Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

techcrunch.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#81

Post by hahainternet »

arrrg wrote: post #52
foolrush wrote: post #41

Earlier quoted context omitted.

Applications and software? Songs? Television? Movies? Health? Seems to be a bit disingenuous to suggest that they aren't making any money from your habits and data.

No, it doesn’t, not really. Look at where their money is coming from. You mentioned health. Apple has no plans at all to make money with that. It’s just an API that makes devices more useful for users . Think critically about this, but please do it in a honest way.

> You mentioned health. Apple has no plans at all to make money with that. It’s just an API that makes devices more useful for users.

So there's no 'Made For Iphone' program?

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#82

Post by SixSigma »

microtonal wrote: post #32
simonh wrote: post #27

Earlier quoted context omitted.

He didn't make a statement that Apple or the NSA can't read your messages. He said that Apple can't read your messages. However since you are so concerned about half truths, if you're going to criticise someone's statements, it would be nice if you'd address what they actually are saying. It's entirely possible that the NSA has hacked Apple, or that an Apple employee has been subverted by the NSA and inserted a back…

The half-truth is here: If the government laid a subpoena to get iMessages, we can’t provide it. It’s encrypted and we don’t have a key. It's encrypted and they don't have the key, but since the user does not have any control over the public keys being added, they could add a trusted public key and get it anyway. So they can actually provide messages if they really wanted to. I don't believe they really want to. But…

And the source code to the compiler they use. And the source code to those compilers, ad infinitum.

And the masks for every IC inside the products, and the schematics of all the circuitry.

And then someone to verify that they are all the correct ones.

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#83

Post by cbr »

fpgeek wrote: post #31
pilif wrote: post #12

There is zero control over what public keys get handed over to your phone to encrypt an iMessage with. For all we know, whenever you want to send a message to $USER, your phone gets a public key for $USERs iPhone, her iPad and the NSA master key. Tim Cook can state that they can't decrypt the message all he wants, but as long as there's no control over what public keys we encrypt the message with, the statement that…

It's even worse that that. As of about a year ago, iMessage didn't do any certificate pinning: http://blog.quarkslab.com/imessage-privacy.html Unless that's been fixed (I haven't come across any evidence one way or the other), you're not just worrying about Apple and the NSA: Your iMessages are vulnerable to anyone who can forge a certificate and MITM your connection to Apple's servers. I'd say that's a reasonably hi…

Certificate pinning usually (ex: Chrome) is implemented with an exception to allow a company administrator to install a new root CA cert on the device and MITM connections. Does iMessage not allow this?

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#84

Post by cbr »

epoxyhockey wrote: post #13
epoxyhockey wrote: post #11

Apple is a PRISM participant, as of Oct 2012 (one year after Steve Jobs died). I highly doubt any iMessage is more secure than a plain text SMS sent via any cell carrier's network. Apple probably offers a sexy interface for the Feds to read everything. Reference: http://tctechcrunch2011.files.wordpress.com/2013/06/prism-sl...

Do any down-voters care to offer a comment? Is it that one contests that Apple is a PRISM participant?

I didn't downvote you, but the leaked PRISM docs don't show "participation". They show that the NSA was getting the data. If they were doing it by, ex, inter-datacenter fiber tapping then Apple wouldn't have "participated" or even known about the leak.

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#85

Post by jcromartie »

pilif wrote: post #12

There is zero control over what public keys get handed over to your phone to encrypt an iMessage with. For all we know, whenever you want to send a message to $USER, your phone gets a public key for $USERs iPhone, her iPad and the NSA master key. Tim Cook can state that they can't decrypt the message all he wants, but as long as there's no control over what public keys we encrypt the message with, the statement that…

Even if you could provide a key to iOS, would you trust that it's actually using it as you'd expect it to?

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#86

Post by [deleted] »

camillomiller wrote: post #37
yeahmayb wrote: post #10

"Our business is not based on having information about you. You’re not our product. Our product are these, and this watch, and Macs and so forth. And so we run a very different company. I think everyone has to ask, how do companies make their money? Follow the money. And if they’re making money mainly by collecting gobs of personal data, I think you have a right to be worried. And you should really understand what’s…

For as much as you may criticize Apple for many things, you can't really say they are not sincere when they say something like this. A company has to make profits, and profits come from a well executed business plan. Apple's business plan is to sell hardware and create software and platforms that drive hardware sales. Collecting data for reasons that are not related to the functioning of a service makes no sense for…

[deleted]

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#87

Post by [deleted] »

microtonal wrote: post #40
yen223 wrote: post #29

Earlier quoted context omitted.

Of course, there's nothing stopping Apple from selling both the product and the user...

But that reduces the value of the product. I also don't think it is in Apple's DNA to do that. My concern is more that, given how bad they generally are at providing robust cloud applications [1], that their security is equally bad. [1] iTunes Match would always refuse to play some songs from my collection. Even when a stopped using an iPhone last december, iMessages would often come in in non-chronological order and…

[deleted]

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#88

Post by avn2109 »

simonh wrote: post #27
pilif wrote: post #12

There is zero control over what public keys get handed over to your phone to encrypt an iMessage with. For all we know, whenever you want to send a message to $USER, your phone gets a public key for $USERs iPhone, her iPad and the NSA master key. Tim Cook can state that they can't decrypt the message all he wants, but as long as there's no control over what public keys we encrypt the message with, the statement that…

He didn't make a statement that Apple or the NSA can't read your messages. He said that Apple can't read your messages. However since you are so concerned about half truths, if you're going to criticise someone's statements, it would be nice if you'd address what they actually are saying. It's entirely possible that the NSA has hacked Apple, or that an Apple employee has been subverted by the NSA and inserted a back…

>> "It's entirely possible that the NSA has hacked Apple, or that an Apple employee has been subverted by the NSA and inserted a back door into the encryption system."

"Entirely possible" is the understatement of the year. I think you mean "absolutely guaranteed." This is the raison d'etre of signals intelligence agencies. The alphabet agencies would be utterly failing at what they see as their job if they didn't have many, many plants inside Apple/Google/AT&T/large communication organizations.

And Tim Cook isn't stupid; he knows this. His claims might be technically true in a strictly literal sense, in that he doesn't have the key, but the claims are certainly misleading to the nontechnical public. He knows full well that iMessage is uber-compromised, probably in several different ways (legal wiretaps, technical intrusions, HumInt, etc).

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#89

Post by yaur »

abalone wrote: post #54
simonh wrote: post #42

Earlier quoted context omitted.

They can't create trusted public keys after the fact, they'd have to already have them. So there's no half truth. Either they currently create and store such public keys or they don't. Tim Cooke is saying they don't. That statement can't be half true. It's either true or false.

They can't create them for old messages, but they could theoretically add them for messages going forward. So it could work like an old-fashioned wiretap, where you get the subpoena, install a bug and start listening -- but can't go back in time and listen. How? iMessage encrypts and sends a copy of every message to every device registered to a recipient (iPads, iPhones, Macs, etc.), each of which has distinct public…

Could is an understatement. They are likely to be legally required to have this feature under CALEA.

Re: Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

#90

Post by scragg »

> we finally got an agreement from the administration to release how many times we had national security orders on Apple. And in a six month period, and we had to release a range, because they won’t let us say the exact number, it’s between zero and 250. That’s the lowest number you can quote. Zero to 250.

So does anyone else think this might be a bad number (being so low)? If the NSA had access to everything, wouldn't you expect the official requests for data to be low and not because Apple doesn't store data or it's all encrypted anyway as Cook implies.

Post reply on HN