Do you have any supporting evidence of this?
I've heard about MS making Steam's life difficult on Windows and trying to push everything over to the Windows Store, but I haven't see anywhere that Apple is also trying to do this.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Cryptography Experts Recommend Apple Replace its iMessage Encryption
- Thread starter MacRumors
- Start date
- Sort by reaction score
Do you have any supporting evidence of this?
I've heard about MS making Steam's life difficult on Windows and trying to push everything over to the Windows Store, but I haven't see anywhere that Apple is also trying to do this.
It is highly unlikely that most people would fall prey to man in the middle or even this. As it stated this is something for state sponsored hacking. I want privacy and security and maybe care about it more than most. Having said that the types of hacks neede to get passed apples security is something that will be targeted. State sponsored hackers will attack CEOs or politicians, not little old me.
From what I read Apple can do more and it looks like it is constantly working to upgrade, so we can expect to see more. And to be clear, Apple is much better than google at this. However, to address your main point, if you are transmitting things that you absolutely do not want to risk of falling into the wrong hands, then I agree that iMessage, what's app, google hangouts, etc is not the right tool. For my use, I want to make sure that nosy bodies can't look, but if i do not expect anyone to be targeting me for anything. And certainly, credit card or ssn never travel through these chat applications or email for that matter.
Regardless of the college bashing here & arm chair quarterbacking, let's just hope Apple is "on it!" and this is now a top priority to get fixed, or better yet, replaced with a new & far more secure encryption model.
If you're using a phone that can't run iOS 9, you should probably upgrade. :\
[doublepost=1471193373][/doublepost]So John's Hopkins University is one of the most well rounded universities in the world! And just so happens to have the biggest hospitals in the world. So not just medical school!
Anyone who says Microsoft is making Steam's life difficult doesn't know what they're talking about.
This kind of research work is greatly appreciated. Getting security right is hard.
It's all explained in the research paper linked in the article. The security researchers disclosed the issues to Apple many months ago and now they're talking about these issues since Apple has patched most of the issues in later updates. In other words, if you're using an older version, you're still at risk. The researchers wrote about what Apple did in later updates but believes there may be more related issues that hasn't been analyzed yet.
There are the short relevant quotes from the paper:
They could get around this my making iMessage a standalone app that works on older versions of iOS/OSX.
They could, but it's not as easy as it sounds. Also, why not just make Messages a separate app that's updatable all the time on all platforms as well.
It slants the objection toward the unachievable - commonly "you won't be happy until you get the moon on a stick" - secondly the more efficient way to nail someone 'up' is on a single pole rather than making the effort to 'show off' with a fancy cross. Personally I think "Christ on a troll bridge with goats" is more appropriate it this instance.
Attackers stealing certificates is not exactly a foreign idea. The whole point of it is that you attack the certificate authority rather than the target e.g. http://www.computerworld.com/articl...--on-own-certificates-after-flame-hijack.html
Johns Hopkins is a full fledged university - some of our EE faculty work with their engineering faculty.
This sounds very familiar to a potential problem with a stock Apache web server install. If your server's private key gets exposed in the future, anyone who's intercepted encrypted messages in the past can go back and decrypt everything (I'm simplifying a bit, but that's the gist of it). There are ways to prevent this, but it breaks your server's ability to talk with some older browsers.
With iMessage, though, it should be an easier fix since Apple controls the software at both ends.
Whatsapp does allow you to verify keys through QR codes.
Also, they claim calls are encrypted. I'm not sure if FaceTime calls are.
Last edited: