Apple Says iMessage Interception Would Require Re-Engineering Systems, Has No Interest in Doing So

[Milquetoast]

So, even if someone else, even the NSA, has access to the public keys on the server, whether it's Apple's server or anyone else's, they still could not decrypt the message I send, or a message sent to me. What's all the uproar about?

The entire idea about public key cryptography is that the public key can be publicly shared without compromising secrecy - and the public nature of the public key is key (no pun intended) to the entire scheme. ))))

You are, probably intentionally, conflating two different types of privacy. My privacy (modesty) inside my house is not the same as expecting privacy when I spew something out over the World Wide Web.

It's all a matter of what you consider your security boundary to be. There are many legal opinions on this, of course. (e.g., If you leave your blinds open, is it fair game for your neighbor (or police) to peep inside your house using binoculars when not on your property? If you're using grow-lamps in your basement to grow some "private" crop, is it OK for the gendarmes to search for your grow-lamps from a helicopter via infared signature - and then act on that information?) Reasonable questions; no really simple answers...

Your privacy on the Internet is generally not well-respected, and if you really want to control information exchanged that way, you're probably best-off using self-signed certs and a mechanism that supports them.

 

[Tech198]

It does't really matter if THEY can read it, some e else can, like the NSA, or FBI.

If something is stored on someone else's machine, your trusting that server. All security bests are off.

In a perfect world, companies say what they set out to achieve, and keep info safe, but the world is not perfect. True, you have to trust someone, but this is what happens when people trust too much. Too much i fo gets leaked "or potential" and we all cry over spilt milk.

This is why i make my own decisions, as what companies get.. Unfortunately, people myst play by the rules, and when/if they break, i'm not the one to say "I told ya so"

but i would rather trust LastPass much mire than Apple any-day..

And unicorns ride in the air ;P

 

[Tubamajuba]

Just because he has nothing to hide doesn't mean his messages are any of your business.

Exactly. His messages are nobody's business but his own, yet he seems to be completely okay with the government potentially reading his messages. What's the difference between some random guy on MacRumors and a random government employee reading an innocent citizen's private communications? NSA agents have already been found snooping on potential love interests. People who I'm sure also had nothing to hide.

The point I'm trying to make is that we MUST be vigilant about protecting our right to privacy. For that matter, I think Apple does a great job of helping us do that.

 

[the8thark]

https://www.apple.com/apples-commitment-to-customer-privacy/

Apple’s Commitment to Customer Privacy

June 16, 2013

Two weeks ago, when technology companies were accused of indiscriminately sharing customer data with government agencies, Apple issued a clear response: We first heard of the government’s “Prism” program when news organizations asked us about it on June 6. We do not provide any government agency with direct access to our servers, and any government agency requesting customer content must get a court order.

Like several other companies, we have asked the U.S. government for permission to report how many requests we receive related to national security and how we handle them. We have been authorized to share some of that data, and we are providing it here in the interest of transparency.

From December 1, 2012 to May 31, 2013, Apple received between 4,000 and 5,000 requests from U.S. law enforcement for customer data. Between 9,000 and 10,000 accounts or devices were specified in those requests, which came from federal, state and local authorities and included both criminal investigations and national security matters. The most common form of request comes from police investigating robberies and other crimes, searching for missing children, trying to locate a patient with Alzheimer’s disease, or hoping to prevent a suicide.

Regardless of the circumstances, our Legal team conducts an evaluation of each request and, only if appropriate, we retrieve and deliver the narrowest possible set of information to the authorities. In fact, from time to time when we see inconsistencies or inaccuracies in a request, we will refuse to fulfill it.

Apple has always placed a priority on protecting our customers’ personal data, and we don’t collect or maintain a mountain of personal details about our customers in the first place. There are certain categories of information which we do not provide to law enforcement or any other group because we choose not to retain it.

For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. Similarly, we do not store data related to customers’ location, Map searches or Siri requests in any identifiable form.

We will continue to work hard to strike the right balance between fulfilling our legal responsibilities and protecting our customers’ privacy as they expect and deserve.

That's what you want to read folks. Direct from the mouth of Apple.

 

[j4zb4]

So, just for the record, you do have something to hide? I thought so.

----------



And when you close them, you have something to hide. Pretty simple, really.

----------



Exactly not the case. If someone says they have nothing to hide, at the same time as closing curtains in their house, they are hypocrites.

----------



Yeah, well that means Sweet Fanny Adams. If I plant a few hints in the right places that you're a potential terrorist, people will be crawling over your private life.

Good job on just quoting just half of my post and claiming victory out of context... You definitely would go to any lengths to prove your sissy point right... Welcome to my ignore list...

 

[ScottishDuck]

I do understand why Privacy is a big issue and a hot topic. I also understand how we need to fight for our privacy and make companies be accountable.

With that being said, I agree with MATTYMO. My iMessages aren't nearly important enough to anyone, other than the communicating parties, to bother reading.

People always say this and don't consider the age we live in. Anything that gives insight into your financial status, interests, friends, etc. is information that is _worth a lot of money_

Why do you think services like facebook are free while making large profits?

 

[henrystar]

[Insert NSA joke here.]

In other words, if Apple secretly changed something so that it would be bad, they could do so. (Of course Coke could add arsenic, too.)

 

[crashdiet69]

Why would this be better as an open system? If fingerprint data is stored securely on apple's servers and encrypted, that's all we can ask for. Because as soon as you give the end user the ability to view their public keys then they become more interested in private keys. This leads to hacking, identity theft, and even more security issues. It's in the public's best interest to stop whining about every little thing apple does and have some faith that the largest corporation in the world would have a decent security system. For example, don't iMessage your social insurance number with your date of birth and a credit card to your friends. *rant over*

 

[3lite]

Let's just go back to passing secret notes in class if we're worried about information leaking out. I go about my day knowing anything and everything I do online could be compromised. Which is why I don't store anything important online or send anything I wouldn't want read in public. Not to sound too paranoid but if a company said "100% secure e-traffic" would you believe them? I wouldn't.

Dude, you're not that important.

 

[Dominicanyor]

Everyone is watching.

 

[MetalMatt24]

Why does it matter. The Alex Jones's of the world are going to believe what they want to believe no matter what.

Atleast Alex Jones is a patriot AND YOU are just someone who watches too much CNN

 

[derek4484]

Can you point to any source saying that Apple doesn't store the keys or that they can't access them?

Did you even read the darn article? Apple was making a point of the fact that they dont keep the user encryption keys, the third party servers store them. Apple cannot read your iMessages.

THAT WAS THE ENTIRE POINT OF THE ARTICLE!!!

But, since the user encryption keys are stored on a third party server, it makes it just as easy for the NSA to get them and use them to read everybody's iMessages.

 

[Oletros]

Did you even read the darn article? Apple was making a point of the fact that they dont keep the user encryption keys, the third party servers store them. Apple cannot read your iMessages.

THAT WAS THE ENTIRE POINT OF THE ARTICLE!!!

But, since the user encryption keys are stored on a third party server, it makes it just as easy for the NSA to get them and use them to read everybody's iMessages.

I have read the darn article, can you point where Apple has stated that they don't store the ****ing private keys?


This is Apple statement:

“iMessage is not architected to allow Apple to read messages,” said Apple spokeswoman Trudy Muller in a statement to AllThingsD. “The research discussed theoretical vulnerabilities that would require Apple to re-engineer the iMessage system to exploit it, and Apple has no plans or intentions to do so.”

Feel free to pint where in that quote Apple states that they don't stopre or have the private keys

 

[fekimoki]

Yeah and Apple also have troble to engineer the chaotic newer & older iMessage sort and mash it up instead in OS X's Messages.

 

[TheNewDude]

I never understand this argument. Just because you are boring doesn't mean the government is not interested in targeting lots of people for nothing more than legally exercising their first amendment rights in a way that challenges the government. Are you that self-centered and short-sighted?

You totally missed the first two lines of my comment.

----------

People always say this and don't consider the age we live in. Anything that gives insight into your financial status, interests, friends, etc. is information that is _worth a lot of money_

Why do you think services like facebook are free while making large profits?

Well I do understand the importance of Privacy. That's why I started my comment with, "I do understand why Privacy is a big issue and a hot topic. I also understand how we need to fight for our privacy and make companies be accountable."

 

[kdarling]

https://www.apple.com/apples-commitment-to-customer-privacy/

That's what you want to read folks. Direct from the mouth of Apple.

All Apple claimed was that they hadn't heard the name "Prism", and that they didn't provide "direct access". Both statements can be quite true, even while being part of the program.

Moreover, it doesn't matter what they say (or rather, what they're allowed to say). Apple is listed on the leaked NSA document. (The Washington Post says Apple resisted for months before giving in, if that makes you feel any better.)

 

[the8thark]

All Apple claimed was that they hadn't heard the name "Prism", and that they didn't provide "direct access". Both statements can be quite true, even while being part of the program.

Moreover, it doesn't matter what they say (or rather, what they're allowed to say). Apple is listed on the leaked NSA document. (The Washington Post says Apple resisted for months before giving in, if that makes you feel any better.)


View attachment 442721

Feel free to quote exactly where/what Apple said in relation to this so we all know Apple's exact words.

 

[kdarling]

Feel free to quote exactly where/what Apple said in relation to this so we all know Apple's exact words.

You posted a link with their words.

Apple has always been very good with phrasing. They state true things individually, yet the casual reader thinks they said something that they really didn't.

In this case, see my comments above. They didn't directly say they were not part of Prism. Instead, they danced all around without saying that, and distracted the reader with little disjointed facts.

It's understandable. I was with the military branch of NSA for years. When you can't say something directly, you have to beat around the bush a bit

 

[the8thark]

You posted a link with their words.

I did not. If you think I have, please repeat the link so everyone can see it. I will admit when I am wrong.