3 ms·
It's even worse that that. As of about a year ago, iMessage didn't do any certificate pinning: http://blog.quarkslab.com/imessage-privacy.html http://blog.quark
by fpgeek 12y ago
It's even worse that that. As of about a year ago, iMessage didn't do any certificate pinning: http://blog.quarkslab.com/imessage-privacy.html http://blog.quarkslab.com/imessage-privacy.html
Unless that's been fixed (I haven't come across any evidence one way or the other), you're not just worrying about Apple and the NSA: Your iMessages are vulnerable to anyone who can forge a certificate and MITM your connection to Apple's servers. I'd say that's a reasonably high bar except for one thing: I believe it covers the vast majority of corporate iPhones used on company-internal networks.
- cbr 12y agoCertificate pinning usually (ex: Chrome) is implemented with an exception to allow a company administrator to install a new root CA cert on the device and MITM connections. Does iMessage not allow this?
- acchow 12y agoThis Chrome behavior surprised me so I checked the source. Indeed, you are correct. Pin checking is short-circuited if the cert is signed by a root. ` if (!is_issued_by_known_root || !HasPublicKeyPins(host, sni_available)) { return true; } ` https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state.cc&q=kPreloadedSTS&sq=package:chromium&type=cs&l=137 https://code.google.com/p/chromium/codesearch#chromium/src/n...
- lawnchair_larry 12y agoWell I'll be damned. Those sneaky bastards. Thanks for pointing this out.