5 ms·

Why is it any worse than only Apple server reading all you messages? You trust one third party with proven track record of spying on its customers, but somehow

Why is it any worse than only Apple server reading all you messages? You trust one third party with proven track record of spying on its customers, but somehow you are upset that someone else also has access to you messages, thought that someone didn't (yet) do anything wrong with them. If you are American, you don't have to fear from Chinese espionage, and US agencies already have your data. If you are European, it's more or less the same. If you are from China, well, at least you can prove that you are not doing anything behind the government back ;)

nodata 13y ago
> Why is it any worse than only Apple server reading all you messages? Not. This. Again. Because one person can read your messages, it doesn't mean that the whole world should be able to. One happening doesn't mean the other is okay.
- antocv 13y ago
  You seem to misunderstand the OP concerns. It is not only one person, it is not only Apple servers reading all your messages. It is in fact the whole world. Through Apple gives it to NSA which hands it over to various other agencies, GHCQ, FRA, your data ends up in Israel. Your data is already a goods traded with on the international market. Why not increase the competitiveness of this Chinese actor, you will get better service in the future? More competitive - better service.
  - est 13y ago
    Let me give you an example. Apple, NSA saw CC number in your chat log, but Apple, NSA, GHCQ, FRA or Israeli Intelligence won't steal your CC and use it. However, the Chinese vendor could intercept CC info and sell it to blackmarket.
    - antocv 13y ago
      You seem to be confused. The NSA has already sold your CC on the black market. Its just that the buyer hasnt used it, because they cant use it without getting penalties. Penalties which this Chinese vendor would succumb to as well. Now are you going to say you trust Israel more than the Chinese, they wont misuse your CC, and if they did, its still better than trusting a Russian vendor?
- ajross 13y ago
  Uh... as I read it the point of this app is the the whole world is able to read your messages. This app is just the existence proof that all that is required is access to the raw packet data. Clearly most people are going to "trust" Apple Computer more than this app vendor. But the point is that such trust isn't worth anything. The data is hanging out there already.
  - saurik 13y ago
    Huh? So, does the existence of an open-source reimplementation of early versions of SSL also imply that if you had access to the raw packets you can read anyone else's SSL stream? How about if we first require the data to be sent in the clear to someone who refuses to tell us how DES works, but is willing to provide a web service that implements it? This app is not by any stretch of imagination proof that the protocol on the wire is not encrypted. Yes, that might be the case, and we might learn some interesting things at pod2g's talk on iMessage at HITB (I'm definitely looking forward to that), but that would be totally unrelated to the existence or possibility of this app.
philwelch 13y ago
People know who Apple is. Apple has a reputation. Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA. I don't know who's running this server in China. But unless it's the NSA, you're much worse off using this app than native iMessage, because now in addition to NSA seeing everything, so does this guy--who has no reputation at risk. Adding more eavesdroppers makes communications additively less secure. How exactly do I have nothing to fear from the Chinese? At least the NSA is unlikely to have any real interest in communications between Americans in America because it's outside their mission, which is not true for Chinese or Russian intelligence.
- deleted 13y ago
  [deleted]
- SideburnsOfDoom 13y ago
  > Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA. I do not think that this statement is accurate. The NSA has specifically targeted the largest players. Also: "encryption works. Properly implemented strong crypto systems are reliable" - Edward Snowden.
  - m0th87 13y ago
    Yes but you do have to sacrifice quite a bit to be outside of the NSA's realm of observability. Is iMessage securely encrypted? Wasn't the DEA caught red-handed with a false memo claiming they couldn't MITM iMessage communication?
    - levosmetalo 13y ago
      By MITM you think a guy with a hard drive sitting in the middle of the Apple HQ siphoning data directly to NSA? Yes, I could imagine that.
    - SideburnsOfDoom 13y ago
      > Yes but you do have to sacrifice quite a bit to be outside of the NSA's realm of observability. Very true. That's a consequence of the largest players in winner-take-all markets being targeted.
ffk 13y ago
Attack surface. When you increase the number of parties capable of decrypting your data, you increase the risk of an exposure.
jasonkester 13y ago
Surely you're joking. I don't doubt you can understand the difference between a government law enforcement agency reading your messages and some guy off the street reading your messages. Neither Apple nor the NSA will, for example, immediately rack up a string of fraudulent charges on every credit card number that it sees come through its system. Some random guy in China? I'd say there's a pretty high chance that's exactly the reason this app is in the app store.
- jlouis 13y ago
  No, it is not a joke. iMessage is not a secure communications channel. With this app in the wild, it is pretty clear it is not a secure communications channel. You should not post CC information along an insecure communications channel. You may be right that there is more risk involved now, but it is nice to get the point out in the open.
- k-mcgrady 13y ago
  >> "I don't doubt you can understand the difference between a government law enforcement agency reading your messages and some guy off the street reading your messages." I'd feel more secure with just some guy off the street reading my messages. Fortunately I don't ever send CC#'s through messaging services so there's very little else he could do.
  - cowsandmilk 13y ago
    where is your proof that the guy off the street in this case isn't the chinese government?
    - k-mcgrady 13y ago
      I didn't mention this case I was speaking more generally. And I'd personally be more worried with what the US government knows about me than the Chinese. I have many more interactions with American people and businesses and I like to visit there. I don't have much if any interaction with China so it doesn't bother me as much.
untog 13y ago
If you are American, you don't have to fear from Chinese espionage Citation needed. There are numerous stories (unconfirmed of course, but that's the way these things always are) of Chinese hackers breaking into companies and stealing trade secrets. They aren't just after super spies, you know. And you don't work in an industry the Chinese would be interested in? Good for you. But do you know anyone that is? This hack might quite possibly allow them to send messages as you to whoever they want. "The NSA has my information so hey, screw it" isn't really an appropriate reaction.
- niels_olson 13y ago
  My server logs suggest I need to fear Chinese espionage. You'd need a hell of a citation to beat that.
zomgbbq 13y ago
The Apple server cannot read your messages because it is encrypted client-side. https://www.schneier.com/blog/archives/2013/04/apples_imessage.html https://www.schneier.com/blog/archives/2013/04/apples_imessa...

nodata 13y ago

> Why is it any worse than only Apple server reading all you messages? Not. This. Again. Because one person can read your messages, it doesn't mean that the whole world should be able to. One happening doesn't mean the other is okay.

antocv 13y ago
You seem to misunderstand the OP concerns. It is not only one person, it is not only Apple servers reading all your messages. It is in fact the whole world. Through Apple gives it to NSA which hands it over to various other agencies, GHCQ, FRA, your data ends up in Israel. Your data is already a goods traded with on the international market. Why not increase the competitiveness of this Chinese actor, you will get better service in the future? More competitive - better service.
- est 13y ago
  Let me give you an example. Apple, NSA saw CC number in your chat log, but Apple, NSA, GHCQ, FRA or Israeli Intelligence won't steal your CC and use it. However, the Chinese vendor could intercept CC info and sell it to blackmarket.
  - antocv 13y ago
    You seem to be confused. The NSA has already sold your CC on the black market. Its just that the buyer hasnt used it, because they cant use it without getting penalties. Penalties which this Chinese vendor would succumb to as well. Now are you going to say you trust Israel more than the Chinese, they wont misuse your CC, and if they did, its still better than trusting a Russian vendor?
ajross 13y ago
Uh... as I read it the point of this app is the the whole world is able to read your messages. This app is just the existence proof that all that is required is access to the raw packet data. Clearly most people are going to "trust" Apple Computer more than this app vendor. But the point is that such trust isn't worth anything. The data is hanging out there already.
- saurik 13y ago
  Huh? So, does the existence of an open-source reimplementation of early versions of SSL also imply that if you had access to the raw packets you can read anyone else's SSL stream? How about if we first require the data to be sent in the clear to someone who refuses to tell us how DES works, but is willing to provide a web service that implements it? This app is not by any stretch of imagination proof that the protocol on the wire is not encrypted. Yes, that might be the case, and we might learn some interesting things at pod2g's talk on iMessage at HITB (I'm definitely looking forward to that), but that would be totally unrelated to the existence or possibility of this app.

philwelch 13y ago

People know who Apple is. Apple has a reputation. Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA. I don't know who's running this server in China. But unless it's the NSA, you're much worse off using this app than native iMessage, because now in addition to NSA seeing everything, so does this guy--who has no reputation at risk. Adding more eavesdroppers makes communications additively less secure. How exactly do I have nothing to fear from the Chinese? At least the NSA is unlikely to have any real interest in communications between Americans in America because it's outside their mission, which is not true for Chinese or Russian intelligence.

deleted 13y ago
[deleted]
SideburnsOfDoom 13y ago
> Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA. I do not think that this statement is accurate. The NSA has specifically targeted the largest players. Also: "encryption works. Properly implemented strong crypto systems are reliable" - Edward Snowden.
- m0th87 13y ago
  Yes but you do have to sacrifice quite a bit to be outside of the NSA's realm of observability. Is iMessage securely encrypted? Wasn't the DEA caught red-handed with a false memo claiming they couldn't MITM iMessage communication?
  - levosmetalo 13y ago
    By MITM you think a guy with a hard drive sitting in the middle of the Apple HQ siphoning data directly to NSA? Yes, I could imagine that.
  - SideburnsOfDoom 13y ago
    > Yes but you do have to sacrifice quite a bit to be outside of the NSA's realm of observability. Very true. That's a consequence of the largest players in winner-take-all markets being targeted.

ffk 13y ago

Attack surface. When you increase the number of parties capable of decrypting your data, you increase the risk of an exposure.

jasonkester 13y ago

Surely you're joking. I don't doubt you can understand the difference between a government law enforcement agency reading your messages and some guy off the street reading your messages. Neither Apple nor the NSA will, for example, immediately rack up a string of fraudulent charges on every credit card number that it sees come through its system. Some random guy in China? I'd say there's a pretty high chance that's exactly the reason this app is in the app store.

jlouis 13y ago
No, it is not a joke. iMessage is not a secure communications channel. With this app in the wild, it is pretty clear it is not a secure communications channel. You should not post CC information along an insecure communications channel. You may be right that there is more risk involved now, but it is nice to get the point out in the open.
k-mcgrady 13y ago
>> "I don't doubt you can understand the difference between a government law enforcement agency reading your messages and some guy off the street reading your messages." I'd feel more secure with just some guy off the street reading my messages. Fortunately I don't ever send CC#'s through messaging services so there's very little else he could do.
- cowsandmilk 13y ago
  where is your proof that the guy off the street in this case isn't the chinese government?
  - k-mcgrady 13y ago
    I didn't mention this case I was speaking more generally. And I'd personally be more worried with what the US government knows about me than the Chinese. I have many more interactions with American people and businesses and I like to visit there. I don't have much if any interaction with China so it doesn't bother me as much.

untog 13y ago

If you are American, you don't have to fear from Chinese espionage Citation needed. There are numerous stories (unconfirmed of course, but that's the way these things always are) of Chinese hackers breaking into companies and stealing trade secrets. They aren't just after super spies, you know. And you don't work in an industry the Chinese would be interested in? Good for you. But do you know anyone that is? This hack might quite possibly allow them to send messages as you to whoever they want. "The NSA has my information so hey, screw it" isn't really an appropriate reaction.

niels_olson 13y ago
My server logs suggest I need to fear Chinese espionage. You'd need a hell of a citation to beat that.

zomgbbq 13y ago

The Apple server cannot read your messages because it is encrypted client-side. https://www.schneier.com/blog/archives/2013/04/apples_imessage.html https://www.schneier.com/blog/archives/2013/04/apples_imessa...