Slashdot Mirror
Want to Keep Messages From the Feds? Use iMessage
According to an report at CNET, "Encryption used in Apple's iMessage chat service has stymied attempts by federal drug enforcement agents to eavesdrop on suspects' conversations, an internal government document reveals. An internal Drug Enforcement Administration document seen by CNET discusses a February 2013 criminal investigation and warns that because of the use of encryption, 'it is impossible to intercept iMessages between two Apple devices' even with a court order approved by a federal judge."
The article goes on to talk about ways in which the U.S. government is pressuring companies to leave peepholes for law enforcement in just such apps, and provides some insight into why the proprietary iMessage is (but might not always be) a problem for eavesdroppers, even ones with badges. Adds reader adeelarshad82, "It turns out that encryption is only half of the problem while the real issue lies in the Communications Assistance for Law Enforcement Act which was passed in 1994.
If I had just figured out how to eavesdrop on imessages, this is JUST the sort of thing I would make public....
... is also known as a "police state."
A security hole left open for the good guys is also a security hole left open for the bad guys.
When I see terrorists in skinny jeans, ironic tshirts and wayfarers, on their iPhones plotting the demise of the Great Satan, then I'll worry.
It could just be something that CBS told them to print. I don't trust a word they say now.
Hey, I'd like to buy some of those drugs. Hit me up on iMessage at 407-TOTALLY-NOT-A-COP.
Long signatures suck.
iMessage keeps messages secret from the carrier, but it can't keep the messages secret from the feds.
Apple has to be able to know the user's private key to allow them to log in new devices, at least when the user logs into Apple using their Apple password. And therefore, with a warrant, so can the police.
Now Apple could use a technique where your password is hashed one way to create your iMessage key, and hashed a different way to be sent to Apple for logging in. But this doen't seem likely, as a login to iCloud (using a user's apple Password) on the web interface sends the password to Apple where its hashed on their end for login validation. So unless the iPhone/Mac iCloud login uses a different technique, Apple must (at a minimum) be able to access the user's iMessage key when the user logs into Apple.
And its far more likely that Apple (and therefore the police with a search warrant) can get the user's iMessage key whenever they want.
Test your net with Netalyzr
PGP all over again. BAN it, it must be evil! How could someone expect to talk to their friends and family without being in the clear for anyone to see. The nerve.
I have not read the terms of service and privacy policies for iMessage because I don't currently use any iDevices. But I would be very surprised if the terms of service and privacy policies for iMessage gave any reasonable assurances of actual privacy. Most other companies don't.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
The US is pressuring companies to leave holes in their software. That's really bad for security. For a car reference, its like asking BMW to tape a spare key to the roof of their sports cars. If police need to move the car or search it for drugs, it will be super convenient!
If you want to intercept messages, the legal way is to just get a warrant from a judge, detain the two endpoints (yes you can do that to people), and search away. If they are selling drugs, most likely one of the two can also be charged with possession.
If you believe, even for a second, that the feds can't read iMessages, you are just the deathstick dealer they are looking for.
Y'all know about this, right?
Here a money quote from an article in Wired:
Yeah... that really fits in perfectly with "can't read iMessages", lol.
I've fallen off your lawn, and I can't get up.
I understand that iMessage uses encryption, so cops can't just eavesdrop on messages, even with a warrant. While iMessage may be the most popular, the principle would apply to any messenger that uses similar levels of encryption. There's almost certainly nothing unique about iMessage and considerably better options probably exist for those wishing to keep their messages secret. Even if the DEA specifically mentions iMessage, there's no reason to not mention that anything that uses encryption follows the same principle.
This is my signature. There are many like it, but this one is mine.
If you read the memo, it's "should be considered encrypted", even if the reality is - their inteceptor/monitoring devices are too stupid to recognize APNS traffic and log/parse it.
This information could be completely cleartext and iMessage may only provide "security through obscurity". Although APNS is PROBABLY tunneled through SSL or something similar, meaning intercepts are only possible if you do it at Apple.
I wouldn't be surprised if Google Talk were just as difficult for feds.
retrorocket.o not found, launch anyway?
Don't rely on closed source to keep your secrets. Since we can't verify that the Feds haven't pressured Apple into giving them a back door, we have to assume they have. The article here could easily be propaganda encouraging people to use compromised software.
Use something like Jitsi or Retroshare if you care about your privacy. Anything else should be considered the equivalent of standing on the street corner with a megaphone.
Give me Classic Slashdot or give me death!
On the Android platform, there are third-party, open-source apps available for encrypted voice and SMS. Those are just the ones I'm familiar with; there may be others.
If I was the feds, that's exactly what I would 'leak' were it easy for me to read iMessages...
Loading...
...just ask Apple?
I know you think you're protecting your rights, but it doesn't mean you aren't facilitating trafficking meth, heroin or the next big thing in soma-jolting chemistry when you advocate for an untappable form of communication. Your right to privacy is actually a proscription against unreasonable use of governmental power. It's not absolute, and it's not guaranteed the 'evil corporation' we all like to whine and bitch about shouldn't be subject to compliance for such measures as reasonable surveillance. I don't like assuming that there's an unfriendly, obtrusive ear, eye or nose pressed to my privates either, but there are bigger evils out there than the DEA.
Or maybe "the powers that be" want us to believe this ?
That was my thought too - why else would the government come out and say "If you want to send secret messages that we can't read, make sure you use iMessage. We can't read anything you send with iMessage, no siree bob, those messages are safe from us! We are no longer recommending rot13, now iMessage is the best way to send a secret message."
Hey, I'd like to buy some of those drugs. Hit me up on iMessage at 407-TOTALLY-NOT-A-COP.
When questioned, he'll just say his number is 407-TOTALLY-ONU-A-COP -- and that this should have been warning enough.
Of course, iMessage doesn't use numbers so it'd more likely be "addicted2drugs13@precinct32.sd.ca.us"
Truly effective encryption is not available to the public.
“He’s not deformed, he’s just drunk!”
I know you think you're protecting your rights, but it doesn't mean you aren't facilitating trafficking meth, heroin or the next big thing in soma-jolting chemistry when you advocate for an untappable form of communication.
Or facilitating free speech in places where saying the wrong thing leads to torture and imprisonment or worse. There will always be illegal things, but the greater right to free secure speech, I believe, takes precedence over stopping drugs / child porn / cause of the decade.
Your right to privacy is actually a proscription against unreasonable use of governmental power. It's not absolute, and it's not guaranteed the 'evil corporation' we all like to whine and bitch about shouldn't be subject to compliance for such measures as reasonable surveillance.
You means the government that retroactively gives itself powers to invade our rights? There's not much checks-and-balances going on in America.
I don't like assuming that there's an unfriendly, obtrusive ear, eye or nose pressed to my privates either, but there are bigger evils out there than the DEA.
So you're of the opinion that if one has done nothing wrong, one has nothing to hide. How can you enjoy your bread and circuses when your head is buried in the sand?
'Not designed to be government-proof'
Apple has disclosed little about how iMessage works, but a partial analysis sheds some light on the protocol. Matthew Green, a cryptographer and research professor at Johns Hopkins University, wrote last summer that because iMessage has "lots of moving parts," there are plenty of places where things could go wrong. Green said that Apple "may be able to substantially undercut the security of the protocol" -- by, perhaps, taking advantage of its position during the creation of the secure channel to copy a duplicate set of messages for law enforcement.
PGP Creator Phil Zimmerman has a new business, Silent Circle, that does proper encryption for voice and SMS on mobile devices.
I made a PHP/MySQL library that prevents SQL injection & makes coding easier!
Hey, I'd like to buy some of those drugs. Hit me up on iMessage at 407-TOTALLY-NOT-A-COP.
Oh crap you're in central florida too?!?! ;)
1. That the feds are going to spend the resources, which even with the breakthrough is unlikely to be trivial, to crack random suspected drug dealer's communications.
2. That they're going to risk the very knowledge that they have the capability to slip out
3. That they aren't the ones dealing the drugs in the first place
4. That they're going to bother to send in a tip when they're busy with country scale espionage.
I don't read AC A human right
Odd that it would be published like that, right? Yeeeeeaaaaaahhh, something's off. Anyway, just in case, never use MS, Apple, Google, or any mainstream product to maintain privacy.
hard to stop all this maddness US is leading...
We all knew this would happen. Alas, we did it anyway.
I believe that the encrypted communication is useless in conditions where every single fact of such communication is traced and the participants logged. and bugged. The really secure communicator should not allow any party except Alice and Bob to know the fact of communication, and any party - IP of other party or anything that allows to find them in meatspace.
Unfortunately, the only communicator I know that claims to do this is I2P The Invisible Internet Project. And it does not support VoIP.
The math of encryption makes it seem almost impossible to break, the reality is user stupidity. Passwords are stupid simple and that will get you every time. Now, iMessage, where they have randomly generated keys, I could see those as being far more difficult to break, even for a massive super computer, but still, not impossible -- if the code breaking software is excluded from the initial brokerage of the shared secret. However, in many ssl type encryptions they re-negotiate the secret periodically. It is possible to insert yourself or monitor the exchange and calculate it.
Who knows? Encryption is based on the assumption that it would take a very very long time to break. When you virtually infinite resources to crack it, all bets are off.
Two points I'd like to make :
A, I do not like having to sacrifice visual usability for security. iMessage is not visually pleasing to say the least.
B, In other news, US to declare all users of iMessage "digital home grown terrorists."
The program is pure shit too, I used stock android, and it decided that black text on a dark background was a great way to display messages.
He tried to kill me with a forklift!
So what is this saying... is OTR cracked? Unless iMessage is a voice service, off-the-record would be a far better option for privacy since it is open sourced. Also, dont be confused with Google chat feature called "off the record" which simply doesn't store a log on your local computer and instructs the remote client to also not store a local log... if the remote client bothers to observe this request. Because for google everything you type is clear text. If your interested in a real encryption option, check out Pidgin chat client with the crypto OTR plugin. Its open source so you can trust it has no back doors compiled into the binary... unless you actually trust this "report" that apple doesnt want to sell your information to law enforcement for profit.
Also, please let me know if OTR has been broken. That would be a shocker to me.
Ha! Good observation. I'd forgotten about them. What happened to Occupy, anyway?