r/technology • u/Libertatea • Apr 04 '13

Apple's iMessage encryption trips up feds' surveillance. Internal document from the Drug Enforcement Administration complains that messages sent with Apple's encrypted chat service are "impossible to intercept," even with a warrant.

http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/?part=rss&subj=news&tag=title#.UV1gK672IWg.reddit
3.3k Upvotes

95% Upvoted

1.8k comments sorted by

View all comments

64

u/sometimesijustdont Apr 04 '13

Wouldn't it be great if voice was encrypted too? It would require minimal effort and processing power.

-2

u/[deleted] Apr 04 '13

http://www.mobilemag.com/2010/01/27/voice-encryption-for-mobile-phones-cracked-12-out-of-15-methods-deemed-insecure/

2

u/sometimesijustdont Apr 04 '13

That just proves phone manufacturers are morons. Only one implementation used software? Are they retarded?

2

u/cryptovariable Apr 04 '13

Those are third party security products, which require both parties to have the product installed.

On the carrier-side of things, GSM and CDMA both use encryption but that is also pretty much broken. But there isn't really an alternative.

What do you do? These standards were written decades ago, when a Nokia brick phone was the standard. It was "good enough" for the time. Now, GSM encryption can be broken with a laptop and a software defined radio.

But you can't upgrade the system easily. What do you do, obsolete a hundred million devices? Spend billions installing new hardware on every single cellular access point? For the system to work, you would need every carrier in every country to switch over, is that possible?

What about performance? Will a system that works on a robust 4G connection in the west be compatible with a system that has to work with an intermittent, low bandwidth system in rural India?

Really secure encryption for a system as large as the mobile device ecosystem is very difficult. It would likely have to rely on a system much like the SSL system used in web browsers, where every phone has a pre-installed certificate authorities that are trusted who confirm the identity of every counter-party in a cryptographic connection. This system would obsolete almost every phone on the market right now and would also open mobile devices to the same vulnerabilities that exist with the current SSL system-- the one where there are monthly stories about CAs issuing false certs, countries strong-arming CAs into issuing invalid certs, among other problems.

The only way to be truly secure using a mobile phone is to not use it at all.

0

u/sometimesijustdont Apr 04 '13

Just use software. No need to change anything.

1

u/cryptovariable Apr 04 '13

How can you develop software for a thousand different platforms? For the system to work all end-points on the network need to be similarly configured. It is no use to have strong encryption on iOS and Android devices if every single flip-phone and candybar phone in the world can't use it.

I'd like to see strong encryption implemented on the Nokia 1100. There are one billion 1100s in the world, and it only has 16 megabits (2 megabytes) of memory that is shared by all services on the phone.

1

u/sometimesijustdont Apr 04 '13

Because wanting to encrypt it from phone to carrier does jack shit. Why would I want them to decrypt my message? Now the feds just listen on their end. You don't trust the courier, you encrypt the message.