Tangentially related, if you use iMessage, I’d recommend you switch to Signal.
text below from a hackernews comment:
Gonna repeat myself since iMessage hasn’t improved one bit after four years. I also added some edits since attacks and Signal have improved.
iMessage has several problems:
- iMessage uses RSA instead of Diffie-Hellman. This means there is no forward secrecy. If the endpoint is compromised at any point, it allows the adversary who has
a) been collecting messages in transit from the backbone, or
b) in cases where clients talk to server over forward secret connection, who has been collecting messages from the IM server
to retroactively decrypt all messages encrypted with the corresponding RSA private key. With iMessage the RSA key lasts practically forever, so one key can decrypt years worth of communication.
I’ve often heard people say “you’re wrong, iMessage uses unique per-message key and AES which is unbreakable!” Both of these are true, but the unique AES-key is delivered right next to the message, encrypted with the public RSA-key. It’s like transport of safe where the key to that safe sits in a glass box that’s strapped against the safe.
- The RSA key strength is only 1280 bits. This is dangerously close to what has been publicly broken. On Feb 28 2023, Boudet et. al broke a 829-bit key.
To compare these key sizes, we use https://www.keylength.com/en/2/
1280-bit RSA key has 79 bits of symmetric security. 829-bit RSA key has ~68 bits of symmetric security. So compared to what has publicly been broken, iMessage RSA key is only 11 bits, or, 2048 times stronger.
The same site estimates that in an optimistic scenario, intelligence agencies can only factor about 1507-bit RSA keys in 2024. The conservative (security-consious) estimate assumes they can break 1708-bit RSA keys at the moment.
(Sidenote: Even the optimistic scenario is very close to 1536-bit DH-keys OTR-plugin uses, you might want to switch to OMEMO/Signal protocol ASAP).
Under e.g. keylength.com, no recommendation suggest using anything less than 2048 bits for RSA or classical Diffie-Hellman. iMessage is badly, badly outdated in this respect.
- iMessage uses digital signatures instead of MACs. This means that each sender of message generates irrefutable proof that they, and only could have authored the message. The standard practice since 2004 when OTR was released, has been to use Message Authentication Codes (MACs) that provide deniability by using a symmetric secret, shared over Diffie-Hellman.
This means that Alice who talks to Bob can be sure received messages came from Bob, because she knows it wasn’t her. But it also means she can’t show the message from Bob to a third party and prove Bob wrote it, because she also has the symmetric key that in addition to verifying the message, could have been used to sign it. So Bob can deny he wrote the message.
Now, this most likely does not mean anything in court, but that is no reason not to use best practices, always.
-
The digital signature algorithm is ECDSA, based on NIST P-256 curve, which according to https://safecurves.cr.yp.to/ is not cryptographically safe. Most notably, it is not fully rigid, but manipulable: “the coefficients of the curve have been generated by hashing the unexplained seed c49d3608 86e70493 6a6678e1 139d26b7 819f7e90”.
-
iMessage is proprietary: You can’t be sure it doesn’t contain a backdoor that allows retrieval of messages or private keys with some secret control packet from Apple server
-
iMessage allows undetectable man-in-the-middle attack. Even if we assume there is no backdoor that allows private key / plaintext retrieval from endpoint, it’s impossible to ensure the communication is secure. Yes, the private key never leaves the device, but if you encrypt the message with a wrong public key (that you by definition need to receive over the Internet), you might be encrypting messages to wrong party.
You can NOT verify this by e.g. sitting on a park bench with your buddy, and seeing that they receive the message seemingly immediately. It’s not like the attack requires that some NSA agent hears their eavesdropping phone 1 beep, and once they have read the message, they type it to eavesdropping phone 2 that then forwards the message to the recipient. The attack can be trivially automated, and is instantaneous.
So with iMessage the problem is, Apple chooses the public key for you. It sends it to your device and says: “Hey Alice, this is Bob’s public key. If you send a message encrypted with this public key, only Bob can read it. Pinky promise!”
Proper messaging applications use what are called public key fingerprints that allow you to verify off-band, that the messages your phone outputs, are end-to-end encrypted with the correct public key, i.e. the one that matches the private key of your buddy’s device.
- iMessage allows undetectable key insertion attacks.
EDIT: This has actually has some improvements made a month ago! Please see the discussion in replies.
When your buddy buys a new iDevice like laptop, they can use iMessage on that device. You won’t get a notification about this, but what happens on the background is, that new device of your buddy generates an RSA key pair, and sends the public part to Apple’s key management server. Apple will then forward the public key to your device, and when you send a message to that buddy, your device will first encrypt the message with the AES key, and it will then encrypt the AES key with public RSA key of each device of your buddy. The encrypted message and the encrypted AES-keys are then passed to Apple’s message server where they sit until the buddy fetches new messages for some device.
Like I said, you will never get a notification like “Hey Alice, looks like Bob has a brand new cool laptop, I’m adding the iMessage public keys for it so they can read iMessages you send them from that device too”.
This means that the government who issues a FISA court national security request (stronger form of NSL), or any attacker who hacks iMessage key management server, or any attacker that breaks the TLS-connection between you and the key management server, can send your device a packet that contains RSA-public key of the attacker, and claim that it belongs to some iDevice Bob has.
You could possibly detect this by asking Bob how many iDevices they have, and by stripping down TLS from iMessage and seeing how many encrypted AES-keys are being output. But it’s also possible Apple can remove keys from your device too to keep iMessage snappy: they can very possibly replace keys in your device. Even if they can’t do that, they can wait until your buddy buys a new iDevice, and only then perform the man-in-the-middle attack against that key.
To sum it up, like Matthew Green said[1]: “Fundamentally the mantra of iMessage is “keep it simple, stupid”. It’s not really designed to be an encryption system as much as it is a text message system that happens to include encryption.”
Apple has great security design in many parts of its ecosystem. However, iMessage is EXTREMELY bad design, and should not be used under any circumstances that require verifiable privacy.
In comparison, Signal
-
Uses Diffie Hellman + Kyber, not RSA
-
Uses Curve25519 that is a safe curve with 128-bits of symmetric security, not 79 bits like iMessage.
-
Uses Kyber key exchange for post quantum security
-
Uses MACs instead of digital signatures
-
Is not just free and open source software, but has reproducible builds so you can be sure your binary matches the source code
-
Features public key fingerprints (called safety numbers) that allows verification that there is no MITM attack taking place
-
Does not allow key insertion attacks under any circumstances: You always get a notification that the encryption key changed. If you’ve verified the safety numbers and marked the safety numbers “verified”, you won’t even be able to accidentally use the inserted key without manually approving the new keys.
So do yourself a favor and switch to Signal ASAP.
[1] https://blog.cryptographyengineering.com/2015/09/09/lets-tal…
Wow.
I think it would help to summarize the major issue with iMessage and have it at the top.
The RSA encrypting the AES with the message content is so face-palmingly bad that you really don’t need to read any further, and thd rest is just more evidence of issues.
Well done. I had no idea. Saving your summary, because it’s so staggering. Wish I could upvote you a hundred times. This is a huge issue.
We literally know that the FBI at one point was unable to break into an iPhone, and then a few days later was able to break into it. Apple clearly let them in the back door after negotiating the condition that they could deny and act all upset about it.
And then they launched a whole privacy - focused marketing campaign immediately afterwards. It’s all laughable transparent, yet you still have moronic pop-security YouTubers repeating that bullshit that Apple is a secure platform.
Um no, the FBI used software developed by an Israel based company to hack into it. This is well documented. Isreal has been creating and selling iPhone hacking software to nation states for years. They also sold out to the Saudi’s who used to it to track and kill the American resident Jamal Khashoggi.
Your right, I don’t think those Israel companies got a backdoor from apple. A “magic packet” backdoor is too hard to hide into the code and would tank their trust FAST. However, They do encrypt the system files to prevent reverse engineering. iPhones then have enough bad practices (see: the IMessage post) (some of them oddly specific) to make a software developer cry in the corner. Incompetence, UX tunnel vision or intentional flaws. (honestly I don’t know the answer)
I know, right?
Unfortunately ignorance of the masses (myself included, and I try to stay current) let’s them get away with this stuff.
Too many people say “well, I don’t do anything wrong, so why be concerned”, as if people have never been railroaded before (Ruby Ridge anyone?).
Seeing the kind of data I know is known about me is terrifying, and I’ve been working for years to reduce it. My current effort is a final degoogle.
Messaging is a tough one to crack, people still use SMS as much as I hate it.
I wouldn’t really classify Ruby ridge as a rail-roading.
This is a guy who uprooted his family to move across the country so he could hang out with terrorists who shared Hitler-loving beliefs.
He then sold a sawed off shotgun to a man he believed was one of those terrorists.
We can definitely criticize law enforcement for every single they did from the inception of the case, but Weaver was not innocent.
In iOS 13 or later and iPadOS 13.1 or later, devices may use an Elliptic Curve Integrated Encryption Scheme (ECIES) encryption instead of RSA encryption
(from apple docs).
If you’re curious about it all, I’d suggest studying some notes from the protocol researchers instead of taking to the pitchforks immediately. Here’s one good post on the topic.
No way governments spying on their own people I could never believe such an act would be tolerated.
What about whatsapp? Is that secure?
Security rarely comes in absolutes. Whatsapp doesn’t appear to be open source. That alone makes it security wise a worse choice than Signal.
Anything made by Facebook is the worse alternative.
That’s another viewing angle coming to the same result :)
But even before Fcbook purchased Whatsapp, it’d have been the worse choice than Signal.
Nowadays Whatsapp is a very bad choice in a lot of ways except for network effect, which is the only real strength of it.
Speaking of network effect: back when Signal was TextSecure, I could message a total of 2 (two!) contacts with it and the UX was far from being awesome.
Signal has come a long way. The UX is great and I can message a lot of my contacts on Signal now.The homies are all on Signal now, everyone else is on iMessage. It’s been a struggle, but we are getting there.
Nobody knows, because it is closed source. It migjt be, but it might just as well not be. Best to use Signal.
lol is Facebook secure?
Thanks for bringing that info here. I was already using Signal but I was concerned about their approach to notification security when I read this news this week.
Here’s some info I found on the reddit Signal sub, not verified but just comments:
*All that goes through the Google or Apple push notification systems is “you’ve got a push notification.”
It’s up to your Signal app to then wake up, contact Signal’s servers, and see what the notification was. Message content and sender identity never pass through Google/Apple push infrastructure.
*Signal does not use google notification system is my understanding.
For apps that do, google only gets metadata, that is not content of the message.
2nd comment is not quite right, it does use the google notification system if you install it from the Play store. You can avoid that by installing the APK downloaded from the Signal site.
Metadata that is unencrypted could include things that identify who the message is to or from, and the timestamps of the messages. Seems like we can only be sure the content of messages is secure, but not the metadata. >
The data is said to have been used to attempt to tie anonymous users of messaging apps to specific Apple or Google accounts.
So it’s not about the notifications or even necessarily the data the app handles; just that there’s an apple ID or google ID they’re pinging to see who it is.
Today’s lesson is: Never use your apple ID or (ugh) google ID for anything important. If you can not use either for anything, great, but we all know we’re not international super spies and sometimes you just want to play a card game or something. Still. If someone’s unaware that smartphones are tracking devices they should probably know that now.
I’m amazed that Apple was prohibited from saying anything until now.
Just because we’re not James Bond today, doesn’t mean we won’t be a person of interest tomorrow.
That’s what’s so dangerous, especially for stuff that’s just collected for no particular reason. Look at the man who was arrested for a crime simply because he biked through the area during the right time, and his Google location history showed up in a search.
Look at the man who texted photos of his son’s genitalia to said son’s doctor and got his entire Google account banned when his phone automatically synced them to Gdrive and the algorithm decided he was a pedophile
I don’t know if that’s a great example tbh. How does Google know it’s a medically necessary picture of a child’s genitals? Just don’t do that. Don’t send anyone pictures of your kid’s junk. Or anyone’s junk for that matter, except maybe your own if you really want to. Certainly not over unencrypted channels. That seems very obvious to me. If your kid’s dick is falling off, go to the ER
You missed the point of the examples.
They’re cases of people who did nothing wrong but none the less found themselves in trouble because they didn’t appreciate how their privacy was being invaded. You can argue about the merits of invading one’s privacy to look for child porn, but it is an invasion of privacy, and it’s one that a tremendous amount of people are complete unaware of.
That man presumed his phone was secure, and presumed the channel to his doctor was secure. So he sent sensitive images believing the only people that would see them would be the recipient, a licensed medical professional who presumably asked for or at least expected the photos. If what he believed had been true, there’d be no story.
He didn’t realize that his photos were synced to g-drive, and he didn’t appreciate that images backed up to a cloud are not private, and that no matter what the context, those images would trigger a response. These are all things they were ignorant of until it was too late.
The larger point is that he is not alone. A lot of people truly don’t appreciate just how much information of theirs is out there on somebody else’s computer, and they do not have the knowledge or the imagination to know how much trouble they could be in one day.
not sure how it works on iOS, but at least on Android Signal has been taking some extra measures to avoid that. the message contents aren’t delivered over GCM, just the ping that there’s a new incoming message, which is then downloaded by Signal separately.
That’s kind of how iMessage works, the Apple equivalent to GCM (Google Cloud Messaging) is called APN (or is it ANP? I always forget), and it sends a notification to the phone which then retrieves the message.
Be interesting to hear the perspective of the developers of Bubble Mini, since they just reverse-engineering iMessage.
Anyone who thinks Apple is private is getting fucked balls deep by marketing at face value.
How do those governments have access to this data? Is it not TLS encrypted?
The article states that Apple recommends not putting any sensitive data in the payloads as well as encrypting the payloads
This sounds a lot like a scenario where Apple informs that a mechanism used for standard mobile communication is being survived by governments not necessarily a scenario where something Apple or google are doing is inherently surveillance.
Here it seems like the surveillance is occurring at the 3rd parties who send the push notifications.
deleted
Right?
First they get location data because cell towers and people not caring.
Then they notice all these message notifications between these dozen people at this time, at this location, that happens to coincide with a protest.
Ding, fries are done!
Apple would be able (and perhaps required?) to provide the decrypted data. TLS is not end-to-end encryption; it’s just server-to-client. It’s useful to prevent MITM wiretapping but it is NOT useful to prevent server-side spying.
The article quotes Apple as saying they can update their transparency report now that this is public. Doesn’t look like they have data for 2023 yet at https://www.apple.com/legal/transparency/
I’d think Apple could make push notification content end-to-end encrypted if they so desired, but I don’t know how they could avoid having access to the vendor and user at minimum for the sake of validation and delivery.
To turn that question around, what incentive do the corporations have to encrypt that data? Whole bunch easier to just not care.
Good time to switch to an open source degoogled android ROM and set up your own push notification server.
Until people stop giving up their freedom to these companies by agreeing to legal documents they don’t even read, it’s only going to get worse.
I agree those are good things to do.
But… Blaming people who are being fucked over by forces generally outside their control is not really going to help their or our situation. Expecting or demanding “people” to just change is also not realistic. Even if they wanted to, time, effort, energy, knowledge, skills, and attention are all finite. This is just one important issue or source of exploitation among a sea of others.
Lol you’re dreaming if you think even 0.1% of people will be interested in setting up their own server.
They’re also dreaming if they think doing these things doesn’t just make them stand out, and provides them any real protection from state actors.
The number one rule of tradecraft is to blend in. I promise that you haven’t thought of some way of using an always connected smartphone that the NSA hasn’t considered. They are probably the ones making your degoogled ROMs.
This is hubris, plain and simple. If your goal is to hide from state actors then the best way of doing that is to be uninteresting statistical noise.
deleted
Most “standard” messaging apps (that includes signal, telegram) use the “OS provided” push service. On Android, they use firebase cloud messaging, a component of google play services.
Degoogled Android means not having any notifications, unless the app supports UnifiedPush, runs in the background 24/7 (which drains battery), or runs in the background occasionally (which delays notifications).
If the app runs in the background occasionaly, you can “burden” the people on the other side by being slow to respond.
Eh, I use a few apps that have true foss forks and thus don’t use gcm but the keep-alive method, and I didn’t notice a difference in battery when I made the switch.
Also lol #3 isn’t exactly a “burden”, take the hint and go away people. Let me live in blissful solitude.
It also means you will be on a very short list of people who use Unified Push.
Well I’d say those going the degoogle route learn about things like Unified, NLP, etc, along the way. But it is something the end user has to handle themselves, rather than it just being there in the OS.
That’s why I bothered to set up a nixOS config to deploy a docker cluster… I’m planning to give my friends and family a USB that connects to a private shared VPN, so all I have to do is walk them through booting from it
We all get a way to back up stuff with redundancy, and I’ll throw up a Jellyfish server, maybe set up some llm assistants to scrape the web for interesting news and put it in a Lemmy instance or something. These are all things I want for myself, and I am willing to configure it exactly once… At that point, might a well let people I trust join the cluster.
Even my technical family used to scoff and ask why bother… This last week when my sister called and asked what I was up to, instead of explaining that it’s more than just targeted ads, I asked if they noticed that everything sucks way more lately.
They never used to listen before… I think that’s changing. I think it’s time to build out alternatives
It’s not so difficult actually. If you already use Conversations from F-Droid you can use your XMPP address to receive push notifications for example.
Let me just tell my dad next time he can find the Skype icon on his taskbar so I can call him.
One interesting point is that some aspects of Linux are actually really good for people who struggle to learn new things as a lot of things on Linux are very consistent, and don’t feel the need to reinvent the wheel every few years like Microsoft.
Because anyone with older relatives or tech illiterate friends knows the fear of a looming new Windows release on having those people suddenly be asking us how to do basic things like change the WiFi network due to Microsoft changing it again.
And for some strange reason young people somehow getting a sense of superiority due to the fact they were able to find the new menu before their parents that was perfectly good before Microsoft changed it again.
Yeah, I was a believer of Linux on the desktop back in 2003-2005, but there’s no way I could have converted my dad.
Which is why I don’t update machines till they die. If it works, don’t mess with it.
I’m so tired of MS moving stuff around.
Lol.
Is there a self-hosted alternative to SMS push? That’s my main push notification, I can’t think of another “service” I use on my phone. I’m an edge case though, already degoogled and don’t let much push to me. SMS is a necessity for work and personal.
Hell, SMS is clear text, no need to get the notifications.
This issue is about the notifications for (supposedly) encrypted chat apps hat use Apples notification service (and Google’s) such as iMessage, Telegram, WhatsApp, etc.
iMessage is supposed to be encrypted? I had no idea.
Sounds just like the idea that governments can retrieve metadata from phone calls without much hassle.
I’m not sure there is much you could do to get around this on iOS besides disabling push notifications in your app.
Removed by mod
Here is an alternative Piped link(s):
https://piped.video/rLXWqdry3Qc?si=LItEsEzrkK2DTL2D
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
pRiVaCy. ThAt’S iPhOnE
deleted by creator
I’m more worried that Apple had data to give up at all, what with them talking big game about not doing that.
With an Android phone I can use a deGoogled ROM and have complete knowledge and control over all data going in or out and where it’s coming from. With an iPhone, I just have to trust that Apple has my best interests at heart and takes as many steps as they are legally allowed to to prevent things like this happening. Their entire business model is dependent on people believing that that is the case, hence the high profile FBI snafu a few years back. We have just received irrefutable proof that this is not true.
See also Signal cooperating with the FBI and giving them absolutely jack shit because by design they don’t know anything about their users.
While, yes, it’s fucked that Apple in Google know about this it’s not really a bother to me if the government is aware that Killers of a Flower Moon is now available on Apple TV+ for streaming, and that there were excellent black Friday deals at the Home Depot. If the government is particularly bothered my latest GrubHub delivery, that’s fine, but I don’t care that they know. 
Saying you don’t need freedom of privacy because you have nothing to hide is like saying you don’t need freedom of speech because you have nothing to say.
Funny, I don’t remember saying that. Perhaps you can quote where I said that.
Cool we’ll some people don’t want to have their private information unwillingly shared with anyone much less the government.
What does that have to do with me?
About as much as your original comment has to do with the topic at hand.
Oh, really. Explain that then.
No
Removed by mod
What is bullshit?
