https://github.com/JJTech0130/pypush/blob/main/albert.py#L16
Hint for any developers out there not seeing the problem: “private” isn’t just a word.
This is “public”!
Edit for the downvoters: please use your words to explain how publishing a private key makes the slightest bit of sense.
If the private key is public, it does nothing by definition and it may as well not exist!
Just use plain text, HTTP, or whatever and stop fooling yourself.
It’s like calling an open field a “secure facility”.
The name is not the thing, the map is not the territory.
Private keys are only private if they’re not public.
Get it? Get it?
Nobody is surprised that Apple is able to revoke this key, by the way.
https://news.ycombinator.com/newsguidelines.html
Edit: it looks like we've had to warn you about this multiple times before:
https://news.ycombinator.com/item?id=32039759 (July 2022)
https://news.ycombinator.com/item?id=27225044 (May 2021)
https://news.ycombinator.com/item?id=22938445 (April 2020)
https://news.ycombinator.com/item?id=21808005 (Dec 2019)
We have to eventually ban accounts that keep breaking the rules like this. I don't want to ban you, so if you'd please review them and stick to them from now on, we'd appreciate it.
Unfortunately, nobody else seems to either, which is why my comment is getting downvoted.
"Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence.
It doesn't matter who's key it is, how it was generated, how it was obtained, etc...
The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks.
Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.
> A published private key by definition is worthless.
If I publish the AACS _private_ key, is it now worthless?
Public-private key pairs only work if the private key is secret. If it’s not secret it doesn’t work.
This is a simple fact of how cryptography works. Or passwords, keys, or any secret like an API key, etc…
If you publish such things on GitHub, they instantly become “not what you’ve labelled it as”.
So you admit it's not completely worthless at that point only for specific use cases.
So we've established that a "private key" that is no longer private may still have uses to some people, it is not wholly "worthless."
Do you want to revise your earlier statement about the private key in the repo in question? Is it "worthless"? Is it a security problem? Do you know what that key is being used for?
From what I gather, the private key was private until it was leaked to / stolen by the team who published it for this use case.
I don't have enough context to say, because I have to admit that once published, the keypair corresponding to the private key is likely to be revoked/discarded.
That's precisely it! Publishing a private key -- anyone's -- invalidates the security of the private-public key pair, making it worthless as security.
There's going to be some consequence to this, such as the third party "changing the locks" and locking out you, or your users.
Similarly, it might allow hackers to intercept the comms, break into your code, or whatever.
The essential, fundamental point I'm trying to get across here is that it never ever makes sense to publish a private key, and then rely on it for any purpose.
I guess it would have been more difficult for Apple to find the key/device ID used in this scheme had these not been available on the first few pages linked by a lot of articles claiming iMessage is broken.
Had this not been publicly posted, someone would've been forced to at least open a log file.
This could have been blocked in minutes. The delay was likely to get approval from Legal.
Hmm, wouldn't blocking IPs be overly broad and risked affecting regular users? Considering that IPs are scarce and constantly recycled by ISPs etc. Blocking device identifiers sounds more targeted and, for that reason, realistic.
So your point is Apple can presumably distinguish between an actual iOS connection and Beeper's connection by looking at "how many connections per IP"? Still seems prone to false positives to me, unless there is something else I missed.
(Upon re-reading the post, I realized that the phone number registration is actually done by Apple. Wonder if this might provide another basis to block Beeper, i.e. all this SMS infrastructure is not cheap to maintain and Beeper's integration is arguably using it in an "unauthorized" way.)
They don't need to break it completely. If Beeper is unreliable, nobody is going to pay for it.
The amount of legitimate users it would affect would be trivial and can be taken care of by customer support.
The benefit of that is that I can then, at that point, verify if we’re dealing with a legitimate device or not. Geniuses at Apple Stores can obviously do this physically, and remote support has the option to run remote diagnostics and even share screens.
Otherwise the IP Apple sees is those of the individual handsets on whatever network they are on.
It's pretty likely that they blocked Mini based on the IDS (Identity Service) which requires the device to pass it's hardware model, serial number, and disk UUID as described elsewhere.
The word "monopolist" in 2023 seems to mean "a company whose corporate values are different than my personal ones and/or whose pricing and packaging don't match my consumption function and/or who has a lot of money and of whom I am jealous".
You can say iMessage isn't a texting app because iMessage functionally (as in, the technical details) works like a non-texting app, but it is the only texting app on those phones and is the way normal texting is done. Perhaps it would be different if iMessage was just installable from the app store.
I understand that the distinction might seem slight, but in the eyes of most US consumers, texting is distinct from a chat app that you download from an app store even if it uses your phone number.
The absolute one way that everyone with a phone has to send a textual message to another person is to text them with their phone number.
In the US, where adoption of Signal, Whatsapp, Discord, or insert hundreds of other apps is very small, the percentage of your real world contacts using a particular app is also extremely small. Convincing all of them to use Signal would certainly be great, but in reality you will be using all of those apps if you are trying to escape the interoperability nightmare that is currently texting.
Given that everyone has a phone and they are all texting already, it would be awfully nice if we could just use texting without these interoperability problems without having to manage all of the apps, and without having to remember who prefers which one.
Group texting is also hugely popular in the US. If no single third party messaging app covers the set of friends you want to group text, what do you do? You text them. Because everyone has it. Let's say when you started your group everyone was on Whatsapp. Phenomenal! Start the group on Whatsapp. Then you meet Joe, and Joe is very cool and you definitely want him in the group chat. Joe doesn't trust Meta products and doesn't want to use Whatsapp. Should Joe capitulate, install another chat app used only for a single group chat, and grant access to their device to a Meta app? Should a negotiation occur amongst the rest of the group where they select a new common app to run the group on and split the conversation history, while also adding an app that they only use for that group chat?
Let's say they choose to switch to Signal, but Josh keeps forgetting (dammit Josh) and keeps messaging the group on Whatsapp. And instead of yell at Josh that the group is on Signal now, folks reply! Because Josh's joke was super funny. Conversation also continues on Signal. Someone on Signal now does a reference to Josh's joke on Whatsapp. Joe is confused, but everyone else gets the joke. Someone realizes what happens and sends a screenshot of the joke and ensuing replies from within Whatsapp so Joe can catch up, but the messages around the joke are longer than one phone screen so there's a lot more context that he misses. Joe is annoyed but he gets over it.
A few months pass and Sandra seems to have a bug where Signal is chewing through her battery life. Since only one of her group conversations is on Signal (she uses Whatsapp mostly) and she is fine not getting the work related banter that is often the topic of the group chat. But then she finds an article that's super interesting and she wants to share it with the group. She remembers that the group moved to Signal, but who cares, that Whatsapp group still exists and there's only, like, one person that isn't in it. She sends the link in the WhatsApp group instead. This leads organically to the group wanting to get together for a holiday. They plan out that July 12th would be a perfect weekend, and since they want to do a potluck, they all choose what part of the meal they'll bring.
A few days before the potluck, someone mentions on the Signal chat that they are excited to see everyone at the potluck. Joe is very confused and asks what they mean. They realize that this was in the WhatsApp group chat and explain what everyone is bringing. Unfortunately Joe is working that weekend, and can't come.
Should the group chat reschedule?
Personally, I don't use default texting, like, at all. Except for those notification/2FA SMSes and couple of contacts, I don't ever open it. For me, mentally, chatting with people (with 2 exceptions) is done through different apps, not the built-in one. And this forms a view that default app is just "one rarely used messenger, of many".
But then, even though I'm in the US, most of my chats are international.
Nitpick, but I can text from my Mac laptop using the messages app. I haven't looked into exactly how exactly it works but I think it's somehow proxying/mirroring the messages through my iPhone. It's very smooth and "just works" though.
> interoperability nightmare that is currently texting.
How about calling it an open competitive market? Centralizing everything on a single format would be a bad thing for the industry and for consumers. Having separate independent networks with drastically different feature sets is a good thing. Trying to find the intersection feature set of Discord, LINE and Signal would result in three applications drastically hampered in their features. LINE for example has an extensive independent industry of artists selling "stamps" that you can buy.
Yes, SMS from iMessage on your non-iPhone (Mac, iPad) proxy through your iPhone. iMessages do not require your phone to be on, since Apple can deliver it directly without using SMS.
However, without a phone you cannot send an SMS message, and most people use phone numbers as contacts in iMessage, which requires an SMS based registration done transparently by your phone.
But all of this is just the technicals of how it works, to the end users it is just texting. The only reason non-technical users are even aware of, or care about, the distinction is because of how iMessage breaks group texting as soon as there's a non-iMessage user involved.
> Nitpick, but I can text from my Mac laptop using the messages app. I haven't looked into exactly how exactly it works but I think it's somehow proxying/mirroring the messages through my iPhone. It's very smooth and "just works" though.
Correct. I think the GP’s remark meant to say “…as if it was a phone, without a phone as well”.
If you’re sending or receiving an SMS from your Mac through the messages app, it absolutely depends on your phone being powered up and online, to route the message through.
But do we know why that is? In Europe everyone's on WhatsApp, and while I'm not especially fan of it, the one feature that I like is that it can be used from any browser on any device, including desktops, including a work laptop where one doesn't have admin rights to install anything, etc.
I can leave my phone away in my pocket all day and still message anyone I please. I would hate it any other way. Why don't people in the US want that?
Or FB messenger, or actually mainly use SMS/iMessage. Europe is not as homogeneous as some people here might be implying. WhatsApp is not even the most popular messaging app in quite a few countries (Messenger is).
Also in Scandinavia, Britain and Switzerland iOS is about as popular as in the US while in some other countries it’s closer to 10%.
(Well, at some point a year or two ago there was some controversy around WhatsApp, and some groups tried to migrate to Signal, but that all died out within a month -- never quite started, actually).
Believe it or not, I had almost never heard about iMessage and its specific quirks before the Beeper story (and still don't understand why the colors of the messages in green or blue matter).
> and still don't understand why the colors of the messages in green or blue matter
Because it indicates a fallback to standard SMS/text messaging which means all the more advanced features (which everyone expect messaging apps to have these days) stop working if you get a text from an Android device.
Sure, but I don’t think personal preferences matter that much in this case, most people just end up using what everyone else is whether they like it or not, which makes perfect sense.
But yeah, I think in most of Europe (not all, they were free/almost free since the late 2000s where I am) this started because SMS messages very relatively very expensive back when smartphones were becoming widespread.
Now WhatsApp, Messenger, Telegram, Viber and whatever else there is are quite entrenched so even if Apple and Google get serious about properly supporting RCS it might get tricky to get users to switch back to the default client
Popular non open-source 3rd party messaging apps don’t really have much interest in supporting interoperability due to obvious reasons.
> ..modern texting app that could message literally anyone with a phone number? Without having them download a specific app?
Well on this thread it seems that WhatsApp might be exactly that from the perspective of some people (to the extent that they don’t even believe that anyone in Europe could be using anything else)
I do want to say I've seen some others in this HN story contradict that Europe is as homogenous as your representing here though.
Still though, I looked at Germany's Whatsapp numbers and it's like 68% of the population, ignoring the fact that 1 account is not necessarily 1 person.
That's super dominant compared to the US which is somewhere around 22% with the same account assumption.
True. But it’s hard to say to what extent. Many/most people probably have multiple apps installed and use them somewhat regularly in addition to texting/iMessages.
I’m not sure what messaging standard you propose gets adopted, because the flavour du jour of most non-iMessage users is RCS, which as an open standard, is unencrypted and insecure.
I have that already via Google Messages, and iMessage already has that as well.
In the case of Google Messages, it's just a web app, you don't need to install it. You visit messages.google.com and scan a QR code from your phone and the devices are linked.
Bob has a hardon for mastadon so then another subgroup is created. Joan finds out that her Google Fi service is incompatible with RCS so she decides to create an email list. Joe finds a bug with Beeper and then decides that really everyone needs to move to ICQ. Marley decides maybe everyone should just try MMS again except that nobody can fall back on that because everyone except Joan has opted into RCS.
Apple's not going to solve your social problems (nor will any other company).
Another protocol like RCS? RCS simply solves the problems of SMS/MMS. It doesn't add another protocol, it ultimately replaces two of them.
> Bob has a hardon for mastadon so then another subgroup is created.
Good for Bob. I don't think Mastodon supports group chatting and its DM support is super nascent, its weird choice but I wish him the best.
> Joan finds out that her Google Fi service is incompatible with RCS
Even though Google Fi is definitely compatible with RCS, we can assume it isn't supported for the scenario.
> so she decides to create an email list.
Joan doesn't know what RCS is and doesn't care. Joan makes a group of people on Messages. It works fine, as it falls back to MMS automatically.
> Joe finds a bug with Beeper and then decides that really everyone needs to move to ICQ.
Wait why is anyone using Beeper here. So the user used a unifying client and ran into a bug and blamed something about the underlying messaging system?
> Marley decides maybe everyone should just try MMS again except that nobody can fall back on that because everyone except Joan has opted into RCS.
Everyone on RCS can fall back to MMS just fine, just like iMessage can. The only difference is one of these is a standard that Apple can implement and the other is a proprietary protocol that Google cannot.
It doesn't add another protocol, it ultimately replaces two of them.
Everyone on RCS can fall back to MMS just fine
Even though Google Fi is definitely compatible with RCS
More recently it looks like Google added some half assed support for RCS and broke other stuff in the process:
https://old.reddit.com/r/GoogleFi/comments/12b8k2p/reminder_...
My cell carrier provides SMS for free, both sending and receiving. My cell carrier charges for MMS, both sending and receiving, so I have MMS disabled. My cell carrier doesn’t support RCS, and would probably charge if it did.
Thankfully, nobody I know tries to send me pictures using SMS/MMS/RCS, and uses WhatsApp / Signal / iMessage instead.
> Another protocol like RCS? RCS simply solves the problems of SMS/MMS. It doesn't add another protocol, it ultimately replaces two of them.
Experience tells me this is false, and that nothing ever dies, nothing ever gets replaced, and augmentation always happens, in IT.
I don't see anyone on Android wanting to put their SMS messages in the Discord app.
> No one wants
Quite the assumption. I had Google Hangouts set as my default SMS app for a time.. this seems quite similar to your Discord example?
It hurts nobody to have the _choice_. If you don't want to change the default that's totally OK.
In everyday iPhone usage, you would either run an app directly, use sharing intents, or use a messaging service specific identifier (eg custom URI scheme) to converse with someone. The social graph is either in the messaging app itself or in individual contact entries. There's no expectation of a Trillian/Adium style app that consolidates all information and messaging options.
There’s no choice not to use iMessage or their iMessage app to send a text, except if the other person is registered to iMessage, it will use that instead.
It’s really annoying. They either need to disable iMessage or open it up as a separate app you get from the App Store.
Letting (actual) Android users use iMessage probably wouldn’t affect that, but the open source hack/reversing of it opened the door to iMessage spam that Apple, for the sake of reputation, and customer satisfaction, is obliged to close.
Anyway, I guess my point is that there are some “burdens” that are less obvious than others.
https://www.wired.com/2014/08/apples-imessage-is-being-taken...
I do know first hand that Apple will turn off (starting at several days) an Apple user’s ability to use iMessage if they get even several reports, though.
If spam is really the problem Apple is worried about, then isn't it conceivable that it happens and that Apple has to work to keep spam low so you have a good experience? Such work is ongoing and sometimes spam gets through anyway. I don't think we should assume Apple's protections on occasional spam are perfect.
What will really happen is that there will be some subpar common denominator. An existing "walled garden" (WeChat?) would add support for this as well.
But this would wind up being rather insecure, because messaging services tend to use email addresses they don't control or phone numbers they don't control as identifiers. We'd have to wait for carriers and email providers to be regulated with the burden of solving this mess (for markets they aren't in).
(for the users, not for the companies)
Although to be fair, I have a hard time imagining a world where this ever happens. So large companies have to proactively share information on all their users with all the other large companies, and vice versa? Or do I become skygazer@iMessage and everyone on instagram has to know that? This just seems like an absurd thing to mandate.
1: https://developer.apple.com/documentation/sms_and_call_repor...
This explains some things. Why wouldn't they just add a spam filter. Is there still iCloud email addresses? Do they have spam filtering?
but I don't think it's their main reason, if anything I see that argument as convenient posturing which aids in covering the uglier underlying reasons
For what it's worth Beeper Mini did support using Apple's iMessage registration system to use your phone number.
Wrong
What do you mean by above board? What they claimed is that there is no way of telling Beeper Mini clients from an old iPhone, therefore Apple wouldn't be able to block one without blocking the other.
Clearly Apple managed to find a way, and who knows if there will be some more cat and mouse happening here. In theory though, I don't see why it wouldn't be possible to have a service that's indistinguishable from an old iPhone.
Newer devices can use device attestation, but old iPhones don't have secure enclave.
https://www.telemessage.com/mobile-archiver/whatsapp-archive...
It’s literally a hacked WhatsApp binary (that logs all your messages) that they sell to corporate clients…
Snapchat as a service is no more. But there may be other options:
It's only a matter of time until that "black box" gets manually deobfuscated. Apple should waste less time on this and instead focus on algorithms that detect and stop spammers.
Using an exfiltrated binary they used its blackbox functions to perform a sort of device attestation using ripped Apple device identifiers. Clearly Apple simply needs to blacklist any device attestation that this service uses, which is obviously trivial. These aren't just RNGs they're fabricating, they're sets of legitimate Apple device data that isn't plainly evident to any random user-mode app.
Why would they block it? Every service has some sort of gate on who can message or it will be overrun by bad actors and spammers. Signal, Telegram and others make you validate your cell phone number -- there's a finite number of those, and they can blacklist them as necessary. Online services make you validate an email, do bot checks, etc. Beeper, and more importantly the technique they used, offers none of those gates. It was a plainly problematic free for all that was guaranteed to be closed.