actual problem
Apple appears to act as a certificate authority for IMessage [0]. At the very least Apple could man-in-the-middle any (and scarily) all their traffic. The article implies that they'd have to do this before the first message is ever sent between to parties. Presumably, we'd hope Apple has the ability to re-key the service since phones get stolen and lost, so they can forge that process to insert the bogus key. We'd probably also hope that your key is not shared across all of your devices, so it might(though its not as likely as the rekey protocol) also be possible to add a device as that is "the feds"
Yes, both of these would require active work on Apple/ law enforcement's part to forward the messages to their intended recipient. However, this isn't that much work and 2) for actual wiretaps you typically need someone to monitor the tap so you don't record information not covered by the tap(we see this in The Wire).
Lastly, there is precedent (all be it Canadian) for companies being forced to exploit vulnerabilities in their system. [1]
Also, this ignores the fact that apple has device backups of most people's devices and can probably extract keys from them ( even for the encrypted ones, its likely with a poor password)
[0]http://blog.cryptographyengineering.com/2012/08/dear-apple-please-set-imessage-free.html http://blog.cryptographyengineering.com/2012/08/dear-apple-p...
[1] http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/