Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage Key Verification

support.apple.com

Post reply on HN
Print view View original

101–110 of 127 posts

Re: iMessage Key Verification

#101

Post by rezonant »

Kluggy wrote: post #91
nixgeek wrote: post #89

Earlier quoted context omitted.

iCloud Advanced Data Protection also requires modern hardware and won’t enable if you have outdated/vintage stuff logged in on your Apple account.

This is super annoying. I don't have iCloud stuff enabled on my old iPad, but it works just fine as a media streaming device for the kids. I want to enable Advanced Data Protection, but it won't let me until I replace the perfectly good iPad :(

Couldn't you just make a dedicated account for that device? Wouldn't that be preferable anyway? You could still use family controls.

Re: iMessage Key Verification

#102

Post by ezfe »

Kluggy wrote: post #91
nixgeek wrote: post #89

Earlier quoted context omitted.

iCloud Advanced Data Protection also requires modern hardware and won’t enable if you have outdated/vintage stuff logged in on your Apple account.

This is super annoying. I don't have iCloud stuff enabled on my old iPad, but it works just fine as a media streaming device for the kids. I want to enable Advanced Data Protection, but it won't let me until I replace the perfectly good iPad :(

You can remove that iPad from your account if you don't need iCloud for it

Re: iMessage Key Verification

#103

Post by ezfe »

lxgr wrote: post #69
heywire wrote: post #66

Earlier quoted context omitted.

You sign into your personal Apple accounts on your work computer? Seems like a very bad idea to mix work and personal.

That's exactly what I'm not doing (iMessage is ok for me, all my iCloud data definitely not), hence no contact key verification for me.

I mean, you literally are - you've signed into iMessage with your personal account on a work device.

I know it's not iCloud, but it's functionally the same as iCloud with all the checkboxes disabled.

Re: iMessage Key Verification

#104

Post by isodev »

brookst wrote: post #42
grgar wrote: post #33

Earlier quoted context omitted.

But the verification code is stored in the contact card, so the parent comment still stands. Anything that can access contacts, e.g. apps or iCloud (since Contacts are not part of Advanced Data Protection i.e. E2E encryption), can modify the verification code in the contact used by Messages for validation.

Are you saying the iOS contacts API lets apps read and write the verification code? That seems like terrible design. What need would a 3P app have for that capability?

No, there is no way for apps to read and write this information.

Re: iMessage Key Verification

#105

Post by lxgr »

ezfe wrote: post #103
lxgr wrote: post #69

Earlier quoted context omitted.

That's exactly what I'm not doing (iMessage is ok for me, all my iCloud data definitely not), hence no contact key verification for me.

I mean, you literally are - you've signed into iMessage with your personal account on a work device. I know it's not iCloud, but it's functionally the same as iCloud with all the checkboxes disabled.

How are the two the same? iCloud automatically logs you into iMessage, but the reverse is not true.

Getting more access beyond iMessage requires another authentication (it’s definitely not just “enabling more checkboxes), and most importantly iCloud Keychain won’t even be touched without the required second factor (usually another device’s passcode on the same iCloud account).

Re: iMessage Key Verification

#106

Post by Kluggy »

_rs wrote: post #94
Kluggy wrote: post #91

Earlier quoted context omitted.

This is super annoying. I don't have iCloud stuff enabled on my old iPad, but it works just fine as a media streaming device for the kids. I want to enable Advanced Data Protection, but it won't let me until I replace the perfectly good iPad :(

Any idea what happens if you sign out, enable it, and try to sign back in? Is the error as cryptic as I might imagine?

IIRC, it's just a generic failure to log into iCloud

Re: iMessage Key Verification

#107

Post by Kluggy »

ezfe wrote: post #102
Kluggy wrote: post #91

Earlier quoted context omitted.

This is super annoying. I don't have iCloud stuff enabled on my old iPad, but it works just fine as a media streaming device for the kids. I want to enable Advanced Data Protection, but it won't let me until I replace the perfectly good iPad :(

You can remove that iPad from your account if you don't need iCloud for it

We do use it for TV+ shows like Snoopy in Space, so alas, I'm stuck with it being registered

Re: iMessage Key Verification

#108

Post by lloeki »

lxgr wrote: post #61
notpushkin wrote: post #18

Earlier quoted context omitted.

Tangential, but Keybase (and later Keyoxide [1]) with their “social proof” mechanics are a more human-friendly way to verify the encryption keys. I kinda wish Matrix had that integrated, too. [1]: Here's my Keyoxide page for example: https://keyoxide.org/alexander@notpushk.in

Is Keyoxide based on the Keybase codebase, or is it a new development? I quite enjoyed Keybase back in the day, but then they pivoted to being a crypto wallet, and were ultimately acquired by Zoom (a move I understand less every day, since they obviously gave up on their bold promises of end-to-end encryption they made back in 2020).

Not entirely clear but it doesn't seem so from the launch post verbiage:

https://blog.keyoxide.org/keyoxide-launch/

Code lives here if you want to dig:

https://codeberg.org/keyoxide

Re: iMessage Key Verification

#109

Post by londons_explore »

notpushkin wrote: post #17
seanieb wrote: post #14

Earlier quoted context omitted.

Trevor Perrin, who co-designed the Signal Protocol, made the point that most people don’t have to do this. If a few people do, an adversary won’t know if the target is verified or not. If they MITM they might be discovered instantly. Which gives the entire herd protection. - https://www.youtube.com/watch?t=2001&v=7WnwSovjYMs

Not a great argument IMO. If only 0.1% people check the keys, the attacker may be just okay with the 0.1% chance of being discovered – especially if there's no consequences for them.

WhatsApp has this scheme. And to my knowledge, never had there been a report of verification failing.

If an adversary was discovered 0.1% of the time. There would be at least one person on a support forum with the text of the error that occurs when it fails...

Re: iMessage Key Verification

#110

Post by kfreds »

For those interested, the underlying technology for this feature is transparency logs. Some technical details for iMessage's approach can be found here:

https://security.apple.com/blog/imessage-contact-key-verific...

The same technology powers WhatsApp's key transparency:

https://engineering.fb.com/2023/04/13/security/whatsapp-key-...

Less than a month ago the first workshop on "transparency systems" was held at ACM CCS:

https://catsworkshop.dev

Shameless plug: I'm one of the designers of the Sigsum public transparency log, as well as System Transparency - a security architecture intended to bring transparency to the reachable state space of a remote running system.

Post reply on HN