Hacker News Reader

Comment by esolyt | Hacker News Reader

I was really hoping not to see the phrase "direct access" this time.

But we get another statement that iMessages is end-to-end encrypted. Apple continues to state that, but there's also some evidence to the contrary. Like newly authorized devices being able to somehow retrieve the chat history.

Someone more capable than I should really investigate iMessages.

Why is that so suspect? That's just TNO-style encryption- as in, you encrypt it going up, and download the encrypted chat history, before decrypting it using your login information.

Now, if they're sending it back to you as plaintext? Sure okay, that's reason to be concerned. But simply getting back your chat history isn't any reason to doubt the end-to-end encryption.

I think that chat history is actually only retrieved when you restore from an iCloud backup (which backs up everything on the phone, and can be disabled), not when a new device signs in.

I can confirm this, as I just did a clean install and set it up as a new iPhone.

>Like newly authorized devices being able to somehow retrieve the chat history.

That's like saying it's suspicious that I can make an encrypted backup of my laptop, and then "magically" get that data unencypted on my new laptop.

There's nothing weird about being to access your own data, even on a different device.

"Apple can not decrypt it" - does it mean somebody else can? Or is it encrypted at a level that is virtually unencryptable with today's technology?

It could mean somebody else can, because of key escrow and partial key escrow. Even if the key is generated on the device and stays on the device, you have to look at how the key is generated. With key escrow, the messages can be secure against attacks by everyone except those who have the escrowed portion of the key.

And to do that you must also transmit the escrowed part of the key in the protocol -- which is 100% detectable as a blob of "extra but seemingly unnecessary data".

Do you see that? Does anybody see that? Has anybody seen that?

It means Apple doesn't have access to the encryption keys, as it's done peer to peer. http://en.wikipedia.org/wiki/Point-to-Point_Protocol

Reply on news.ycombinator.com