iMessage and FaceTime Ranked as Most Secure Mass-Market Messaging Options

[2457282]

I went and looked at the full scorecard. I knew less than ten of these messaging apps. I had no idea how many were out there. The problem for me is that in order for it to work everyone has to be on the same app. Fortunately, iMessage works for me since 90% of the people I chat with (that would be a total of less than 10 people) are on the iPhone. And since SMS is integrated and works for that one other person, I am just fine with iMessage. Very happy to hear that it is very secure as well.

 

[bushido]

Just as whatsapp rolls out the "blue arrows" indicating that a message has been read and it cannot be disabled.

Every girl on my fb wall is freaking out lol

 

[flyinmac]

Probably a good idea to get suspicious if the other party is wearing a mask. Though identification via voice would still be possible, even if not always reliable.

We might also call people we haven't met before in person.

FaceTime conversations with people from Craiglist casual encounters????

 

[dannys1]

So are you telling me iMessages can't be scanned by the Feds??? Do they have to have the device to read them?

For some reason I just don't believe this...

Correct, its the only one that encrypts messages end to end.

 

[808?]

can we go back to ICQ? good ol' days.

I still use it.

 

[Swift]

"Is security design properly documented?"

Huh? I don't understand how whether the security is documented or not actually improves the security.

It allows people who really know the security field to make judgements. And they have.

The only thing it doesn't do -- that's significant to me -- is that you can't verify who's calling. FaceTime video, of course, is identifiable by the video. Audio by the voice, if you know the person. But Messages? However, no other apps have that ability either. Hard to do in a system where people want to use pseudonyms, or chatter on with strangers. Verifying identities is complicated, and I'm not sure people wouldn't resent it.

As for the last "deficiency," frankly, open source is over-estimated as a security strength. There have been some nasty holes in Bash, and the Heartbeat vulnerability and the rest, many of which stayed for a generation inside critical parts of the most prominent open source code. A heavily-used proprietary market piece of software gets more attention, and they generally fix it quickly, because they lose sales.

----------

Correct, its the only one that encrypts messages end to end.

And Apple doesn't keep the keys.

 

[KALLT]

What does "Can you verify contacts' identities?" mean?

Like, if someone else shows up in FaceTime, wrong identity?

The website mentions this:

This criterion requires that a built-in method exists for users to verify the identity of correspondents they are speaking with and the integrity of the channel, even if the service provider or other third parties are compromised. Two acceptable solutions are:

• An interface for users to view the fingerprint (hash) of their correspondent's public keys as well as their own, which users can verify manually or out-of-band.
• A key exchange protocol with a short-authentication-string comparison, such as the Socialist Millionaire's protocol.

Other solutions are possible, but any solution must verify a binding between users and the cryptographic channel which has been set up. For the scorecard, we are simply requiring that a mechanism is implemented and not evaluating the usability and security of that mechanism.

 

[rorschach]

Not open source, but they said they'd make the protocol an open standard which would let anyone implement it.

I did hear they couldn't do this in the end for patent reasons, they violated someone's patent and had to pay for the rights to use it therefore the standard wasn't completely theirs to open.

However I've never seen a citation to back this up. Anyone got a link to prove/disprove this?

Here's an article about Apple losing the lawsuit:
Apple loses Facetime patent lawsuit to VirnetX

However, that verdict was just overturned a few weeks ago.
Appeals Court Throws Out $368 Million Verdict Against Apple in VirnetX Lawsuit

 

[bsolar]

Correct, its the only one that encrypts messages end to end.

But you cannot verify the other end's identity independently, which means a man-in-the-middle attack is still theoretically possible.

PS: Thanks for the more in-depth explanation.

 

[Rigby]

Correct, its the only one that encrypts messages end to end.

Apple could still read your traffic if they wanted to. While it's true that iMessage uses end-to-end encryption, the problem is that Apple controls the public key infrastructure and acts as certificate authority. If someone wants to send you a message, they need your public key to be able to encrypt it for you. When the sender attempts to look up your public key, Apple can easily replace it with another key where they have the corresponding private key (and since they are the CA too, they can sign the replacement key which would make the iOS device consider it trustworthy). This allows them to decrypt the message. Apple could then re-encrypt the intercepted message with your real public key and forward it to you, so you would never know that it has been intercepted.

This page has more detail if you're interested:

http://blog.quarkslab.com/imessage-privacy.html

 

[ericdsa]

FaceTime is not as safe as indicated

Apple manages the keys for Face Time connections, and because of this could include its own or the NSA's key and they could be a party to the conversation.

Apple saying that they cannot decrypt does not make it so.

So the chart and this article pointing to the chart are in error.

 

[manu chao]

Couldn't they just make the clients themselves?

They could (like Blackberry is doing it) but that is not what Jobs had originally promised.

 

[Michael Goff]

They could (like Blackberry is doing it) but that is not what Jobs had originally promised.

Does it matter what he promised? Things change.

 

[XboxMySocks]

Excellent features, true. But again, there may still be artifacts upon deletion, unless I'm incorrect and iMessage to iMessage leaves none, and FaceTime sessions leave none?

You are indeed incorrect.

 

[Appel]

Still theres no two step verification or any good way to manage what devices are active and receiving messages for imessage. I really dont see the point of all this two step verification hype from apple if imessage is left out. Until then (if ever) all the listed features is great but SMS still safer for 99 procent of the users.

 

[manu chao]

Does it matter what he promised? Things change.

No it doesn't matter. I just wanted to be clear that these are three things are not the same (and each option has slightly different security implications).

 

[Michael Goff]

No it doesn't matter. I just wanted to be clear that these are three things are not the same (and each option has slightly different security implications).

That is true. But if they don't do anything, well, nothing changes. Apple continues to be seen as the closed company that can't play well with others.

Then again, they can't monetize this service. Even if they did make it, it'd be bad like Safari on Windows was.

 

[Dopestar]

TouchID could be used to fill the holes suggested here.

Imagine this use case: Jane and John both have iPhones and are chatting using iMessage. Jane wants to send sensitive information (boob pics) to John, but wants to make sure that John hasn't handed his phone to his friend Bobby at the time she sends it. She could flag the message as 'secret', and John has to use TouchID or his AppleID password to verify his identity before seeing that message.

Offtopic: I'd also like a private browser that is 'locked' with TouchID. I could keep all my porn windows open in Private mode, and no one could see them without me unlocking that specifically.

There is an app for that use Stash

 

[639051]

Yeah, the content is not important.

/s

No, the chart design sucks and makes the content difficult to read. It has good info, but crap delivery.

----------

It allows people who really know the security field to make judgements. And they have.

The only thing it doesn't do -- that's significant to me -- is that you can't verify who's calling. FaceTime video, of course, is identifiable by the video. Audio by the voice, if you know the person. But Messages? However, no other apps have that ability either. Hard to do in a system where people want to use pseudonyms, or chatter on with strangers. Verifying identities is complicated, and I'm not sure people wouldn't resent it.

As for the last "deficiency," frankly, open source is over-estimated as a security strength. There have been some nasty holes in Bash, and the Heartbeat vulnerability and the rest, many of which stayed for a generation inside critical parts of the most prominent open source code. A heavily-used proprietary market piece of software gets more attention, and they generally fix it quickly, because they lose sales.

----------



And Apple doesn't keep the keys.

You are incorrect, Apple does indeed have the keys, they have to otherwise the system would require much more effort on the part of each user to communicate with one another.

Steve Gibson has a great podcast about his review of it, while he gave glowing reviews for their implementation he did speak about the keys being in the hands of Apple and that being a negative in terms of security but a plus for ease of use.

Edit : Here is the transcript for episode 1 (of 3) where he discusses iOS (including iMessage) security.

https://www.grc.com/sn/sn-446.htm

 

[Oz22151]

What about WhatsApp ?

 

[pietrov]

Sorry, I don't trust anyone saying my messages are secure...

 

[miknos]

Scorecard is wrong about Skype:
It doesn't use end-to-end encryption.

http://arstechnica.com/security/201...ssages-get-end-to-end-encryption-think-again/

 

[KALLT]

Scorecard is wrong about Skype:
It doesn't use end-to-end encryption.

http://arstechnica.com/security/201...ssages-get-end-to-end-encryption-think-again/

It’s a shame that this overview of the EFF doesn’t reference their sources. We take this analysis based on their authority alone.

 

[OldSchoolMacGuy]

But Apple couldn't control the implementation of clients on other systems, which unless their code was open source at the very least puts up the issues of trust in the third-party.

And any client that isn't open source (including Apple's) could send along the key to decrypt the message (that key obviously being encrypted such that only the client maker could listen in).

Steve Jobs said Facetime is built on open standards and that it would be opened up to others to implement it on their own devices.

http://www.fiercedeveloper.com/story/facetime-open-standard-never-happened/2012-12-06

http://en.wikipedia.org/wiki/FaceTime#Standards

 

[dannys1]

Apple could still read your traffic if they wanted to. While it's true that iMessage uses end-to-end encryption, the problem is that Apple controls the public key infrastructure and acts as certificate authority. If someone wants to send you a message, they need your public key to be able to encrypt it for you. When the sender attempts to look up your public key, Apple can easily replace it with another key where they have the corresponding private key (and since they are the CA too, they can sign the replacement key which would make the iOS device consider it trustworthy). This allows them to decrypt the message. Apple could then re-encrypt the intercepted message with your real public key and forward it to you, so you would never know that it has been intercepted.

This page has more detail if you're interested:

http://blog.quarkslab.com/imessage-privacy.html

Thats a lot of effort to read my smiley face emoji.