Hacker News new | past | comments | ask | show | jobs | submit login

We quickly need to reach a point where we encrypt everything we do on the client-side, during transmission and only readable by intended recipients.



We're working on this for text messages with TextSecure (http://www.whispersystems.org). If you've got the time and interest to help contribute, please check it out.


The FBI is already whining that default use of HTTPS by Google and Facebook is ruining their snooping:

http://www.washingtonpost.com/world/national-security/propos...


iMessage does this now. The problem is that the UI gives no control over the list of keys it encrypts to, so you can still be wiretapped.


Do you have further documentation of this? There doesn't seem to be anything other than hearsay which demonstrates that they do end-to-end encryption, and some anecdotal evidence that they don't (a new device brought online will receive messages from before it was initialized, for instance).


http://ios-rev.tumblr.com/

http://imfreedom.org/wiki/IMessage

https://github.com/meeee/pushproxy

I was curious, too. I had lunch with the guy who made the proxy (man, I love living in Berlin) and discussed his efforts to reverse engineer the iMessage protocol (which runs inside/on top of Apple's push notification system).

AFAICT, iMessage activation fetches a key from Apple that is either tied to or based on the hardware serial number. Based on Apple's history of rather excellent crypto implementations on iOS[1] I'm guessing that (on iOS) this key then gets signed by either the hardware key or somesuch to authenticate the device to the APNS. On OSX, the activation request includes the hardware serial number of the mac making the request, and the service rejects arbitrary SNs (though valid SNs are predictable so those can be used to get iMessage working on OSX inside a VM).

If I had the free time, I'd finish reversing the protocol.

I don't have proof, but preliminary observations suggest that iMessages are, indeed, end-to-end encrypted.

http://www.csoonline.com/article/731446/fbi-highlights-imess...

http://www.macobserver.com/tmo/article/apples-imessage-encry...

http://news.cnet.com/8301-13578_3-57577887-38/apples-imessag...

[1] http://images.apple.com/iphone/business/docs/iOS_Security_Oc...


> and some anecdotal evidence that they don't (a new device brought online will receive messages from before it was initialized, for instance

I haven't seen that behavior, but it could be explained the messages being encrypted to a per-AppleID-key which is encrypted to each device's key. Time permitting I'd really like to learn more about the specific architecture.

I'd like to believe that Apple would build, at least initially, a system that's as secure as possible from snooping, waiting only until mandated by the feds to backdoor it with key escrow. Maybe I'm too idealistic. In either case I don't talk about anything sensitive on iMessage.


I just tried that and I didn't receive old messages. My guess is people who noticed this used iCloud Backup, restored the new device and once they logged in to the iMessage account, the Messages App showed the existing messages restored from the backup.


iMessage is not Free software so it can always be wiretapped




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: