3 ms·

Uh, how does this "encryption" work? For the website to show these details (and it does, in part, use these details in the interface) it must be able to decryp

by nwh 13y ago

Uh, how does this "encryption" work? For the website to show these details (and it does, in part, use these details in the interface) it must be able to decrypt these on the web applications side. Ergo the keys for decryption must also be on the server or derived from the users passwords, both of which make the use of encryption a fairly worthless venture. ED: As another commenter mentioned in an earlier thread, lots of other AppleID facing applications are gone as well ( https://ecommerce.apple.com/ https://ecommerce.apple.com/ ), so it would be interesting to find out how far this all goes. The websites don't seem that far disconnected from the information in iCloud.

jordanthoms 13y ago
I think the 'sensitive personal information' is passwords, so the names, addresses etc which are displayed on the site were not encrypted.
- deleted 13y ago
  [deleted]
fleitz 13y ago
Maybe they phoned for a ransom after breaking in? Your post is pure speculation and depends heavily on what Apple means by 'sensitive'. I'm guessing that Apple means your CC numbers, certs, shared keys, etc. Possibly also your support tickets, your bank numbers, etc. As for how encryption works, I'd suggest Applied Cryptography by Scheiner. I think there's a problem in that book about Bob keeping speculative posts to Alice secret from Eve. After reading that book, I'd suggest applying for a job at Apple to give you first hand knowledge of what they're actually doing and then you could make an informed judgement about what may or may not have been exposed.
- nwh 13y ago
  I am aware how crypto works. I was commenting on there being no source for a key in this situation, rendering it a fairly useless venture.
  - stan_rogers 13y ago
    In a case like this, there would (normally) only be one secret to find. (IVs, or at least the information IVs are derived from, and so forth would be stored with the data.) That doesn't necessarily make it easy to break if the key was securely handled, but it does make it catastrophic if the key is determined. Apple's email essentially says, "we don't think they have the key, but..." And a complete investigation, along with changes to the system and an opportunity for users to change data as soon as possible under the new system, is the right way to go about it.
- wisty 13y ago
  AFAIK, it was a white (or grey) hat hacker. See the comment on the techcrunch article. He nabbed Apple employee details, as proof. But they are probably worried that someone else has also done it.

by nwh 13y ago

jordanthoms 13y ago

I think the 'sensitive personal information' is passwords, so the names, addresses etc which are displayed on the site were not encrypted.

deleted 13y ago
[deleted]

fleitz 13y ago

Maybe they phoned for a ransom after breaking in? Your post is pure speculation and depends heavily on what Apple means by 'sensitive'. I'm guessing that Apple means your CC numbers, certs, shared keys, etc. Possibly also your support tickets, your bank numbers, etc. As for how encryption works, I'd suggest Applied Cryptography by Scheiner. I think there's a problem in that book about Bob keeping speculative posts to Alice secret from Eve. After reading that book, I'd suggest applying for a job at Apple to give you first hand knowledge of what they're actually doing and then you could make an informed judgement about what may or may not have been exposed.

nwh 13y ago
I am aware how crypto works. I was commenting on there being no source for a key in this situation, rendering it a fairly useless venture.
- stan_rogers 13y ago
  In a case like this, there would (normally) only be one secret to find. (IVs, or at least the information IVs are derived from, and so forth would be stored with the data.) That doesn't necessarily make it easy to break if the key was securely handled, but it does make it catastrophic if the key is determined. Apple's email essentially says, "we don't think they have the key, but..." And a complete investigation, along with changes to the system and an opportunity for users to change data as soon as possible under the new system, is the right way to go about it.
wisty 13y ago
AFAIK, it was a white (or grey) hat hacker. See the comment on the techcrunch article. He nabbed Apple employee details, as proof. But they are probably worried that someone else has also done it.