Tim Cook on iMessage Security: It’s Encrypted, and We Don’t Have a Key

Re:Tim Cook on iMessage Security: It’s Encrypted, and We Don... by giovani on Tuesday September 16, 2014 @12:55PM (#8325469)

So this ends up being as "simple" as answering the question: Do you trust Apple? Given they control the operating system and all around it, having the directory server controlled by someone else (or distributed) doesn't solve the problem as they have access to anything they want in your device, meaning they don't need any keys to begin with.

[ Parent | on HN ]

Re:Tim Cook on iMessage Security: It’s Encrypted, and We Don... by srslack on Tuesday September 16, 2014 @01:06PM (#8325521)

I wouldn't trust any company that blatantly dodges the question of security with a half truth. It's clear he's playing word games for PR points.

You can reset your password and redownload all of your messages to a new device if you use iCloud backup. Cook is full of shit when he says that Apple doesn't have the capability. They own the system.

Even a dedicated civilian could reset your password, associate a device with your account and receive all messages going forward. To state that Apple cannot is such a laughable claim that it becomes clear that it's just a PR game. Which calls into question how sincere he is in his feelings about privacy.

[ Parent | on HN ]

Re:Tim Cook on iMessage Security: It’s Encrypted, and We Don... by comex on Tuesday September 16, 2014 @01:17PM (#8325598)

For the record, you cannot redownload old messages in iMessage; if you use iCloud Backup, a civilian could fetch messages from there, but if not, they're out of luck.

[ Parent | on HN ]

Re:Tim Cook on iMessage Security: It’s Encrypted, and We Don... by srslack on Tuesday September 16, 2014 @01:24PM (#8325660)

Fair enough, I was mistaken. Security is hard, but no one should get a pass playing games like this when it comes to security.

A civilian could still associate another key (device) to the account if they're dedicated with the password or a password reset (not as stealthy) assuming 2FA is disabled. And Apple could surely do it stealthily since they own the system.

They have the capability, and it's too kind to his statement by calling it a half-truth in that respect because it's really a lie when he says "[Apple doesn't] have the capability."

[ Parent | on HN ]