Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Says iMessage Interception Would Require Re-Engineering Systems, Has No Interest in Doing So

Daveoc64 said:
...err no. You get the user to store their encryption key - if they lose it, all their data is gone.

That's not at all user friendly, so most services would not dream of functioning like that.
Click to expand...

You said "there ARE services OUT THERE" so prove to me what messaging services can not be cracked THEORETICALLY? Gives me name.
 
Email, texts, iMessages--I don't have any reasonable expectation that the contents can't or won't be read by someone other than the recipient--so rather than fret I just make sure whatever I say wont' come back to haunt me. :cool:
 
LV426 said:
There is always a simple retort to a statement like this from the "Nothing to hide" brigade.

Do you have curtains in your home?
Click to expand...

Why, yes, I do. And I keep them open most of the time during the day to let sunlight in. And they are not made of two inches of lead to keep prying infrared and X-ray "eyes" from seeing through even when they are closed.

Privacy and security is all about reasonable and practical defenses. For 99.99% of all communications, secure iMessage is already overkill, but that's okay because it comes at no convenience cost to the less-secure alternatives most of the time (unless, say, you are talking to someone without an iOS device, obviously, or sending something too long or involved to message, etc). If your communications fall into that 0.01% remainder which requires more security than iMessage, you need to look for a more secure alternative.

And, no, this is not a defense of peeping toms. Where the NSA is intercepting private message it is very much a violation of rights (perhaps a justified violation of said rights, but that can't be determined without an honest and open airing of the facts), even if the most that they see is "Please get more milk". But, really, the fact that infrared cameras exist and are in wide use in law enforcement and military operations doesn't make me thermo-isolate my house, and the fact that in one dystopian reality the NSA might intercept iMessage messages to a specific individual doesn't stop me from using it.
 
For encrypted communication protocols to work, you have to trust SOMEONE. Whether it's a Certificate Authority, Apple, Google, Facebook... frankly, of all of those, I'd trust Apple the most since they do not have any interest in my data. All they care is that I use their cool software because it keeps me buying their expensive hardware.
 
Daveoc64 said:
So you've not noticed that Apple has changed what it previously said?
Click to expand...

They did not, actually. Still doesn't change the fact that I don't really care about a bunch of hacker kiddies trying to get Internet popularity...
 
bobr1952 said:
Email, texts, iMessages--I don't have any reasonable expectation that the contents can't or won't be read by someone other than the recipient--so rather than fret I just make sure whatever I say wont' come back to haunt me. :cool:
Click to expand...

Exactly. Don't forget that all of these channels, no matter how they are transmitted, end up sitting in the clear on the endpoint device. Saying something untoward or suspicious is more likely to be a problem because the recipient device falls into "untrusted" hands (or the message is inadvertently forwarded, etc) than by the secure transmission routes being compromised. We are living the parable of the solid steel door next to the open window.
 
Todd B. said:
How about we start listening to adults rather than nerds in their basement with way too much time on their hands. I trust Apple - the people who designed the system - far more than I trust a hacker with a blog who says a lot of stuff to try and get attention.
Click to expand...

Especially with all the NSA leaks going on with no sign of stopping, I'd like to think they wouldn't be dumb enough to make that claim if they had in fact backdoored it. Skype claimed the same and see how that worked out for them.

http://www.slate.com/blogs/future_t...c_claims_and_private_government_dealings.html
 
Daveoc64 said:
You're totally missing the point - Apple is unlikely to want to do it. It's the risk from an unscrupulous employee doing it that people would be concerned about.
Click to expand...

This isn't as easy as you think when a company uses strict source control. Every check in requires a bug number. Every check in requires a review of at least 2 people. Bug reports are generated and reviewed. To sneak an entire infrastructure in without anyone noticing wouldn't be easy. It would take someone with wide ranging powers to not only modify code at will, but also delete all evidence.
 
I understand everyone's desire for 100% privacy, but honestly, I doubt the NSA cares about your affairs with your secretary or your fibs to your friends.

End of the day, you really shouldn't have to worry unless you plan on plotting and committing a violent crime or act of terrorism. If you are doing that, than I don't feel bad for you.:rolleyes:
 
matrix07 said:
Yeah.. Because nobody bothers to show you how to crack it IN THEORY?
Click to expand...

I don't understand what your angle is here. This is very basic cryptography.

If you want a service like iMessage or Dropbox where you don't have to manage encryption keys, there's always got to be a way for the provider of that service to store and retrieve your key on your behalf.

In principle, that means that someone at that service provider could do the exact same thing - access your key.

With a service that relies on you to store your keys, they obviously don't have your key to retrieve in the first place, so that attack vector goes out of the window.

duffman9000 said:
This isn't as easy as you think when a company uses strict source control. Every check in requires a bug number. Every check in requires a review of at least 2 people. Bug reports are generated and reviewed. To sneak an entire infrastructure in without anyone noticing wouldn't be easy. It would take someone with wide ranging powers to not only modify code at will, but also delete all evidence.
Click to expand...

Who says it requires a change to source controlled software?
 
I don't trust Apple or any other IT company after they all bent over to the prisim program. That said I've accepted that there is a risk in me using their services that I'm willing to take.
 
white4s said:
**** the nsa and **** the government

this countries going down the drain because of those 2
Click to expand...

Or, this country's going down the drain because of people who don't care enough about communicating to use even remotely correct grammar and punctuation, and can't be bothered to use vocabulary more complex than that of an uncultured toddler. One or the other. Probably the government, though.
 
Daveoc64 said:
I don't understand what your angle is here. This is very basic cryptography.

If you want a service like iMessage or Dropbox where you don't have to manage encryption keys, there's always got to be a way for the provider of that service to store and retrieve your key on your behalf.

In principle, that means that someone at that service provider could do the exact same thing - access your key.

With a service that relies on you to store your keys, they obviously don't have your key to retrieve in the first place.



Who says it requires a change to source controlled software?
Click to expand...

What I'm arguing here is that showing a website isn't showing it can't be cracked THEORETICALLY. You need to prove to me how Cryptocat can not be cracked AT ALL because you said there ARE messaging services OUT THERE that can't be cracked. Remember Apple said that it's impossible to decrypt your message and now someone showed it can IN THEORY. How do you know Cryptocat can't be cracked if someone bothers enough to show it. In theory, messaging services like this all can be cracked, one way or another. It's silly to blame Apple because you BELIEVE someone else can't be cracked while you can't prove it.
 
Well, I've personally been lied at by Apple once when they removed iPad 1/2 iPhone emulation mode antialiasing in iOS5 to boost the sales of iPad 3.

Then, when I asked them, properly backing up my statements regarding the superiority of anti-aliased iPhone 2x mode (I've even shown them a direct comparison photo), stated to me it was a "bug" in iOS3.2.x (with the iPad1) / iOS4 (both models). No, they did not bother telling me "sorry, we need to boost the sales of our forthcoming Retina iPad by artificially dumbing down our existing models" or something similar (obviously not stating there would be a Retina iPad). They took me for an absolute idiot instead - someone that doesn't understand it'd be a blatant lie to state such a quality-enhacing feature is a "bug".

After my above-explained, very bad experience with Apple, I won't ever believe anything they state WRT such a, in the light of the NSA affair, already dubious and sensitive case.

(BTW, in iOS7, they've brought antialiasing back for the iPad 2 / Mini a month ago. After all, they won't likely to sell many more non-Retina iPads if they indeed introduce the Retina iPad mini and stop offering the iPad 2 - no need to make them less desirable than Retina models any more. Unlike back in late 2011 and the impending release of the iPad 3.)
 
Last edited:
matrix07 said:
What I'm arguing here is that showing a website isn't showing it can't be cracked THEORETICALLY. You need to prove to me hoe Cryptocat can not be cracked AT ALL because you said there ARE messaging services OUT THERE. That can't be cracked. Remember Apple said that it's impossible to read decrypt your message and now someone showed it can IN THEORY. How do you Cryptocat can't be cracked if someone bothers enough to show it. In theory, messaging services like this all can be cracked, one way or another.
Click to expand...

Like I said above, this is very basic cryptography.

https://en.wikipedia.org/wiki/Public-key_cryptography

The security comes from widely accepted mathematical concepts.

The problem with iMessage is also understood by *everyone* because of the same mathematical concepts. You can't do what Apple does with iMessage and make it impossible for Apple to access the messages.

In short: Apple has all the pieces of the jigsaw to read an arbitrary user's iMessages. It might not want to, but it still could.

With a service like CryptoCat, that's not possible, because they're missing pieces of the jigsaw.
 
Apple has no interest in re-engineering the system, but now that the NSA knows that it is possible to intercept these they will be requiring Apple to secretly re-engineer the system. If Apple refuses everyone goes to jail.
 
NMBob said:
And what does "re-engineer" mean? Uncomment a couple of lines of code? It's pretty crazy to think that they couldn't decode the messages while they were in the process of building the system.
Click to expand...

No, as in changing architecturally how messages flow through the system. We don't have the full details, but the level of effort required to decode iMessage messages would not be insignificant.
 
duffman9000 said:
This isn't as easy as you think when a company uses strict source control. Every check in requires a bug number. Every check in requires a review of at least 2 people. Bug reports are generated and reviewed. To sneak an entire infrastructure in without anyone noticing wouldn't be easy. It would take someone with wide ranging powers to not only modify code at will, but also delete all evidence.
Click to expand...

In this particular case, as Apple said, "iMessage interception would require re-engineering systems". In other words, changing the systems so that interception is possible would be a major undertaking. That's not something an unscrupulous employee could just sneak in.

Radiating said:
Apple has no interest in re-engineering the system, but now that the NSA knows that it is possible to intercept these they will be requiring Apple to secretly re-engineer the system. If Apple refuses everyone goes to jail.
Click to expand...

Tinfoil hat: Apple already refused and lost the eBooks case as a result.

Battlefield 2 said:
I don't trust Apple or any other IT company after they all bent over to the prisim program.
Click to expand...

And you have exactly what evidence for that?
 
Daveoc64 said:
In short: Apple has all the pieces of the jigsaw to read an arbitrary user's iMessages. It might not want to, but it still could.

With a service like CryptoCat, that's not possible, because they're missing pieces of the jigsaw.
Click to expand...

You still don't understand. Apple doesn't have all the pieces RIGHT NOW. The system now doesn't allow them. It isn't even sure QuartzLab theory could be working. And your link still didn't prove that it can't be cracked in theory. Sorry, we can not be double-standard here.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back