News for hackers. Stuff that matters.
Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by msh on Monday July 19, 2021 @11:07AM (#27883457)
Then you could just as well get a iPod touch or iPad mini.
Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by sneak on Monday July 19, 2021 @11:15AM (#27883552)
Neither of those has a vibrate motor to let me know about notifications. They also can't be used to pair to an Apple Watch.

I know this because I used to carry an iPad Mini in my pants pocket.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @11:16AM (#27883559)
Then buy an iPhone, and turn off iCloud Backup in Settings, it's not hard to do. Then your iMessages are fully E2E Encrypted.
Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by sneak on Monday July 19, 2021 @11:17AM (#27883566)
Nope, because they get escrowed by the other end of the iMessage conversation.

Also, the whole point of disabling iMessage (in this thread) is to close the iMessage-related zero click exploits described in TFA.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @11:21AM (#27883624)
The other end of the conversation escrows the key on any messenger. Otherwise how would you read the message? Unless you consider Snapchat, but that's not End to End Encrypted.

And are you really sure that Signal or your preferred messengers don't also have Zero-Click exploits? After all, they aren't sandboxed to the degree iMessage is with BlastDoor.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by Dah00n on Monday July 19, 2021 @12:38PM (#27884567)
>"BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"

https://twitter.com/billmarczak/status/1416801514685796352

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @12:49PM (#27884723)
Except that almost every other secure messenger is guilty of the same thing. And they don't sandbox at all, whereas BlastDoor at least tries to.
Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by Dah00n on Tuesday July 20, 2021 @06:36AM (#27892085)
Really? I have never heard of any "extremely complex and buggy parsing" done by other clients. Do you have a link to info on that?
Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by sneak on Monday July 19, 2021 @11:49AM (#27883944)
Snapchat claims to be end to end encrypted, last I looked.

Signal does not escrow endpoint keys in an iCloud Backup, so your first statement is incorrect.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @12:01PM (#27884089)
This is false. Snapchat has "snaps" protected, but text messages and group messages are not end to end encrypted.

Also, Signal putting your escrow keys in iCloud? I don't think you know what you are talking about. You can set iMessage to not put your keys in iCloud like I said above by turning off iCloud Backup which makes it fully End-to-End with your own key on your device, just like Signal.

If you are worried about the other party having their conversations being backed up, tell them to disable iCloud Backup. If you are this worried about the privacy of your communications, hopefully the other party would be as well.

And Signal and any other E2E messenger is absolutely storing copies of your key on the recipient's phone, just like iMessage would. If it didn't, there'd be no way to verify that a message was sent from the same sender.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by tialaramex on Monday July 19, 2021 @12:52PM (#27884751)
Signal doesn't need keys for the messages you previously received. You received a message from Jim, it's received, done, no need to retain keys to decrypt the message from Jim.

You might be thinking, "But what about the next message from Jim?" but that message is encrypted with a new key so the previous key isn't useful, your Signal works out what that key will be and remembers it until it receives a message from Jim.

It's a ratchet, you can go forwards but you can't go backwards, if I didn't keep the message Jim sent me last week then even though you've got the encrypted message, and I've still got a working key to receive new messages, we can't work back to decrypt the old message.

You might also be thinking, "There must be a long term identity key so that I can tell Jim and Steve apart?". Indeed there is. But Signal doesn't use this to sign messages since that's a huge security mistake, instead this long term identity key is used to sign a part of the initial keys other parties will use to communicate with you.

This design deliberately means you can't prove to anybody else, who sent you anything or what they sent. Sure, you can tell people. You can dish the dirt to your spouse, your friends, the Secret Police, but you can't prove any of it cryptographically.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @01:05PM (#27884919)
You are trying to say that iMessage does not have forward secrecy.

That's true, and is a perfectly legitimate reason to use Signal.

I'm saying that the OP was dissing iMessage because of the Pegasus zero-click exploit, and was saying that switching to Signal gives zero guarantees of protecting you from that, because it likely has it's own zero-click exploits, especially because it doesn't attempt to sandbox unlike iMessage does with the flawed BlastDoor.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by Dah00n on Monday July 19, 2021 @12:44PM (#27884666)
>You can set iMessage to not put your keys in iCloud like I said above by turning off iCloud Backup which makes it fully End-to-End

"Fully" smells like a weasel word here. Either it is E2EE or it isn't. iMesssage isn't by default from what you are saying and if it requires the other end to also turn off icloud backup before it is E2EE then I'd go as far as stating that it is a completely useless attempt to be E2EE. In fact I'd argue Apple is full of sh*t if they actually ever stared that it is E2EE (but I have no idea if they did).

Comparing Signal to such a mess is... well at a minimum it is disingenuous.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @01:01PM (#27884868)
It's not a weasel word.

The messages are fully end-to-end encrypted, we know that, the EFF has stated as such. However, iCloud Backup means copies of your messages that arrived after the end-to-end process are backed up online. For most people who buy iPhones, having their messages not be permanently lost if their phone is stolen is a fair trade. If you don't want copies of your messages backed up after they arrived through the end-to-end encryption process, then turn it off.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by smoldesu on Monday July 19, 2021 @12:28PM (#27884459)
...or I could just use a truly-secure option that doesn't destroy my personal security model. Owning an iDevice presents a considerable security risk to my current setup.
Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @12:33PM (#27884512)
There is no such thing as a "truly-secure option." As anyone truly concerned about security will tell you.

You will be forced to make compromises somewhere unless you want to live under a rock in the desert. You can't drive without a State ID, can't get a home loan without credit, can't work without a Social Security Number except under limited circumstances, can't make money without reporting to the IRS, and so on. It's entirely about what compromises you want to make, and the tradeoffs therein.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by sneak on Monday July 19, 2021 @12:41PM (#27884632)
> can't work without a Social Security Number except under limited circumstances

Something like 96% of human beings don't have a social security number. Many of them work.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by gjsman-1000 on Monday July 19, 2021 @12:51PM (#27884746)
Like the nation you live in doesn't have its own Tax Authority with information on you, and doesn't have its own ID Number you need to use for working.

The technicals are different, the point is the same.

Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by smoldesu on Monday July 19, 2021 @01:57PM (#27885439)
I don't count on a "truly secure" option existing, I just manage my risk by reducing the amount of Big Tech thumbs in my personal pie. Apple, much like Amazon, Microsoft and Facebook, have no right to any of my personal information, end of story.
Re:iMessage, Apple Music used by NSO Pegasus to attack journ... by nobodylikeme on Monday July 19, 2021 @12:15PM (#27884261)
I just wanna know how big are your pants pockets