News for hackers. Stuff that matters.

A comment on Android 10. Parent comment

Re:Android 10 by viraptor on Tuesday September 03, 2019 @07:39PM (#20872514)
The key has to be generated either in the app or on some server. There are no other choices really, unless you use only ephemeral keys - and that gives you secrecy but doesn't validate the other side. (And you can still copy that key) WhatsApp is e2e on all devices since 2016 and uses open whisper, which is the same encryption as signal.

Regarding the key - you have to trust the app it doesn't share it with the app authors. That's regardless of who/how implements the encryption. And it's true for iMessage as well.

[ Parent | on HN ]
Re:Android 10 by dkonofalski on Thursday September 05, 2019 @01:51PM (#20889167)
>it's true for iMessage as well

Are you sure about that? I was under the impression that, according to the security white paper released by Apple, that the key is generated on-device in the Secure Enclave and that Apple never has access to it. The Enclave itself also doesn't have network access so there's no way for that to be transmitted anywhere by any other means except for physical access, which is also limited in the hardware.

[ Parent | on HN ]
Re:Android 10 by viraptor on Sunday September 08, 2019 @04:34PM (#20913243)
You still have to trust the app to use the secure enclave and not generate the key in standard code.
[ Parent | on HN ]
Re:Android 10 by dkonofalski on Monday September 09, 2019 @11:44AM (#20919208)
iMessage does that, though. This has been verified by the jailbreak community and the netsec community.
[ Parent | on HN ]