4 ms·

If they really took privacy seriously they wouldn't be able to decipher the message even as it passed through their servers. There are already apps that make en

by paulgb 12y ago

If they really took privacy seriously they wouldn't be able to decipher the message even as it passed through their servers. There are already apps that make end-to-end encryption user friendly (Telegram comes to mind).

klinquist 12y ago
Supposedly Apple can't decipher iMessages: http://techcrunch.com/2014/02/27/apple-explains-exactly-how-secure-imessage-really-is/ http://techcrunch.com/2014/02/27/apple-explains-exactly-how-...
- x1798DE 12y ago
  >When someone starts an iMessage conversation with you, they fetch your public key(s) from Apple’s servers. Before that message leaves the sender’s device, it’s encrypted into something that only your device knows how to decrypt. From the article, that's the part where Apple could MITM the communication, because public keys retrieved from Apple would be automatically trusted. They can just silently inject an extra public key for which they have the private key. That said, it seems like the protocol at least has forward secrecy, meaning that if they didn't inject a bad key when the message was sent, there's not much they can do later to decrypt the message (unless they have a backdoor that allows them to force your phone to send them its private key)
LeoPanthera 12y ago
Even iMessage uses end-to-end encryption. It's a pretty poor sign if it's less secure than the service already built into the phone. (And yeah I know iMessage isn't open source and so this is difficult to verify, but "Talk" isn't open either. Apple published a big PDF about how they do encryption - if this were proved to be false it would destroy all trust in Apple forever, so I believe what they say.) Big PDF: http://images.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf http://images.apple.com/ipad/business/docs/iOS_Security_Feb1... (See page 20) tl;dr: "Apple does not log messages or attachments, and their contents are protected by end-to-end encryption so no one but the sender and receiver can access them. Apple cannot decrypt the data."
- paulgb 12y ago
  Interesting, did not know that. Apple is still in a position to MITM the transaction if they wanted though (Telegram provides a key visualization that can be compared offline to prevent this)
  - mahyarm 12y ago
    Unless telegram changed their protocol recently, it's a fundementally flawed design. Telegram can also MITM you with their design too.

by paulgb 12y ago

klinquist 12y ago

Supposedly Apple can't decipher iMessages: http://techcrunch.com/2014/02/27/apple-explains-exactly-how-secure-imessage-really-is/ http://techcrunch.com/2014/02/27/apple-explains-exactly-how-...

x1798DE 12y ago
>When someone starts an iMessage conversation with you, they fetch your public key(s) from Apple’s servers. Before that message leaves the sender’s device, it’s encrypted into something that only your device knows how to decrypt. From the article, that's the part where Apple could MITM the communication, because public keys retrieved from Apple would be automatically trusted. They can just silently inject an extra public key for which they have the private key. That said, it seems like the protocol at least has forward secrecy, meaning that if they didn't inject a bad key when the message was sent, there's not much they can do later to decrypt the message (unless they have a backdoor that allows them to force your phone to send them its private key)

LeoPanthera 12y ago

Even iMessage uses end-to-end encryption. It's a pretty poor sign if it's less secure than the service already built into the phone. (And yeah I know iMessage isn't open source and so this is difficult to verify, but "Talk" isn't open either. Apple published a big PDF about how they do encryption - if this were proved to be false it would destroy all trust in Apple forever, so I believe what they say.) Big PDF: http://images.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf http://images.apple.com/ipad/business/docs/iOS_Security_Feb1... (See page 20) tl;dr: "Apple does not log messages or attachments, and their contents are protected by end-to-end encryption so no one but the sender and receiver can access them. Apple cannot decrypt the data."

paulgb 12y ago
Interesting, did not know that. Apple is still in a position to MITM the transaction if they wanted though (Telegram provides a key visualization that can be compared offline to prevent this)
- mahyarm 12y ago
  Unless telegram changed their protocol recently, it's a fundementally flawed design. Telegram can also MITM you with their design too.