Hacker News Reader

Comment by levosmetalo | Hacker News Reader

Why is it any worse than only Apple server reading all you messages? You trust one third party with proven track record of spying on its customers, but somehow you are upset that someone else also has access to you messages, thought that someone didn't (yet) do anything wrong with them.

If you are American, you don't have to fear from Chinese espionage, and US agencies already have your data. If you are European, it's more or less the same. If you are from China, well, at least you can prove that you are not doing anything behind the government back ;)

View on HN

Surely you're joking. I don't doubt you can understand the difference between a government law enforcement agency reading your messages and some guy off the street reading your messages.

Neither Apple nor the NSA will, for example, immediately rack up a string of fraudulent charges on every credit card number that it sees come through its system. Some random guy in China? I'd say there's a pretty high chance that's exactly the reason this app is in the app store.

No, it is not a joke. iMessage is not a secure communications channel. With this app in the wild, it is pretty clear it is not a secure communications channel. You should not post CC information along an insecure communications channel.

You may be right that there is more risk involved now, but it is nice to get the point out in the open.

>> "I don't doubt you can understand the difference between a government law enforcement agency reading your messages and some guy off the street reading your messages."

I'd feel more secure with just some guy off the street reading my messages. Fortunately I don't ever send CC#'s through messaging services so there's very little else he could do.

where is your proof that the guy off the street in this case isn't the chinese government?

I didn't mention this case I was speaking more generally. And I'd personally be more worried with what the US government knows about me than the Chinese. I have many more interactions with American people and businesses and I like to visit there. I don't have much if any interaction with China so it doesn't bother me as much.

That still makes no sense. Your information has been leaked to one party, so you're okay with it leaking to others as well? Also, it's not just what they know, it's what they do with that knowledge. And it seems pretty absurd to make the claim that the US has had worse precedence in this regard than China.

Worry about it when you're important enough for the Chinese government to care what you do? I'm certainly not.

People know who Apple is. Apple has a reputation. Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA.

I don't know who's running this server in China. But unless it's the NSA, you're much worse off using this app than native iMessage, because now in addition to NSA seeing everything, so does this guy--who has no reputation at risk. Adding more eavesdroppers makes communications additively less secure.

How exactly do I have nothing to fear from the Chinese? At least the NSA is unlikely to have any real interest in communications between Americans in America because it's outside their mission, which is not true for Chinese or Russian intelligence.

> Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA.

I do not think that this statement is accurate. The NSA has specifically targeted the largest players.

Also: "encryption works. Properly implemented strong crypto systems are reliable" - Edward Snowden.

Yes but you do have to sacrifice quite a bit to be outside of the NSA's realm of observability. Is iMessage securely encrypted? Wasn't the DEA caught red-handed with a false memo claiming they couldn't MITM iMessage communication?

By MITM you think a guy with a hard drive sitting in the middle of the Apple HQ siphoning data directly to NSA? Yes, I could imagine that.

> Yes but you do have to sacrifice quite a bit to be outside of the NSA's realm of observability.

Very true. That's a consequence of the largest players in winner-take-all markets being targeted.

"In Snowden we trust" - the internet

It's sad that the NSA and government has lost the faith of Americans to the point that the word of one man is taken without question.

Well, Mr "nsashill42334", account under 24 hours old, I don't think that Mr Snowden should be trusted without question. However it seems unlikely that he is setting out to dupe people into using encryption for some reason or other.

Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA.

scary baseling like this

> Why is it any worse than only Apple server reading all you messages?

Not. This. Again.

Because one person can read your messages, it doesn't mean that the whole world should be able to. One happening doesn't mean the other is okay.

You seem to misunderstand the OP concerns.

It is not only one person, it is not only Apple servers reading all your messages. It is in fact the whole world. Through Apple gives it to NSA which hands it over to various other agencies, GHCQ, FRA, your data ends up in Israel. Your data is already a goods traded with on the international market.

Why not increase the competitiveness of this Chinese actor, you will get better service in the future? More competitive - better service.

Let me give you an example.

Apple, NSA saw CC number in your chat log, but Apple, NSA, GHCQ, FRA or Israeli Intelligence won't steal your CC and use it.

However, the Chinese vendor could intercept CC info and sell it to blackmarket.

You seem to be confused.

The NSA has already sold your CC on the black market. Its just that the buyer hasnt used it, because they cant use it without getting penalties. Penalties which this Chinese vendor would succumb to as well.

Now are you going to say you trust Israel more than the Chinese, they wont misuse your CC, and if they did, its still better than trusting a Russian vendor?

Uh... as I read it the point of this app is the the whole world is able to read your messages. This app is just the existence proof that all that is required is access to the raw packet data.

Clearly most people are going to "trust" Apple Computer more than this app vendor. But the point is that such trust isn't worth anything. The data is hanging out there already.

Huh? So, does the existence of an open-source reimplementation of early versions of SSL also imply that if you had access to the raw packets you can read anyone else's SSL stream? How about if we first require the data to be sent in the clear to someone who refuses to tell us how DES works, but is willing to provide a web service that implements it? This app is not by any stretch of imagination proof that the protocol on the wire is not encrypted. Yes, that might be the case, and we might learn some interesting things at pod2g's talk on iMessage at HITB (I'm definitely looking forward to that), but that would be totally unrelated to the existence or possibility of this app.

If you are American, you don't have to fear from Chinese espionage

Citation needed. There are numerous stories (unconfirmed of course, but that's the way these things always are) of Chinese hackers breaking into companies and stealing trade secrets. They aren't just after super spies, you know.

And you don't work in an industry the Chinese would be interested in? Good for you. But do you know anyone that is? This hack might quite possibly allow them to send messages as you to whoever they want.

"The NSA has my information so hey, screw it" isn't really an appropriate reaction.

My server logs suggest I need to fear Chinese espionage. You'd need a hell of a citation to beat that.

Attack surface. When you increase the number of parties capable of decrypting your data, you increase the risk of an exposure.

The Apple server cannot read your messages because it is encrypted client-side. https://www.schneier.com/blog/archives/2013/04/apples_imessa...

Reply on news.ycombinator.com