Hacker News Reader

Comment by legrande | Hacker News Reader

> Apple does not get access to the messages

I routinely look at the network traffic of my iDevice and see a tonne of traffic being sent to Apple. I can't see the contents of the traffic, since 99% of it is encrypted, but I can safely say Apple is very cozy with your device. Just assume Apple can see everything, and change your behavior accordingly. If I want secure comms, I use battle-hardened things like Tails[0].

What is with the very low adoption of comsec tools like Tails? Does everyone think it's crimeware and only used by criminals? Because I do a lot of my surfing with Tor, but that doesn't mean I'm a darknet drugs kingpin does it?

[0] https://tails.boum.org/

View on HN

Probably for the very simple reasons of convenience and wanting to use a mobile device to communicate? A clunky laptop with low / no state is not that.

We all know 'it doesn't have to be this way'. There is nothing special about your personal OS needing to phone home on you. I think people are more likely to use something like LinageOS vs something like tails if they want 'more secure' communications than to drag a laptop around with Tails.

I'm a bit skeptical about Tails and other comsec tools which are a full OS instead of small, separate app. I don't have the time or knowledge to inspect full OS image in detail, and it feels like "secure communications, protected from the guys you don't like" is exactly the thing the "guys you don't like", like government, would create, with proper backdoors in place. After all, that had happened numerously before. (Crypto AG, that story about CIA gaining control of some "secure messaging" devices, etc)

Apps can be observed by the host OS, so if you're looking for an app that is secure relative to the host OS, then you're looking for unobtanium and instead need a host OS you can trust.

OTOH, the big lesson of Clipper is that every OS, every app, every platform, can be hacked by nation state adversaries.

No, I'm looking for an app which will be secure, as in, lack backdoors or obvious security issues. I understand that OS can compromise it, but I more or less trust my normal OS, and it seems weird to use a "secured" OS, because that's where I'd expect all the backdoors to be. Not to mention the fact that if your threat vector is "Apple looking through you photos", you probably don't even need anything special in the first place - popular Linux disto with some Matrix client will be just fine.

I'm skeptical as well since I don't believe the CIA or NSA even use such tools. Don't they just use RHEL or Windows? Why would they backdoor their own stuff?

Because they can easily un-backdoor them?

> I can't see the contents of the traffic, since 99% of it is encrypted, but I can safely say Apple is very cozy with your device.

So in reality you are too lazy to hook their TLS verification code (super easy to do with public tools), or alternatively you did do this and the traffic just wasn’t that interesting.

Not really sure what we are supposed to take away from this.

Laughs in certificate pinning. Updating/restoring MacOS behind a TLS intercepting proxy is more or less impossible.

I already addressed this in the very comment you were replying to, certificate pinning is very easy to defeat with public tools.

Which tools? You keep saying it's very easy in a fairly insulting manner but then offer zero information to anyone on how to do it.

I think it’s fair and reasonable to expect a basic level of knowledge when someone is making such confident statements regarding their reverse engineering work.

Defeating certificate pinning with tools like Frida is one of the most basic and common tasks when reversing iOS/OS X applications.

Frida

Reply on news.ycombinator.com