41–50 of 127 posts
I wonder if the timing of this in response to Beeper Mini gaining access to the iMessage network?
I wouldn't say they "gained access to iMessage network".
They figured out a weakness in Apple's authentication that allowed a user with a fake serial # to authenticate. Apple is slowly making it more strict/checking the serial #s better (my opinion/guess).
Earlier quoted context omitted.
They can't just change the verification code, and it's not based on the fields of the contact card. You can think of it as a fingerprint for their iMessage public key, the one used to encrypt messages end-to-end. If the key with which your phone encrypts iMessage payloads has changed, it indicates that the conversation is being intercepted. WhatsApp supports this too, see "Verify Security Code" on this page: https://…
But the verification code is stored in the contact card, so the parent comment still stands. Anything that can access contacts, e.g. apps or iCloud (since Contacts are not part of Advanced Data Protection i.e. E2E encryption), can modify the verification code in the contact used by Messages for validation.
Earlier quoted context omitted.
They can't just change the verification code, and it's not based on the fields of the contact card. You can think of it as a fingerprint for their iMessage public key, the one used to encrypt messages end-to-end. If the key with which your phone encrypts iMessage payloads has changed, it indicates that the conversation is being intercepted. WhatsApp supports this too, see "Verify Security Code" on this page: https://…
But the verification code is stored in the contact card, so the parent comment still stands. Anything that can access contacts, e.g. apps or iCloud (since Contacts are not part of Advanced Data Protection i.e. E2E encryption), can modify the verification code in the contact used by Messages for validation.
Seems like Apple is tacitly acknowledging that sophisticated actors have successfully been man-in-the-middling iMessage users. I wonder if they have clear evidence of that since I haven’t seen any coverage on this.
Seems like Apple is tacitly acknowledging that sophisticated actors have successfully been man-in-the-middling iMessage users. I wonder if they have clear evidence of that since I haven’t seen any coverage on this.
The attack is that anyone can make an iMessage account and pretend to be your friend ("new phone who this"); this feature is how you prevent that.
Rather, it aims to prevent someone who compromised iMessage infrastructure, from pulling a dodgy around keys.
Earlier quoted context omitted.
I'm always confused by this. This merely validates that Anna at the time thought that was Adam's number, what else? Does not guarantee it's Adam reading.
If you have a cryptographic primitive and a robust system to protect it (secure hardware, biometric auth), if you can confirm digital identity in real life you can be reasonably assured Adam is reading. Chain of integrity.
This seems somewhat similar to Matrix's (and other apps') approach of comparing keys to verify identity (plus with I guess some extra hardware requirements and attestation). I'm interested to see what the uptake is among users, because even though Matrix has done a fair amount to smooth this process, verification is still a pretty large source of friction from what I can tell, and I'm not completely sure how it could…
I don't like how matrix does it. I tried to get very technical people to use it and they struggled. Plus, they assume you have enough trust with your contacts to share with them your device details instead of just a unique identifier.
If Apple rolls out a similar system and it works or they're able to identify pain points and make it easier to use, then cool. Maybe Matrix can take pointers from the UI if that's the case. But I wonder if that will be the case, or if Apple's implementation will suffer from the same UX problems that Matrix's does.
Earlier quoted context omitted.
I don't like how matrix does it. I tried to get very technical people to use it and they struggled. Plus, they assume you have enough trust with your contacts to share with them your device details instead of just a unique identifier.
The article is a little short on details, but it's not immediately clear to me how Apple's UX will differ. This is exactly my concern, I agree that Matrix's setup can be difficult for new users, but I'm not sure what a good UX for this even is. Apple's non-public verification method seems to be (at least at first glance) almost identical to what Matrix is doing. If Apple rolls out a similar system and it works or the…
Sucks that it requires iCloud Keychain enabled, and also removing your appleid from any legacy macs and iphones. Wish they explained the reasons for this, because I'm having a hard time seeing one.
Probably requires a hardware-security-module for generating secure attestation keys.