I love how they have the private key in plain text on GitHub.

Hint for any developers out there not seeing the problem: “private” isn’t just a word.

This is “public”!

Edit for the downvoters: please use your words to explain how publishing a private key makes the slightest bit of sense.

In this case it makes sense, the key is a "private key" in the cryptographic sense, but it's not "private" in regards to the pypush app, it's needed for the app to work, so it needs to be public information or else the app would be useless for anyone who didn't have that key.

Because "private" here is regarding the cryptography and not regarding the disclosure? How are users supposed to obtain this key to use the service without it being published?

“How can people get into my locked door if I don’t tape a key to it for them to use?”

If the private key is public, it does nothing by definition and it may as well not exist!

Just use plain text, HTTP, or whatever and stop fooling yourself.

It’s like calling an open field a “secure facility”.

The name is not the thing, the map is not the territory.

Private keys are only private if they’re not public.

You're not sharing the key to your house, you're sharing the key to one of the biggest skyscrapers in the world.

And now everyone is up in arms that they changed the locks.

Get it? Get it?

This is a private key to access Apple's service for a proof of concept. How is someone without access to an Apple device going to obtain such a key without it being distributed somehow?

Nobody is surprised that Apple is able to revoke this key, by the way.

Please make your substantive points without swipes (like "What are you talking about" and "your schtick"), no matter how bad another comment is or you feel it is.

https://news.ycombinator.com/newsguidelines.html

Edited.

Can you please not post in the flamewar style? It's not what we're going for here, and you can make your substantive points without that.

https://news.ycombinator.com/newsguidelines.html

Edit: it looks like we've had to warn you about this multiple times before:

https://news.ycombinator.com/item?id=32039759 (July 2022)

https://news.ycombinator.com/item?id=27225044 (May 2021)

https://news.ycombinator.com/item?id=22938445 (April 2020)

https://news.ycombinator.com/item?id=21808005 (Dec 2019)

We have to eventually ban accounts that keep breaking the rules like this. I don't want to ban you, so if you'd please review them and stick to them from now on, we'd appreciate it.

This isn't about taping a key to _your_ front door—you're taping a key to Apple's.

Yea, and like anyone who found out that someone taped the key to their door to their door, they changed the locks, and now everyone's mad at them.

In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people of that age

Perfectly understandable, at that age I only had the vaguest notion of how cryptography works.

Unfortunately, nobody else seems to either, which is why my comment is getting downvoted.

"Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence.

It doesn't matter who's key it is, how it was generated, how it was obtained, etc...

The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks.

Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.

Your understanding in of cryptography appears to be "private means private"

> A published private key by definition is worthless.

If I publish the AACS _private_ key, is it now worthless?

Yes! It becomes worthless for copy protection.

Public-private key pairs only work if the private key is secret. If it’s not secret it doesn’t work.

This is a simple fact of how cryptography works. Or passwords, keys, or any secret like an API key, etc…

If you publish such things on GitHub, they instantly become “not what you’ve labelled it as”.

> It becomes worthless for...

So you admit it's not completely worthless at that point only for specific use cases.

Sure, it has uses: it can be printed on a T-shirt to teach big media a lesson about the futility of copy protection, etc…

Plus it lets people decrypt media encrypted by that key that they might otherwise have been unable to.

So we've established that a "private key" that is no longer private may still have uses to some people, it is not wholly "worthless."

Do you want to revise your earlier statement about the private key in the repo in question? Is it "worthless"? Is it a security problem? Do you know what that key is being used for?

The repo is a proof of concept. The key provided is used for illustration purposes and worked for the proof of concept. Nobody believes Apple would not revoke that key. But you don't need to talk down to the author for their age like this when they've made clear this is a proof of concept.

I believe users are downvoting your comments because they are breaking the site guidelines. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and posting more in the intended spirit, we'd appreciate it, and your comments should get fewer downvotes too. See also https://news.ycombinator.com/item?id=38579013.

The private key is that of the operating system, unknown to the user. It is not the private key of the project.

> how publishing a private key makes the slightest bit of sense.

From what I gather, the private key was private until it was leaked to / stolen by the team who published it for this use case.

I don't have enough context to say, because I have to admit that once published, the keypair corresponding to the private key is likely to be revoked/discarded.

> the keypair corresponding to the private key is likely to be revoked/discarded.

That's precisely it! Publishing a private key -- anyone's -- invalidates the security of the private-public key pair, making it worthless as security.

There's going to be some consequence to this, such as the third party "changing the locks" and locking out you, or your users.

Similarly, it might allow hackers to intercept the comms, break into your code, or whatever.

The essential, fundamental point I'm trying to get across here is that it never ever makes sense to publish a private key, and then rely on it for any purpose.

I think I'm on board with your POV here.

I guess it would have been more difficult for Apple to find the key/device ID used in this scheme had these not been available on the first few pages linked by a lot of articles claiming iMessage is broken.

Had this not been publicly posted, someone would've been forced to at least open a log file.

What's the link between this repo and Beeper?

> What's the link between this repo and Beeper?

https://news.ycombinator.com/item?id=38531759

I might be missing it but still don’t see how that answers the question about how that repo is related to beeper mini. Did they use this directly or the same methodology?

In https://news.ycombinator.com/item?id=38531759 its OP states "A team member has published an open source Python iMessage protocol PoC on Github: https://github.com/JJTech0130/pypush."

Maybe there’s an easy way to just read all their replies but I see now that in the linked blog post it links https://blog.beeper.com/p/how-beeper-mini-works which goes over the technical details and mentions the python repo. Thanks

Oh, it wasn't lost among all their replies, it was in the 4th paragraph of the header text section of that Show HN post.

Beeper Mini's implementation was built on top of this repo. I'm sure it was cleaned up and modified for the production release, but the gist is largely still the same.

Thanks I see that mentioned here https://blog.beeper.com/p/how-beeper-mini-works