iMessage, explained • Hacker News Board

Re: iMessage, explained

#161

Post by Eriksrocks » Sat, Dec 09, 2023, 11:57 PM UTC

kotaKat wrote: post #150

blibble wrote: post #110

Earlier quoted context omitted.

maybe, but for a task like this it doesn't really scale Apple aren't going to allow one phone to attest 5000 new iMessage clients

That's... amusingly, also a thing in Chinese marketplaces, for a similar purpose. iCloud Activation Lock, on non-cellular devices (eg, Wi-Fi only iPads), relies on the device's serial number, Wi-Fi MAC, and Bluetooth MAC addresses as the three identifiers required to clear the Activation Lock check. Via special debug cables (eg, a "DCSD cable") there are ways to write in new SysCfg data to the flash to change those v…

Interesting. I assume this is mostly used to "wash" stolen devices to make them appear legitimate for resale? I'm surprised Apple designed the hardware to allow this without any sort of authentication.

Re: iMessage, explained

#162

Post by SpaghettiCthulu » Fri, Dec 15, 2023, 2:22 AM UTC

Eriksrocks wrote: post #157

SpaghettiCthulu wrote: post #108

Earlier quoted context omitted.

It's only a matter of time until a company starts selling TPM dumps, right?

You can't "dump" a TPM. That's the whole point. They are designed such that the cryptographic secrets they hold (including ones loaded at manufacturing) are unrecoverable without an electron microscope and nation-state level resources (and even then, it would be extremely difficult if not impossible on modern process nodes).

> You can't "dump" a TPM.

> unrecoverable without an electron microscope and nation-state level resources (and even then, it would be extremely difficult if not impossible on modern process nodes).

Oh, so you can. It's only a matter of time.

Re: iMessage, explained

#163

Post by SpaghettiCthulu » Fri, Dec 15, 2023, 2:24 AM UTC

loopdoend wrote: post #158

Eriksrocks wrote: post #157

Earlier quoted context omitted.

You can't "dump" a TPM. That's the whole point. They are designed such that the cryptographic secrets they hold (including ones loaded at manufacturing) are unrecoverable without an electron microscope and nation-state level resources (and even then, it would be extremely difficult if not impossible on modern process nodes).

Even with an electron microscope you wouldn't extract a root key it would just be a device key which they would then ban.

There's plenty that one would be able to do with a device key before it is banned.