Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage, explained

jjtech.dev

Post reply on HN
Print view View original

151–160 of 163 posts

Re: iMessage, explained

#151

Post by joshavant »

Looking at the Beeper Mini announcement [1], they clearly state that a user doesn't need an Apple ID to register their phone number and send/receive iMessages. Also, they describe direct, device-to-Apple interactions.

However, this article says:

> IDS is used as a keyserver for iMessage...

> The first step in registering for IDS is getting an authentication token. This requires giving the API your Apple ID Username and Password.

> After registering with IDS, you will receive an “identity keypair”. This keypair can then be used to perform public key lookups.

So how does the Beeper Mini app take an arbitrary Android phone number, register public keys for it with IDS, and perform public key lookup of recipients... all without ever using an Apple ID?

[1] https://blog.beeper.com/i/139416474/security-and-privacy

EDIT - It looks like the answer here is the 'SMS Gateway' which is virtually undescribed in the OP article or anywhere on [1]. Guess that's the secret sauce.

Re: iMessage, explained

#152

Post by jjeaff »

joshavant wrote: post #151

Looking at the Beeper Mini announcement [1], they clearly state that a user doesn't need an Apple ID to register their phone number and send/receive iMessages. Also, they describe direct, device-to-Apple interactions. However, this article says: > IDS is used as a keyserver for iMessage... > The first step in registering for IDS is getting an authentication token. This requires giving the API your Apple ID Username a…

I just downloaded Beeper Mini on my android phone and after giving me a fail error when trying to send an SMS to Apple to register my phone, it then popped up asking for my apple id.

Re: iMessage, explained

#153

Post by jjeaff »

matwood wrote: post #14
catlover76 wrote: post #6

I just got an iPhone for the first time, and it is a noticeably better device than my previous Android phones. One downside is that I can't use iMessage on my Windows and Linux computers. Will look into pypush Honestly, the iPhone is nudging me further to giving a Macbook/OSX a try one day, but the major blocker to me is the poor state of gaming on Macs.

But the internet keeps saying the iPhone is just marketing. /s I’ve developed for and used both, and I’ve settled on iPhones for the last few generations. Though, I think flagship devices of either are fine nowadays. The ‘slab of glass’ phone is basically a solved problem at this point.

I think Google does a good job with the Pixel line. I believe it is likely they are the 2nd most secure consumer phones after iPhone due to their quick updates and Google's good security record. The fact that I can easily side load apps on Android make it a much better, ad free experience for me.

Re: iMessage, explained

#154

Post by nortonham »

catlover76 wrote: post #119
nortonham wrote: post #117

Earlier quoted context omitted.

> the iPhone is nudging me further to giving a Macbook/OSX a try one day, Gaming isn't great on Mac (depending on what games you play), but macbooks are great imo. A pro or an air with apple silicon is worth the money. I've never really appreciated the build quality of a mac before. > I just got an iPhone for the first time, and it is a noticeably better device than my previous Android phones. In what way? What Andro…

My last phone was a Samsung Galaxy A50, and it was pretty good as far as the hardware went. But I felt that Android was bad; I couldn't help but notice that a number of the apps loaded very slowly and had other small glitchy issues. Nothing that would compel a person to switch phones, just a lot of mostly minor inconveniences, except for 2 that really stick out right now: the Android messages web app always had a har…

>the Android messages web app always had a hard time connecting to my phone even when the phone was clearly on, had the messages app open, and was connected to same wifi as my computer; and second, Chrome recently just started becoming unopenable (like it would open and then immediately close for some reason).

Those are definitely annoying and off putting. On my pixel 5 chrome always worked well (but I use other browsers), and messages app was trouble free...

Wonder if it was a problem with that model of phone you had.

But it's true, apples ecosystem is definitely a draw

Re: iMessage, explained

#155

Post by metadat »

cynicalsecurity wrote: post #42

> In order to generate the “validation data”, pieces of information about the device such as its serial number, model, and disk UUID are used. Sadly, this is a clear sign the project is going to stop working eventually. At some point, the Apple is simply going to pull the plug. I remember doing similar tricks when I was a kid. Nowadays I simply won't even care trying. The problem clearly isn't supposed to be solved t…

> A better experience would be writing your own message delivery solution, superior to iMessage.

May be infeasible, due to network effects

Re: iMessage, explained

#156

Post by sbuk »

metadat wrote: post #155
cynicalsecurity wrote: post #42

> In order to generate the “validation data”, pieces of information about the device such as its serial number, model, and disk UUID are used. Sadly, this is a clear sign the project is going to stop working eventually. At some point, the Apple is simply going to pull the plug. I remember doing similar tricks when I was a kid. Nowadays I simply won't even care trying. The problem clearly isn't supposed to be solved t…

> A better experience would be writing your own message delivery solution, superior to iMessage. May be infeasible, due to network effects

Evidence exists that, with regards to a messaging platform, this has already been achieved.

Re: iMessage, explained

#157

Post by Eriksrocks »

SpaghettiCthulu wrote: post #108
blibble wrote: post #86

Earlier quoted context omitted.

remote attestation would mean it's not possible to pull out the binary and run it externally you'd need the key from the TPM/secure enclave too, which is much much harder to extract

It's only a matter of time until a company starts selling TPM dumps, right?

You can't "dump" a TPM. That's the whole point. They are designed such that the cryptographic secrets they hold (including ones loaded at manufacturing) are unrecoverable without an electron microscope and nation-state level resources (and even then, it would be extremely difficult if not impossible on modern process nodes).

Re: iMessage, explained

#158

Post by loopdoend »

Eriksrocks wrote: post #157
SpaghettiCthulu wrote: post #108

Earlier quoted context omitted.

It's only a matter of time until a company starts selling TPM dumps, right?

You can't "dump" a TPM. That's the whole point. They are designed such that the cryptographic secrets they hold (including ones loaded at manufacturing) are unrecoverable without an electron microscope and nation-state level resources (and even then, it would be extremely difficult if not impossible on modern process nodes).

Even with an electron microscope you wouldn't extract a root key it would just be a device key which they would then ban.
Post reply on HN