Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

usenix.org

Post reply on HN
Print view View original

51–60 of 141 posts

Re: A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

#51

Post by bouke »

tgma wrote: post #19
modeless wrote: post #18

Earlier quoted context omitted.

Yes but when Messages in iCloud is enabled that "client-side" encryption key is itself included in your iCloud backup (that Apple can read), as disclosed. So Apple can read your messages regardless of whether you enable or disable Messages in iCloud. The only things that prevent it are disabling cloud backups entirely, or enabling ADP. But even those don't really prevent it because unless everyone you message also do…

Good to know, hence my 95% certainty. Fortunately for me, each new device starts with DFU restore and installation of my own Configuration Profile which supervises the device, disable automatic pairing with new devices, disables useless apps like Game Center, and most importantly disables iCloud Backup entirely, etc.

How do you make backups of your data; e.g. Photos, Notes and Messages?

Re: A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

#53

Post by xvector »

unloader6118 wrote: post #35
modeless wrote: post #23

Earlier quoted context omitted.

Yes, your backup is e2e encrypted after you enable the off-by-default ADP. But some of your friends probably didn't enable ADP, and the keys to decrypt your messages to them are stored in their backups which Apple can read at will.

There are some fundamental different between two ecosystems. On Google, the Google Drive and Photo are encrypted to a key owned by google. On iCloud, the iCloud Drive and Photo are encrypted to your account key. In which, without ADP, this key is shared with Apple. When ADP is enabled, Apple does not store this key. iCloud Backup is stored with the same technology as iCloud Drive. When it comes to lost password accou…

You aren't understanding the point being made in OP. Everyone here understands the crypto for ADP vs non-ADP, there's no need to explain it.

The simple fact of the matter is that if I have ADP enabled, my chats should be excluded from the backups of those I'm communicating with (it should be as an opt-in basis at the very least).

Not having this renders ADP useless for the purpose of its stated threat model.

Re: A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

#56

Post by jjcob »

londons_explore wrote: post #32
jjcob wrote: post #31

Earlier quoted context omitted.

The waiting time increases after failed attempts.

In general that isn't secure unless the security chip has access to a secure time server to know that the required amount of time has passed. Otherwise you can simply say "yeah, we power cycled you and now the year is 100,000, can I have another guess?" I don't see any mention of that functionality in any public documentation.

I'm not sure how different devices implement it, but the security chip can simply count the time it was powered on, it doesn't have to rely on wall clock time.

(Relying on wall clock time caused a bug in an early iOS version of this feature, where it would show a really long delay when the clock was reset, and there was no way to set the clock correctly)

Re: A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

#57

Post by 9dev »

isodev wrote: post #42
modeless wrote: post #2

All that security, and then by default Apple literally just sends themselves a copy of your encryption keys to store in iCloud backup, the only cloud backup solution Apple allows you to use. "to help you recover your data" [1] (oh and also to send law enforcement your message history in plaintext on request, but we don't talk about that). [1] https://support.apple.com/en-us/102651#:~:text=in%20iCloud%2...

I think the story around privacy and security in general has become diluted in marketing talk. Every single default on both iOS and macOS effectively makes one’s data, well, accessible and not private. The gap between perception and reality when it comes to Apple as a “privacy champion” has never been so big as it is today.

Most customers do want it this way, but Apple still allows to exchange comfort for privacy, if you want to. I actually think it's a pretty sensible approach to capture both the big segment of people who don't care, and those who do and know which knobs to tweak.

You can still turn everything compromising off and end up with a device secured to paranoid levels. That's definitely more than an empty promise, or what other vendors provide.

Re: A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

#58

Post by ewoodrich »

londons_explore wrote: post #26
modeless wrote: post #11

Earlier quoted context omitted.

> neither android hardware nor the google servers have any kind of secure element enforcing brute force protections I don't know why you would say this when it is obviously false. https://security.googleblog.com/2018/10/google-and-android-h...

do they actually enforce these limits? I couldn't find any google UI which says "2 tries left or your data will be permanently erased". One can't implement brute force protections without such a UI... "You need to wait 5 minutes" isn't sufficient for a 4 digit pin...

I can't speak to Pixels personally but every Samsung phone I've owned that I can remember has exactly that.

https://www.reddit.com/r/samsung/comments/13nnphc/delete_pho...

Re: A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

#59

Post by commandersaki »

modeless wrote: post #20
conradev wrote: post #17

Earlier quoted context omitted.

Not if you have "Advanced Data Protection" turned on: https://support.apple.com/en-us/108756

Unlike Google's comparable backup encryption feature, ADP is off by default. And ADP protects your messages from Apple only to the extent that everyone you message also turns on this non-default option; otherwise your messages are still Apple's to read as they please with no notification to you.

To be clear, ADP default on would mean a massive influx in support requests for people that lose their data because they don't have the recovery key.

Same reason FileVault isn't on by default on macs.

Re: A Formal Analysis of Apple's iMessage PQ3 Protocol [pdf]

#60

Post by StopDisinfo910 »

9dev wrote: post #57
isodev wrote: post #42

Earlier quoted context omitted.

I think the story around privacy and security in general has become diluted in marketing talk. Every single default on both iOS and macOS effectively makes one’s data, well, accessible and not private. The gap between perception and reality when it comes to Apple as a “privacy champion” has never been so big as it is today.

Most customers do want it this way, but Apple still allows to exchange comfort for privacy, if you want to. I actually think it's a pretty sensible approach to capture both the big segment of people who don't care, and those who do and know which knobs to tweak. You can still turn everything compromising off and end up with a device secured to paranoid levels. That's definitely more than an empty promise, or what oth…

> Most customers do want it this way, but Apple still allows to exchange comfort for privacy […] more than an empty promise, or what other vendors provide.

That’s pretty much exactly what all the other vendors in the market provide: insecure and spying by default.

I don’t really understand why Apple should somehow get good points for their stance on privacy when they are actually doing pretty much the same thing than everyone else.

Post reply on HN