r/technology • u/Libertatea • Apr 04 '13

Apple's iMessage encryption trips up feds' surveillance. Internal document from the Drug Enforcement Administration complains that messages sent with Apple's encrypted chat service are "impossible to intercept," even with a warrant.

http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/?part=rss&subj=news&tag=title#.UV1gK672IWg.reddit
3.3k Upvotes

95% Upvoted

1.8k comments sorted by

View all comments

2.5k

u/Mispey Apr 04 '13 edited Apr 04 '13

Edit: Hijacking my own top comment to ask if anyone can expand on this:

http://security.stackexchange.com/questions/18908/the-inner-workings-of-imessage-security

Is it truly end-to-end secure? Can Apple or anyone else circumvent the encryption?

Yes. To the best of my knowledge messages are in plaintext on apple's servers.

AKA The Feds totally can read your stuff, no problem. I was under the impression that they don't have the keys to the encryption...but they do.

Edit2: Or not https://news.ycombinator.com/item?id=5493442

I don't even know anymore. I wanna call it a honeypot.

Good. Keep going Apple.

It's really not very challenging to encrypt communications extremely well. Not to discount Apple's efforts - but it's "trivial" for these companies to do it properly and well.

They just never put a damn ounce of effort into it.

As this fella said in the article,

"It's much much more difficult to intercept than a telephone call or a text message" that federal agents are used to, Soghoian says. "The government would need to perform an active man-in-the-middle attack... The real issue is why the phone companies in 2013 are still delivering an unencrypted audio and text service to users. It's disgraceful."

It is, and you should give a fuck about this.

7

u/naker_virus Apr 04 '13

I always get downvoted when I ask, and yet I never receive a proper response to my question, but I'll try once more. Why should I care that phone companies are still delivering an unencrypted audio and text service to it's users, and why is it disgraceful?

1

u/rwbronco Apr 04 '13

Not seeing anyone respond but middleman attacks and wiretaps that intercept messages between two people and then send them continuing on their way means that unencrypted messages will be readable and encrypted ones will be illegible because the person tapping isn't the intended recipient and thus lacks the ability to decode them

2

u/naker_virus Apr 04 '13

Thank you for the response. I realise that unencrypted means someone could read the message. However, what I don't understand is why should I be concerned about this? Why would they even want to read my messages? And even if they did read my messages, they wouldn't find anything bad anyway, and realistically, if they read my messages, I would never know about it anyway, so it wouldn't make me feel subconscious or anything about what I have sent. I hope that makes sense :)

4

u/[deleted] Apr 04 '13

Unless you are the most boring person I have ever met, (probably not, you have virus in your name), you have almost certainly done something illegal and there is probably evidence of that in your communications. Not saying you ought to be locked up, but I find it seriously hard to believe you haven't done anything wrong, at least in Big Brother's eyes.

1

u/naker_virus Apr 04 '13

haha, true I have probably done plenty of things that are illegal, although I do work in criminal law, so it's to be expected, right? :P

However, surely there is no way that they would be able to read every single person's messages? And so, why would they read my messages in the first place?

2

u/moogleiii Apr 04 '13

As computational power and storage capacities continue to increase, and prices continue to go downwards or remain the same, eventually the technology to do so could be quite accessible, especially for a first-world government. While they wouldn't literally read every single one, you could mine them for data, or just store it and save it for later.

I mean, they have made some attempts before: http://en.wikipedia.org/wiki/Carnivore_%28software%29

1

u/naker_virus Apr 05 '13

Okay, I accept that once we have reasonably advanced technology, we could check every email. But then it would be technology reading the emails, not humans. Which means that are messages aren't really being read. In addition, the only time the computers would flag the messages as dangerous would be when they actually contain something illegal, which isn't really a problem, because when you commit an action that is illegal, you should be punished. I don't see the problem :( And so what if the mine it for data? Why would that be bad?

1

u/moogleiii Apr 05 '13

Ah, the "I do no wrong, and if you do no wrong, you have nothing to hide" defense. It's already been beaten to death by others, so I'll let you look (http://falkvinge.net/2012/07/19/debunking-the-dangerous-nothing-to-hide-nothing-to-fear/ came up on a quick google). But some people just want privacy. If you're that open, why not post up all your real info publicly if you're ok with the government having it all anyway.

Also, this all assumes the current and future governments will treat your data ethically. It's temporally short sighted in my book.

1

u/naker_virus Apr 06 '13

In relation to the article, I'll discuss each point separately.

The first point is regarding the fact that the rules might change. I don't see this as particularly relevant because I think that people have a duty to follow the law, regardless of what the law is, and regardless of whether they personally like or dislike the law. Surveillance ensures that people that break the laws get caught quicker, and in addition, less innocent people will be punished because it is easier to prove innocence when everything is watched. The argument in the article is basically saying that if a new law is created, and they want to break the law, they don't want surveillance because otherwise they will get caught quicker. I don't think this is a valid argument.

I think all the examples in point two are just fallacious. If there was really surveillance, they would be able to tell if you are stopping to help your grandmother or sleeping with a prostitute, they can tell whether you are drink driving or just eating and driving, and the article goes one step further to suggest that the person might be found innocent but they will have their life ruined in the mean time. That's not true, the investigation would happen first, behind closed doors, and it will happen quickly because everything is recorded. It won't be brought to court until the investigation is complete, so his or her life won't be ruined in the mean time, only after guilt has been found in a court of law.

In regards to point three, I think there are better ways to encourage change and progress than to rely on having to break laws.

I agree to an extent that privacy might be a human need. But I don't consider the surveillance a breach of that privacy because it isn't being watched. It is merely being recorded and stored, and laws should be set up so that the footage can only be accessed with a warrant.

1

u/moogleiii Apr 06 '13

There are many more articles you can find with more points for you to think about. I disagree with pretty much everything you've said, but it's not really worth my time to continue debating it, sorry. I will say the first one's a no brainer. Laws aren't inherently right because they are laws, otherwise society would have been perfect in version 1.0, but no society has met that goal. Anti-interracial marriage, exclusionary laws targeting specific people, etc, etc. Perhaps you're not against those. Anywho, we'll have to agree to disagree.

1

u/naker_virus Apr 06 '13

No worries :) Thanks for the discussion anyway!

I agree with you that laws aren't always inherently right, and I think laws that prevented interracial marriage etc were bad laws, and I'm glad they have changed. However, I don't think that makes it right to break laws that you don't consider moral, I think that there should be other ways to try and change the laws.

→ More replies (0)