Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage with PQ3 Cryptographic Protocol

security.apple.com

Post reply on HN
Print view View original

201–210 of 280 posts

Re: iMessage with PQ3 Cryptographic Protocol

#201

Post by pavon »

jdminhbg wrote: post #198
pavon wrote: post #131

Earlier quoted context omitted.

Every single person I converted to using Signal stopped using it when SMS support was removed. HN tends to be a younger crowd whose peers cycled through a number of social-networking and messaging apps as popularity waxed and waned. But older generations don't see any compelling reason why they should bother splitting their conversations over multiple apps, when literally everyone with a mobile has texting. Being a d…

> resigned to the idea that cross-platform RCS is the only thing that will bring encryption to the majority of my contacts I thought RCS explicitly wasn’t E2EE?

The current standard isn't. Google uses non-standard E2EE, and they and Apple are working on getting it standardized.

Re: iMessage with PQ3 Cryptographic Protocol

#202

Post by snowwrestler »

londons_explore wrote: post #193
bjoli wrote: post #179

Earlier quoted context omitted.

I was reading the NIST comments and djb is not very happy with how they present things, and the other commenters seem to think he is a prick.

I want an encryption algorithm composed of 2 parts chained, such that both parts need to be broken for the whole thing to be broken. And I'd like the US/The west to declare 1 part as secure, and I'd like Russia to declare the other part as secure. I'm fairly confident that Russia and the US won't collude to push a known-weak algorithm.

They would not have to collude; there is no incentive for either to publicly endorse a secure algorithm. Both Russian and U.S. intelligence services want the ability to break into anything.

They would publicly endorse insecure algorithms, and then employ more secure algorithms in their own classified systems.

I think encryption quality is best evaluated by math and technical testing, not international political triangulation.

Re: iMessage with PQ3 Cryptographic Protocol

#204

Post by randall »

hannob wrote: post #172
andy_xor_andrew wrote: post #126

Earlier quoted context omitted.

I'm way out of my depth in terms of the math here. But my 'software engineer brain' likes the ideal of using the prime factoring problem, because it's so simple to understand, and feels like some kind of universal primitive. "It's easy to multiply but hard to factor." It just seems so intuitive. But I'm reading the 'learning with errors' wiki page and it's beyond my comprehension. There's a weird fear in my mind that…

I know that thinking, but learning more about RSA, I came to realize that there's a flipside of this. People think "RSA is easy", because someone gave them a lecture of a simplified/wrong/insecure version of RSA. Pretty much all "simple introductions to RSA" you can find out there are wrong. The truth is: RSA isn't that simple. If you want to have RSA, and want to have it secure, there's a whole bunch of things to co…

I love that security by difficulty is the new security by obscurity, but actually secure.

Re: iMessage with PQ3 Cryptographic Protocol

#205

Post by sneak »

tptacek wrote: post #110
sneak wrote: post #65

Earlier quoted context omitted.

If everyone you iMessage with has iCloud Backup still enabled (and I guarantee you 100% that they do because it is the default), then you turning yours off does nothing, as all of your conversations remain readable by Apple via the escrowed keys of the other endpoints. iMessage is not e2ee.

It does not appear to be the default.

Wanna bet? Perhaps I should make a video.

Re: iMessage with PQ3 Cryptographic Protocol

#206

Post by callalex »

xoa wrote: post #20
soxicywn wrote: post #2

Does anyone know if this is still vulnerable to the iCloud Backups problem? The only solution to that right now is for you and your contact to turn on Advanced Data Protection. Curious if that’s still required.

> Does anyone know if this is still vulnerable to the iCloud Backups problem? The only solution to that right now is for you and your contact to turn on Advanced Data Protection. This is such a strange two sentences as a "problem". E2EE security, as it says in the name, is about the protection of dara transmission between two trusted end points. That's it. What the trusted end points themselves choose to do with that…

Your argument about iMessage on Mac’s holds water, but the iPhone is sold as an appliance and there is no concept of a file system presented to the user. They sell the messaging platform as “encrypted” and the word “encrypted” is plastered all over iCloud marketing and documentation. You really can’t blame the user for assuming the appliance is secure by default. When you first set up an iPhone it just asks you if you want to back up to iCloud. It doesn’t use the word “insecure” nor “unencrypted” anywhere on that screen.

Re: iMessage with PQ3 Cryptographic Protocol

#207

Post by super_mario »

AnonC wrote: post #51
xoa wrote: post #20

Earlier quoted context omitted.

> Does anyone know if this is still vulnerable to the iCloud Backups problem? The only solution to that right now is for you and your contact to turn on Advanced Data Protection. This is such a strange two sentences as a "problem". E2EE security, as it says in the name, is about the protection of dara transmission between two trusted end points. That's it. What the trusted end points themselves choose to do with that…

> No communication service stops people from backing up with encryption or not, local or remote, or from copy/pasting or for that matter taking photos of the screen ("analog hole"). At least for the first part on backing up without copy pasting or using the “analog hole”, Signal expressly prohibits and doesn’t allow any kind of backup — encrypted or not — on iOS/iPadOS/macOS.

Signal perhaps does not allow you to export your message history through the front door, however decrypting and exporting your message history is relatively low effort.

You messages are stored in encrypted SQLite3 database. The Signal encryption key is in

    ~/Library/Application\ Support/Signal/config.json
in plain text. If you have SQLCipher (https://github.com/sqlcipher/sqlcipher) compiled you can decrypt your Signal database:

Navigate to

    ~/Library/Application\ Support/Signal/sql/
and type

    sqlcipher db.sqlite
    sqlite> PRAGMA key = "x''";
    sqlite> .schema
and query away.

Of course there is a Python package to automate all of this here:

https://github.com/carderne/signal-export

This exports your message history as markdown and HTML files for your convenience and it will do incremental exports as well.

For iOS the same holds true, considering iOS has had a jail break most of its existence.

So, in retrospect your Signal messages are only as secure as computers of the people you talk to and of course your own device.

I would go a step further and assert that there is no such thing as secure communication.

Re: iMessage with PQ3 Cryptographic Protocol

#208

Post by alphabettsy »

modeless wrote: post #188
snowwrestler wrote: post #166

Earlier quoted context omitted.

Just a bit lower on the same page: > When iCloud Backup is turned on, everything inside it is end-to-end encrypted, including the Messages in iCloud encryption key. Meaning that Apple does not actually have access to that key, because it is encrypted before being saved to their servers.

This is misleading, again. The paragraph you quoted only applies with optional "Advanced Data Protection". Advanced Data Protection is off by default. In the default state Apple does have access to the Messages in iCloud keys in iCloud Backup, as I said.

Yep.

Table is here: https://support.apple.com/en-us/102651

Re: iMessage with PQ3 Cryptographic Protocol

#209

Post by madars »

tptacek wrote: post #142
andy_xor_andrew wrote: post #126

Earlier quoted context omitted.

I'm way out of my depth in terms of the math here. But my 'software engineer brain' likes the ideal of using the prime factoring problem, because it's so simple to understand, and feels like some kind of universal primitive. "It's easy to multiply but hard to factor." It just seems so intuitive. But I'm reading the 'learning with errors' wiki page and it's beyond my comprehension. There's a weird fear in my mind that…

Well, one way to think about this is: how much abstract algebra are you keeping in your head to reassure yourself of the security of classical asymmetric cryptography? It's surprisingly deep. Some programmers are "comfortable" with it because they've been brought up being taught that "factoring" is just the way asymmetric cryptography works, but that has never really been the whole case. Elliptic curve is not at all…

100%. Another underappreciated point is that factoring connection is very misleading. That is, we don't know if factoring is equivalent to breaking RSA (in particular, the algorithms breaking low-exponent RSA (which one shouldn't use for a number of reasons) don't factor the modulus). It might be true that computing e-th roots (i.e. breaking RSA) is tractable while factoring is not.

Similarly, PKCS is complex but every part of PKCS is there because without it there is a concrete attack. Burt Kaliski (former chief scientist of RSA Labs) has an amazing talk which goes into detail about this: https://www.youtube.com/watch?v=sqsDKjPaJVg For example, why does RSA need randomized padding, besides the trivial IND-CPA violation? Because if you encrypt the same message to many recipients, the attacker can use Hastad's attack, which uses lattices in a deep way, to recover the message from non-randomized ciphertexts https://en.wikipedia.org/wiki/Coppersmith%27s_attack?useskin... Very much like an airline checklist in a way :-)

Another nugget in the talk: how RSA embedded a public key in their products and bootstrapped VeriSign! Can't recommend it highly enough.

Re: iMessage with PQ3 Cryptographic Protocol

#210

Post by joshjob42 »

godelski wrote: post #115
jwells89 wrote: post #79

Earlier quoted context omitted.

The main things holding back Signal usage in my case is practically nobody in my social circle using it and the desktop client not being as nice as that of Messages or Telegram, the latter being particularly relevant for myself and contacts who primarily message with their computers rather than their phones.

Sounds like time to become an evangelist then. I had to do this in my group and other than security a major benefit is just that getting potatos instead of pictures has significantly declined. Here's my advice: don't sell security as the foremost feature. Sell it as "iMessage, but for everyone." You got stickers, reactions, high quality videos and images. Then mention security, it is the cherry on top.

Before anyone goes evangelizing Signal, make sure to tell your iOS friends that if they ever lose their phone they lose every message they ever sent on Signal with no way to restore them, and the same applies if they ever get an Android phone (latter also true of iMessage, but WhatsApp is totally cross-platform).
Post reply on HN