Hacker News Reader

>(if I understand it correctly) the cryptography is solid

The issue is that iMessage outright ignores a long understood challenge in the APPLICATION of cryptography, namely knowing when to trust that someone is REALLY giving you their public key rather than being man-in-the-middled.

While this is a thorny challenge there are well understood, if imperfect, ways of addressing it that have been around for decades. At minimum it works like ssh, where you get a warning when an unfamiliar new key is presented and decide whether to trust it or not. More sophisticated is the certificate infrastructure around TLS/SSL where some effort is made to bring semi-trusted third parties into play.

These are all flawed solutions, the problem remains essentially unsolved. But any truly secure system based around public keys has some mechanism that addresses this challenge.

The issue with iMessage is that 1. Apple did not attempt to address the key exchange problem, which would maybe be fair enough on an "easy" consumer product with weak security claims but then 2. Apple made strong security claims very publicly and 3. even said a counterfactual, that it had no capability to intercept messages.

THAT is what is disingenuous: Apple implements public key cryptography, which since its inception and at its very heart raises difficult challenges around key exchange; Apple chooses to ignore these challenges; Apple then claims strong public key security. Either attempt to address the challenges like everyone else, or don't make the security claim, you can't do both.

I disagree.

The flawed systems are SMS and predecessor systems like alphanumeric pagers, where your messages are archived indefinitely in a database by the carrier. Remember the Wikileaks release of all of the pager traffic in lower Manhattan on 9/11?

In my mind, the NSA/PRISM stuff is a meta-problem that is just something that is hanging out in the background. I work in enterprise IT, I'm not a dissident, drug dealer or whistleblower, so I'm more worried about incompetent carriers and other hostile parties than the NSA.

So iMessage gives me encrypted message content that may be readable retrospectively by the NSA, and is almost certainly "tappable" by normal law enforcement.

The reality is, that's about as good as you are going to get outside of a defined community of interest. My employer has highly secure voice and text solutions available for key personnel, for instance. Perfectly secure communications won't be available to the masses, because the operators of those systems face liability.

This ignores the context of the system, which is everything in this controversy.

Apple did not say, "Here's iMessage, it is much more secure than SMS."

Apple said (in essence), "Here's iMessage, we couldn't tap it if we tried."

THAT is false, and all of the nice things you point out about iMessage aren't in dispute and don't have anything to do with the glaring inaccuracy of Apple's claim.

They didn't say that. Previously they said: "no one but the sender and receiver can see or read [FaceTime calls and iMessages]. Apple cannot decrypt that data." Now, they are saying "iMessage is not architected to allow Apple to read messages".

They key message is: Apple cannot decrypt or read your data. That's all they said.

They didn't say "Apple will not lawfully provide iMessage encryption keys to the government" nor "Apple will not provide the secret key for the iPhone CA to the government upon request/demand" nor "Apple will not provide iMessage data to the police."

When a secret court compels you to remain silent, what isn't said is critical.

Whats the liability difference between the systems at work and the systems for the general public?

Strong crypto is, and should be, available to everyone.

The law.

Common carriers are required to to have "tappable" systems if the system is deemed to replace phone conversations.

The biggest difference is ease of use. The more secure a system, the less user friendly it tends to get, and that is the cause why the general public don't get secret and top secret cryptographic products...

Two corrections to your comment...

ANY system where code can be deployed at will and the owner of the device is not in full control of the device will have this same level of vulnerability. Saying that a system is insecure because you could change the system doesn't tell you anything interesting about the system.

1. The NSA vacuums up network traffic. Meaning they use man-in-the-middle attacks. Sometimes they do force businesses to deploy a malicious program, as you describe, to gather a user's password. This is called a Pen Register, or Trap Trace Device: https://ssd.eff.org/wire/govt/pen-registers However, this is the exception, not the norm.

Defending against man-in-the-middle attacks is a bare minimum requirement for any system that purports to be "secure". Defending against Pen Registers is an unsolved problem, but it's unrelated to the attack presented here.

If I understand it correctly, they are saying that the messages are encrypted using an RSA key unique to the sender, and that this is not secure because Apple could, if they wanted to or were ordered to, replace the certificates with ones that were not secret. [...] What is misleading here is that (if I understand it correctly) the cryptography is solid, it is the implementation being owned by Apple that raises the doubt. But this is NOT a statement about the cryptography used on the iMessages, it is a statement about the fact that Apple effectively has "root access" to their phones.

2. From http://blog.quarkslab.com/static/resources/2013-10-17_imessa... page 36:

- All iMessages are encrypted and signed using asymmetric cryptography

- Thus, there has to be a key directory

- iMessage client retrieves recipient’s public keys by querying Apple’s ESS server

It's that last point which is the most important. When someone sends you an iMessage, their device queries an Apple-controlled server for the recipient's public key. The server returns a "Public Keys Buffer". The buffer contains an RSA public key (1280-bit) to encrypt messages for the remote device.

Apple controls that server. They can send you whatever public key they want.

In other words, while I wouldn't say it's "trivial," it's at least "realistic" for the government to be able to order Apple to serve up an MITM'd public key. Combined with a copy of the network traffic, they can then decrypt all iMessages. And the government isn't the only adversary to worry about, either.

The point of cryptography is that you should be able to trust who you choose to trust. Apple is saying we can trust their claim of not being able to decrypt iMessages. But that claim rests on Apple to serving up the proper public keys through Apple-controlled servers. This is called the key exchange problem, and it's why their iMessage claim can be accurately described as "completely bogus." They don't even attempt to address key exchange security.

The takeaway is: iMessage shouldn't be trusted.

>Apple controls that server. They can send you whatever public key they want.

Isn't that also true (minus Apple) for the PGP keyservers?

Yes. But with PGP you are supposed to check the key fingerprint before trusting it, either directly offline or by someone you have checked offline signing it.

That's not really going to fly with a consumer level product like iMessage though.

Why ? just as an option for extra security ?

And if you want to make it extra nice, you could add an automatic/half-automatic back channel through bluetooth. could create interesting design options.

And so the challenge is similar to the TOR challenge, in a sense. If you want real security it requires a certain amount of inconvenience (such having to use an OS and a device for which you can verify it is doing what you think it is, or using a protocol that slows down your already slow internet connection) and because inconvenience is not popular this means using a tool that only people who are "afraid of being caught doing something" would want to use.

In a sense, you are an instant target for suspicion, you have created a "reasonable and probably cause for suspicion" by using such a device or software system.

I remember driving through my neighborhood in suburban Philadelphia and seeing a young man walking down the side of the road and being shocked by this act. Nobody walks in that neighborhood or along that road. Nobody bikes there. Frankly, it's ill advised because of the winding nature of the road and the absence of sidewalks or even a shoulder. I could feel myself become immediately suspicious of his presence and his actions.

All he was doing was going out for a walk. Frankly, I was the weird one.

At some point, as technology becomes embedded in our culture we expect people to use it and we look at those who do not as odd balls and are suspicious of them (think the Amish).

So if you are avoiding using the "latest and greatest" and opting to use a "secure system", people are going to look at you like you are crazy and be suspicious of your activities. This will probably drive you to keep it secret, which will only make it look more incriminating.

My point is: how do make these things mainstream in such a way that ordinary people who aren't interested in the security aspects can and will use them, but those who want or need the added security can use them without garnering suspicion for doing so?

That's a really interesting problem.

1. Say i care about privacy. I decide that all the help i give people over the internet, would be composed of a plain text teaser ,and an encrypted content. That's easy to imagine doing so in private messages , and even in small groups. Maybe even using some technical trick this could work on publicly posted information(or at least slow the rate/chance of wiretapping). And in those cases i only reply to messages sent securely.

If enough people do this , soon enough , there will be plenty of encryption.

2. Make it a habit to embed an encrypted background channel in many apps that always transmits, that need comes be , can be used to transmit info. "Hey it's just a cool app man". If enough such apps spread, suddenly everyone encrypts.

' 3. Same applies regarding to anonymity.

I don't find it disingenuous. Per the article's title, it is refuting Apple's claim that it "cannot" access iMessages, and on that basis, I think it's entirely valid. Apple put out a statement earlier this year:

For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. [1]

I didn't read the article as asserting that the encryption is broken or poorly designed, simply that if compelled, Apple could indeed eavesdrop on iMessages, which contradicts the above statement. The author explains this explicitly:

In fairness to Apple, most other commercial messaging systems are also vulnerable to man-in-the-middle or similar attacks mounted by insiders. The difference is that few if any of those other providers have issued public statements claiming the messages sent over their services can be read only by the sender and receiver.

[1] https://www.apple.com/apples-commitment-to-customer-privacy/

Even disregarding Apple's control over the software, the system depends on Apple as a trusted key distributor. This is the vulnerability which the article is concerned with, as far as I can tell.