Hacker News Reader

Hacker News

Comment by mooredinty | Hacker News Reader

Full thread

mooredinty

Remember this Pre-Snowden disinformation?

'US DEA upset it can't break Apple's iMessage encryption'

http://appleinsider.com/articles/13/04/04/us-dea-upset-it-ca...

I still can't believe so many people fell for that.

View on HN

That implies some kind of evidence has come out to suggest that this article is false. Could you point to such evidence, please?

They were bothered that their "stingray" like devices could not capture the messages. But fear not, they can still get it from Prism or Xkeyscore (or whatever they call it).

False and false.

The article linked complaints that traditional legal interception means do not work. Those are the ones where they nicely ask the cellular providers for the data. It's not about "stingray like devices", it's about sending a letter and getting the data. End-to-end encryption protects against that, be it iMessage or BBM.

Prism collects data directly from companies that participate, and Apple has said they do not have access to iMessages contents. There was some speculation about courts being able to force Apple to abuse their authority as the iMessage certificate swapper, but I've seen no evidence or convincing argument for that to be the case.

Xkeyscore does not collect any data, but searches it.

Apple is still subject to NSLs, and like Lavabit, can be coerced into operating in such a way that they're able to provide message contents to authorities while advertising that they are in fact secure.

It's much simpler than that. Their marketing team gets their material from the R&D team, and neither group knows about the NSLs, because why would they? Only compliance and a few people on legal know, and everyone hates them already anyway.

And how would "compliance and legal" get access to something engineering designed to be end-to-end encrypted?

>something engineering designed to be end-to-end encrypted?

Is that seriously what you believe?

Assuming it's actually end-to-end encrypted, it is susceptible to MITM attacks because you're trusting a centralized source with key exchange and verification.

You cannot perform an audit on your own. You are trusting that you received the correct keys without a way to verify identities outside of the network.

That is not secure. Please read http://blog.quarkslab.com/imessage-privacy.html

How exactly do you imagine this is possible? End to end encryption means Apple cannot access the message contents.

Can you provide the source code that shows the implementation of the end-to-end encryption? Can you verify that you REALLY have Alice's public key and she has yours? Or are you trusting that the keys you're receiving from Apple's network belong to exactly who Apple says they do?

White paper on the topic: http://blog.quarkslab.com/imessage-privacy.html Consumer grade article: http://arstechnica.com/security/2013/10/contrary-to-public-c...

Lavabit offered in-network public key encryption for its users. Its implementation was faulty and investigators only needed an SSL key to get the information they wanted from suspects. They also ordered Lavabit to keep operating under the pretense that they were secure. http://www.infoworld.com/article/2609583/encryption/how-secu...

Skype was advertised as "end-to-end" encrypted AND peer-to-peer networked for years, until it was slowly exposed as a lie. Skype's content is not end-to-end encrypted and the network is centralized. http://arstechnica.com/security/2013/05/think-your-skype-mes...

It does not imply that, it implies misdirection.

Did I miss something? Why do you think the DEA can break iMessage encryption?

One doesn't need to break any encryption if one has other means of accessing the plaintext. There's a difference between disinformation and misinformation. Even the truth, told selectively, can be disinformative.

https://en.wikipedia.org/wiki/Limited_hangout

One should be careful not to live in or spread in paranoia where everything is a plot to deceive. For anyone looking at the source material and judging reasonably, there was no deception. Perhaps some journalists got a little carried away, but I'd blame that on the pressures of their industry, not malice.

The original DEA slide that was leaked says something very simple: traditional interception techniques do not work on end-to-end encrypted message services (e.g. iMessage). They can't just ask (or get a judge to ask) a law-enforcement-friendly cellular provider to tap the line and CC them on anything someone does. This is true for BBM and WebRTC and many other ways of communicating, as well.

They can surely force by legal means Apple to give you the wrong key for a recipient, thereby defeating the end-to-end protection.

This is the danger of the new wave of security tools that want to "solve" the hard problems (such as key verification) of secure messaging. The hard problems are still there, they're usually just bypassed by centralising trust, which creates a very tempting target for government legal pressure.

You can't use the super secret laser snooper on small fish. So even if it exists, it's still reasonable to have other venues.

Reply on news.ycombinator.com