Slashdot Mirror
Want to Keep Messages From the Feds? Use iMessage
According to an report at CNET, "Encryption used in Apple's iMessage chat service has stymied attempts by federal drug enforcement agents to eavesdrop on suspects' conversations, an internal government document reveals. An internal Drug Enforcement Administration document seen by CNET discusses a February 2013 criminal investigation and warns that because of the use of encryption, 'it is impossible to intercept iMessages between two Apple devices' even with a court order approved by a federal judge."
The article goes on to talk about ways in which the U.S. government is pressuring companies to leave peepholes for law enforcement in just such apps, and provides some insight into why the proprietary iMessage is (but might not always be) a problem for eavesdroppers, even ones with badges. Adds reader adeelarshad82, "It turns out that encryption is only half of the problem while the real issue lies in the Communications Assistance for Law Enforcement Act which was passed in 1994.
If I had just figured out how to eavesdrop on imessages, this is JUST the sort of thing I would make public....
... is also known as a "police state."
Now im gonna use IMessage to sell my drugs!
Or maybe "the powers that be" want us to believe this ?
A security hole left open for the good guys is also a security hole left open for the bad guys.
When I see terrorists in skinny jeans, ironic tshirts and wayfarers, on their iPhones plotting the demise of the Great Satan, then I'll worry.
It could just be something that CBS told them to print. I don't trust a word they say now.
iMessage keeps messages secret from the carrier, but it can't keep the messages secret from the feds.
Apple has to be able to know the user's private key to allow them to log in new devices, at least when the user logs into Apple using their Apple password. And therefore, with a warrant, so can the police.
Now Apple could use a technique where your password is hashed one way to create your iMessage key, and hashed a different way to be sent to Apple for logging in. But this doen't seem likely, as a login to iCloud (using a user's apple Password) on the web interface sends the password to Apple where its hashed on their end for login validation. So unless the iPhone/Mac iCloud login uses a different technique, Apple must (at a minimum) be able to access the user's iMessage key when the user logs into Apple.
And its far more likely that Apple (and therefore the police with a search warrant) can get the user's iMessage key whenever they want.
Test your net with Netalyzr
PGP all over again. BAN it, it must be evil! How could someone expect to talk to their friends and family without being in the clear for anyone to see. The nerve.
I have not read the terms of service and privacy policies for iMessage because I don't currently use any iDevices. But I would be very surprised if the terms of service and privacy policies for iMessage gave any reasonable assurances of actual privacy. Most other companies don't.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
The US is pressuring companies to leave holes in their software. That's really bad for security. For a car reference, its like asking BMW to tape a spare key to the roof of their sports cars. If police need to move the car or search it for drugs, it will be super convenient!
If you want to intercept messages, the legal way is to just get a warrant from a judge, detain the two endpoints (yes you can do that to people), and search away. If they are selling drugs, most likely one of the two can also be charged with possession.
If you believe, even for a second, that the feds can't read iMessages, you are just the deathstick dealer they are looking for.
Y'all know about this, right?
Here a money quote from an article in Wired:
Yeah... that really fits in perfectly with "can't read iMessages", lol.
I've fallen off your lawn, and I can't get up.
I understand that iMessage uses encryption, so cops can't just eavesdrop on messages, even with a warrant. While iMessage may be the most popular, the principle would apply to any messenger that uses similar levels of encryption. There's almost certainly nothing unique about iMessage and considerably better options probably exist for those wishing to keep their messages secret. Even if the DEA specifically mentions iMessage, there's no reason to not mention that anything that uses encryption follows the same principle.
This is my signature. There are many like it, but this one is mine.
If you read the memo, it's "should be considered encrypted", even if the reality is - their inteceptor/monitoring devices are too stupid to recognize APNS traffic and log/parse it.
This information could be completely cleartext and iMessage may only provide "security through obscurity". Although APNS is PROBABLY tunneled through SSL or something similar, meaning intercepts are only possible if you do it at Apple.
I wouldn't be surprised if Google Talk were just as difficult for feds.
retrorocket.o not found, launch anyway?
Just send File:/// as an iMessage and you are sure to keep it private.
Don't rely on closed source to keep your secrets. Since we can't verify that the Feds haven't pressured Apple into giving them a back door, we have to assume they have. The article here could easily be propaganda encouraging people to use compromised software.
Use something like Jitsi or Retroshare if you care about your privacy. Anything else should be considered the equivalent of standing on the street corner with a megaphone.
Give me Classic Slashdot or give me death!
On the Android platform, there are third-party, open-source apps available for encrypted voice and SMS. Those are just the ones I'm familiar with; there may be others.
If I was the feds, that's exactly what I would 'leak' were it easy for me to read iMessages...
Loading...
...just ask Apple?
I know you think you're protecting your rights, but it doesn't mean you aren't facilitating trafficking meth, heroin or the next big thing in soma-jolting chemistry when you advocate for an untappable form of communication. Your right to privacy is actually a proscription against unreasonable use of governmental power. It's not absolute, and it's not guaranteed the 'evil corporation' we all like to whine and bitch about shouldn't be subject to compliance for such measures as reasonable surveillance. I don't like assuming that there's an unfriendly, obtrusive ear, eye or nose pressed to my privates either, but there are bigger evils out there than the DEA.
Truly effective encryption is not available to the public.
“He’s not deformed, he’s just drunk!”
I know you think you're protecting your rights, but it doesn't mean you aren't facilitating trafficking meth, heroin or the next big thing in soma-jolting chemistry when you advocate for an untappable form of communication.
Or facilitating free speech in places where saying the wrong thing leads to torture and imprisonment or worse. There will always be illegal things, but the greater right to free secure speech, I believe, takes precedence over stopping drugs / child porn / cause of the decade.
Your right to privacy is actually a proscription against unreasonable use of governmental power. It's not absolute, and it's not guaranteed the 'evil corporation' we all like to whine and bitch about shouldn't be subject to compliance for such measures as reasonable surveillance.
You means the government that retroactively gives itself powers to invade our rights? There's not much checks-and-balances going on in America.
I don't like assuming that there's an unfriendly, obtrusive ear, eye or nose pressed to my privates either, but there are bigger evils out there than the DEA.
So you're of the opinion that if one has done nothing wrong, one has nothing to hide. How can you enjoy your bread and circuses when your head is buried in the sand?
I would completely trust in a commercial system nobody can examine, even though proven cryptosystems published in peer-reviewed journals have existed for decades, and their implementations are completely free.
There are basically two ways this can go: Either law enforcement is lying through their teeth about not being able to read it (they're allowed to do that). Or they're really stymied, which means Apple will be forced to nerf or remove the encryption feature.
Meanwhile, gnupg.
'Not designed to be government-proof'
Apple has disclosed little about how iMessage works, but a partial analysis sheds some light on the protocol. Matthew Green, a cryptographer and research professor at Johns Hopkins University, wrote last summer that because iMessage has "lots of moving parts," there are plenty of places where things could go wrong. Green said that Apple "may be able to substantially undercut the security of the protocol" -- by, perhaps, taking advantage of its position during the creation of the secure channel to copy a duplicate set of messages for law enforcement.
PGP Creator Phil Zimmerman has a new business, Silent Circle, that does proper encryption for voice and SMS on mobile devices.
I made a PHP/MySQL library that prevents SQL injection & makes coding easier!
Honeypot, that is all.
I agree that it's not difficult to obtain decrypted iMessages. I set up my iPad to receive the same txts/imessages as my iphone using only my iTunes account and password, readily available from Apple for a proper DEA request. It's not man-in-the-middle-style decryption, but it is undetectable, real-time, plain text duplication of the data, which is even better.
If the DEA can get the device there are several softwares which will pull down and archive every text and imessage sent or received by the device. I ran such a program against my iPhone last week and it indicated over 10,000 messages, so probably going back to when I first started using this system, 2-3 years ago. I wasn't paying close attention, but I'm pretty sure this includes the imessages and not only TXTs. This method is probably only useful after arrest, but it seems comprehensive and provides data from before surveillance was initiated. (I don't delete my messages, so I don't know to what extent doing so would prevent the software from obtaining it.) Again, not decryption between two devices, but pretty useful in prosecution.
So this is likely FUD intended to lull the surveilled into a sense of relaxation. Even if it's true that they can't decrypt between 2 Apple devices, they don't need to.
BBM is much better at keeping your messages secret.
Get Overplay.net VPN service.
No more eyes on you
1. That the feds are going to spend the resources, which even with the breakthrough is unlikely to be trivial, to crack random suspected drug dealer's communications.
2. That they're going to risk the very knowledge that they have the capability to slip out
3. That they aren't the ones dealing the drugs in the first place
4. That they're going to bother to send in a tip when they're busy with country scale espionage.
I don't read AC A human right
For Windows, use Bitmessage.
They can't tell who you are talking to and the message is encrypted between one or more parties.
https://bitmessage.org/wiki/PyBitmessage_Help
https://bitmessage.org/wiki/Main_Page
There are a host of encryption methods and software out there already that people can and do use to communicate anonymous with encrypted messages. Baring or back dooring iMessages isn't going to help the police/feds at all, except with the most naive criminals. Just a few:
Bitmessage
https://bitmessage.org/wiki/Main_Page
A.A.M Direct
AAM hSub Interpreter
https://bitmessage.org/wiki/Main_Page
QuickSilver Lite
https://www.quicksilvermail.net/qslite/
"PGP Creator Phil Zimmerman has a new business, Silent Circle [silentcircle.com], that does proper encryption for voice and SMS on mobile devices."
Before you place your trust in this, consider:
Silent Circle Dangerous to Cryptography Software Development
http://log.nadim.cc/?p=89
The Baffling Patronage of Silent Circle
http://log.nadim.cc/?p=102
And, amusingly enough:
Is Silent Circle Open Source Yet?
http://issilentcircleopensourceyet.com/
No.
Silent Circle have only released incomplete source code[1], but have been telling press and activists that all source code has been released and openly reviewed.
[1] https://github.com/SilentCircle
You say, "Creator of PGP Has Already Fixed This" I would disagree at this time.
Try messengers from other countries, such as "WeChat" (improved copy of WhatsApp). You can be relatively sure that US "law enforcement" doesn't have access to it, and the Chinese won't willingly give up data on their citizens (the majority users) the US law enforcement.
The NSA is listening to iMessage, WeChat, and all the rest anyway. The police isn't, though.
Just make sure you're not using it to organize Free Tibet movements, AND are planning to visit China soon.
Best solution on the market. www.silentcircle.com
hard to stop all this maddness US is leading...
We all knew this would happen. Alas, we did it anyway.
I believe that the encrypted communication is useless in conditions where every single fact of such communication is traced and the participants logged. and bugged. The really secure communicator should not allow any party except Alice and Bob to know the fact of communication, and any party - IP of other party or anything that allows to find them in meatspace.
Unfortunately, the only communicator I know that claims to do this is I2P The Invisible Internet Project. And it does not support VoIP.
The math of encryption makes it seem almost impossible to break, the reality is user stupidity. Passwords are stupid simple and that will get you every time. Now, iMessage, where they have randomly generated keys, I could see those as being far more difficult to break, even for a massive super computer, but still, not impossible -- if the code breaking software is excluded from the initial brokerage of the shared secret. However, in many ssl type encryptions they re-negotiate the secret periodically. It is possible to insert yourself or monitor the exchange and calculate it.
Who knows? Encryption is based on the assumption that it would take a very very long time to break. When you virtually infinite resources to crack it, all bets are off.
Two points I'd like to make :
A, I do not like having to sacrifice visual usability for security. iMessage is not visually pleasing to say the least.
B, In other news, US to declare all users of iMessage "digital home grown terrorists."
The program is pure shit too, I used stock android, and it decided that black text on a dark background was a great way to display messages.
He tried to kill me with a forklift!
So what is this saying... is OTR cracked? Unless iMessage is a voice service, off-the-record would be a far better option for privacy since it is open sourced. Also, dont be confused with Google chat feature called "off the record" which simply doesn't store a log on your local computer and instructs the remote client to also not store a local log... if the remote client bothers to observe this request. Because for google everything you type is clear text. If your interested in a real encryption option, check out Pidgin chat client with the crypto OTR plugin. Its open source so you can trust it has no back doors compiled into the binary... unless you actually trust this "report" that apple doesnt want to sell your information to law enforcement for profit.
Also, please let me know if OTR has been broken. That would be a shocker to me.
Ha! Good observation. I'd forgotten about them. What happened to Occupy, anyway?