News for hackers. Stuff that matters.

A comment on Signal app downloads spike as US protesters seek message encryption. Parent comment

Re:Signal app downloads spike as US protesters seek message ... by Nextgrid on Thursday June 04, 2020 @11:03PM (#23424636)
Key management is still centralized and controlled by Apple, so they can still MITM communications by messing with the key exchange.

iCloud backups (enabled by default) are not end-to-end encrypted.

So while it's technically E2E, in practice you get very little protection from it because it's broken by design.

I still use iMessage because of the user experience, but let's not be fooled by their misleading E2E claims; it's all just marketing BS.

[ Parent | on HN ]
Re:Signal app downloads spike as US protesters seek message ... by ciarannolan on Thursday June 04, 2020 @11:06PM (#23424659)
If both parties disable iCloud on their phones, does Apple have any way to read messages sent via iMessage?
[ Parent | on HN ]
Re:Signal app downloads spike as US protesters seek message ... by frisco on Thursday June 04, 2020 @11:27PM (#23424799)
We have no idea and there’s no real way even in principle for us to know.
[ Parent | on HN ]
Re:Signal app downloads spike as US protesters seek message ... by Nextgrid on Friday June 05, 2020 @12:16AM (#23425020)
They can still pull off an MITM attack by sending the MITM’s keys (pretending to be the other user’s keys) because they control they key exchange.

It’s an active attack and can’t apply retroactively but within these constraints they can still do it.

[ Parent | on HN ]
Re:Signal app downloads spike as US protesters seek message ... by sneak on Friday June 05, 2020 @03:52AM (#23426064)
Yes, if they add a wiretapping key to one or both of your key lists, which is silent/invisible to the sender.
[ Parent | on HN ]