Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Want to Keep Messages From the Feds? Use iMessage

timothy posted about a year ago | from the disinformation-brought-to-you-by-the-afl-cia dept.

Encryption 153

According to an report at CNET, "Encryption used in Apple's iMessage chat service has stymied attempts by federal drug enforcement agents to eavesdrop on suspects' conversations, an internal government document reveals. An internal Drug Enforcement Administration document seen by CNET discusses a February 2013 criminal investigation and warns that because of the use of encryption, 'it is impossible to intercept iMessages between two Apple devices' even with a court order approved by a federal judge." The article goes on to talk about ways in which the U.S. government is pressuring companies to leave peepholes for law enforcement in just such apps, and provides some insight into why the proprietary iMessage is (but might not always be) a problem for eavesdroppers, even ones with badges. Adds reader adeelarshad82, "It turns out that encryption is only half of the problem while the real issue lies in the Communications Assistance for Law Enforcement Act which was passed in 1994.

cancel ×

153 comments

Sorry! There are no comments related to the filter you selected.

Hmm... (5, Insightful)

T-Bucket (823202) | about a year ago | (#43361387)

If I had just figured out how to eavesdrop on imessages, this is JUST the sort of thing I would make public....

Re:Hmm... (2, Informative)

Anonymous Coward | about a year ago | (#43361515)

If the endpoints can decrypt the stream or messages; and if Apple can reach into the devices and retrieve those keys, game over.

Seriously now (5, Informative)

fyngyrz (762201) | about a year ago | (#43361677)

If you believe, even for a second, that the feds can't read iMessages, you are just the deathstick dealer they are looking for.

Y'all know about this [wikipedia.org] , right?

Here a money quote from an article in Wired [wired.com] :

the NSA made an enormous breakthrough several years ago in its ability to cryptanalyze, or break, unfathomably complex encryption systems employed by not only governments around the world but also many average computer users in the US

Yeah... that really fits in perfectly with "can't read iMessages", lol.

Re:Seriously now (5, Insightful)

Old97 (1341297) | about a year ago | (#43361775)

Technology available to intelligence agencies like NSA is not always made available to law enforcement.

Re:Seriously now (5, Insightful)

hawguy (1600213) | about a year ago | (#43361853)

Technology available to intelligence agencies like NSA is not always made available to law enforcement.

Exactly, if the NSA does have the ability to crack encryption thought to be uncrackable by the rest of the world, there's no way they'd let that ability be used for any public law enforcement cases -- they'd keep it closely guarded and would only use it for top-secret intelligence gathering.

Re:Seriously now (2)

fyngyrz (762201) | about a year ago | (#43362215)

None of which stops them from calling your LEO's office and saying, "Hi, this is your federal government; Joe Palooka, address such and such, is dealing drugs." Or whatever. At which juncture, you are now a POGI. The point is, your secrets... aren't.

IMHO, anyone who assumes they are operating in an atmosphere of privacy today is very likely wrong, even in some of the most mundane venues we encounter on a daily basis. I think acting as if one has privacy is imprudent, to say the least. Right now, if you can't stand for something to be known, then you're much better off if you don't talk about it, don't write it down, don't commit it to digital form, and don't perform any on-record acts that relate to it. Also, assume you're on-record. All the time. Unless you can prove otherwise. Which you probably can't do.

Re:Seriously now (4, Funny)

Anonymous Coward | about a year ago | (#43362479)

None of which stops them from calling your LEO's office and saying, "Hi, this is your federal government; Joe Palooka, address such and such, is dealing drugs." Or whatever. At which juncture, you are now a POGI. The point is, your secrets... aren't.

Yes of course, but you have to JIYE the YTSARD or who's going to GJS the KSDYI?

Re:Seriously now (1)

raydobbs (99133) | about a year ago | (#43362765)

Abbreviation BINGO!

Re:Seriously now (5, Interesting)

rhekman (231312) | about a year ago | (#43362517)

While nothing technical is stopping an intelligence agency from passing on criminal tips to LEOs, there are legal road blocks to doing so. At least in the U.S. there are supposed to be restrictions on federal agencies spying on private citizens. More importantly though, our federal Constitution, state laws, and over 900 years of English common-law heritage guarantee one's right to face your accuser. Unless the originating agency can prove where and how they intercepted some communication, and it wasn't obtained as part of an unreasonable search or seizure, any such evidence is "fruit of the poisoned tree".

Re:Seriously now (1)

king neckbeard (1801738) | about a year ago | (#43362821)

Theoretically, they could just provide a decryption key to a LEO, and that wouldn't be legally considered an accusation. However, repeated instances of breaking strong encryption would draw suspicion.

Re:Seriously now (1)

ejasons (205408) | about a year ago | (#43363535)

Unless the originating agency can prove where and how they intercepted some communication, and it wasn't obtained as part of an unreasonable search or seizure, any such evidence is "fruit of the poisoned tree".

That's a quaint, but outdated sentiment. The original impetus can just be an "anonymous tip", and then any later, related evidence can usually be allowed...

Re:Seriously now (1)

Jah-Wren Ryel (80510) | about a year ago | (#43363587)

Unless the originating agency can prove where and how they intercepted some communication, and it wasn't obtained as part of an unreasonable search or seizure, any such evidence is "fruit of the poisoned tree".

That is absolutely true. However, that doesn't stop them from "laundering" the information in such a way to reverse engineer a plausible explanation for how they came across that fruit.

For example. the spooks (illegally) decrypt a message that contains a list of scheduled drug shipments and their destinations. At that point, they need only have the local police change their patrols to focus on the areas around those destinations. Make that change a week or two in advance of the shipment's arrival and they've got all the cover they need to say that they just stumbled upon the shipment during one of their regularly scheduled patrols. Fruit laundry...

Re:Seriously now (2, Insightful)

Anonymous Coward | about a year ago | (#43362635)

Until it goes to court, and the NSA has to divulge a $billion decryption program in order to put some clown selling dime bags in jail for 6 months, and simultaneously tell every military and intelligence agency in the world that they need to upgrade.

Yeah, great trade.

Re:Seriously now (1)

hawguy (1600213) | about a year ago | (#43363231)

None of which stops them from calling your LEO's office and saying, "Hi, this is your federal government; Joe Palooka, address such and such, is dealing drugs." Or whatever. At which juncture, you are now a POGI. The point is, your secrets... aren't.

Someone below addressed this point - if they make a habit of it, eventually someone will catch on that the government is decrypting supposedly uncrackable ciphers and then their cover is blown.

IMHO, anyone who assumes they are operating in an atmosphere of privacy today is very likely wrong, even in some of the most mundane venues we encounter on a daily basis. I think acting as if one has privacy is imprudent, to say the least. Right now, if you can't stand for something to be known, then you're much better off if you don't talk about it, don't write it down, don't commit it to digital form, and don't perform any on-record acts that relate to it. Also, assume you're on-record. All the time. Unless you can prove otherwise. Which you probably can't do.

Dissent against the government has always been risky - the digital world introduces new risks, but also provides some benefits -- when you want to spread your word, there's no need to own a large printing press in your basement when sitting near a starbucks with a laptop lets you reach far more people with far less risk of being discovered -- if you're careful, it's a lot easier to dispose of your digital data than dispose of a 1000kg printing press when the FBI comes to your door.

Re:Seriously now (1)

plover (150551) | about a year ago | (#43362363)

"Hey, is this Justice T. Sheriff? Hi, Eve Mallory here. You might want to check out Alice, of 1234 Main St. I know she calls this guy Bob in Costa Rica every Wednesday at midnight, and every Thursday she gets a package. I'm not saying, I'm just saying, you know?"

Re:Seriously now (1)

NatasRevol (731260) | about a year ago | (#43362457)

Line from the worst mob movie ever?

Re:Seriously now (1)

tnk1 (899206) | about a year ago | (#43362617)

It also may make use of resources that law enforcement is not going to have, like specialized hardware or simply a giant supercomputer. Or aliens.

Re:Seriously now (1)

Lawrence_Bird (67278) | about a year ago | (#43364011)

er.. easy way around it:

FBI: Hello? NSA? This is FBI. We have this problem iMessage we need decrpted, can you help?
NSA: Well not if the message was transmitted within the US.
FBI: Suppose we have our London office transmit the message to Paris, could you decrypt that?
NSA: Sure, no problem!

Re:Seriously now (3, Insightful)

king neckbeard (1801738) | about a year ago | (#43361847)

It depends on what the meanings of 'enormous breakthrough' and 'unfathomably complex encryption systems' are in this context. I'm sure they can crack encryption much faster with a supercomputer than we can with a nice desktop, but that's not really going to make a difference.

Re:Seriously now (0)

Anonymous Coward | about a year ago | (#43361935)

Take off your tin foil hat and read the whole article. They haven't cracked 128 (assumed AES) and they haven't cracked AES. I don't know what iMessage has so maybe then can and maybe they can't. Your inference isn't interesting enough to make me go look. The article is about building a building, faster computers, they haven't broken AES, there are guesses made at the abilities of the govt. now and in the future, and they are collecting a bunch of stuff hoping to be able to break it at a future date. What they really can and can't do won't show up in a Wired article.

Re:Seriously now (1)

ZombieBraintrust (1685608) | about a year ago | (#43361937)

NSA has enough computer power to brute force many encryption methods. The question is how expensive it is to run those machines. They are not going to spend 5 grand to catch a $50 drug deal. But I would also assume those machines are idle most of the time and available to agencies willing to foot the bill.

Re:Seriously now (1)

The Snowman (116231) | about a year ago | (#43362223)

They are not going to spend 5 grand to catch a $50 drug deal.

Really? This is the U.S. government we are talking about here. They waste more money than that on a daily basis.

Re:Seriously now (3, Insightful)

fyngyrz (762201) | about a year ago | (#43362431)

Oy. That's not how it works. An encrypted message contains something unknown. Any particular spending required to break it occurs prior to knowing what's in it. Once spent, then they know -- and since they *already* spent to break it, there's no need to make any further finance based decisions. If the message contains something they think is of interest, it'll go off to the people who might like to know about it without any particular commentary. This is how it works -- I'm not guessing. Not by some magical choosing of which messages to break because they know what's in them.

The entire point of any sub rosa organization, be it religious extremists, home grown anarchist bombers, counterfeiters, drug dealers or agents of snooping nations is that they are trying to operate in such a way as to look innocent. So encrypted messages from otherwise innocent looking parties aren't presumed innocent. For that matter, unencrypted messages aren't presumed innocent. This isn't speculation; this is the reality of it. The computers look at everything and if it looks like it's something of interest, it gets kicked upwards.

As for the prior AC, if you assume they haven't cracked anything in particular, you're making a serious mistake. One they'd very much like you to make.

Re:Seriously now (1)

DanielRavenNest (107550) | about a year ago | (#43363221)

They don't need to brute force your encryption. First they gather lots and lots of databases (credit cards, google searches, facebook, etc.) Then they trawl the data for interesting correlations: Ah, so person X uses TOR visits Mexico regularly spends a lot more on their credit cards than their job can support. How interesting! They can then single out these people for more attention. Use of encryption is just one of the factors that goes into sifting out the interesting people to watch.

Another example: buys fertilizer and has a farm that is in the family for decades ---> not interesting. Buys fertilizer and lives in an apartment --> very interesting.

You can set up hundreds of factors like that, and none of them involve breaking codes.

Re:Seriously now (1)

guruevi (827432) | about a year ago | (#43362289)

Your source is Wired though...

A good encryption system with a sufficiently sized key is both physically and theoretically (if you calculate out the physics) uncrackable in a short period of time. Off course, old encryption systems (such as 40-bit encryption) is easily cracked in minutes with a datacenter full of GPU's these days.

Re:Seriously now (1)

mark-t (151149) | about a year ago | (#43362371)

When who you are trying to eavesdrop on doesn't ever transmit or share any of their encryption keys used for exchanging the data on *ANY* channels, and those keys can be changed, on the fly, and without any warning whatsoever, unless you are actually acting as a MitM for the communication, you can't possibly decrypt the data in anything that can come close to real time.

Re:Seriously now (2)

WaffleMonster (969671) | about a year ago | (#43362595)

Here a money quote from an article in Wired:

Another quote from the same article you cited.

"a lot of foreign government stuff we've never been able to break is 128 or less."

Re:Seriously now (0)

Anonymous Coward | about a year ago | (#43362905)

Thanks for the quote and link to the Wired article. I hadn't seen it before it was quite interesting. I do wonder what the NSA found. It might just be that they've completely broken RC4 (which is still used for a lot of HTTPS connections despite being known to be weak albeit not completely broken publicly), but I guess it's possible they found something on AES (the article is a bit misleading on how weak AES is: assuming no further weaknesses are found, no AES key could ever be brute forced due to there not being enough computational power (using physical limits) in the universe for a blind brute force attack on a 256-bit key (and not enough on Earth at least for a 128-bit key)).

Re:Seriously now (0)

Anonymous Coward | about a year ago | (#43363357)

If you believe, even for a second, that the feds can't read iMessages, you are just the deathstick dealer they are looking for.

If you believe all the conspiracy theories about the NSA breaking encryption you're either ignorant or just plain stupid.

There are three ways to break encryption

  * brute force - a $2 billion dollar datacenter is not enough to crack even a single iMessage. you'd have to spend a lot more than $2 billion on *each individual message* to crack them. The electricity requirements alone to brute force a single message would be higher than the entire worlds energy consumption.
  * a flaw in the math - the best mathematicians in the world are all convinced there are no flaws.
  * a backdoor. there could be one but it's unlikely since current legislation would make it a criminal offence to install a backdoor

The NSA's datacentre has two purposes:

  * collect and store data that cannot be cracked
  * crack data that was collected decades ago with systems (such as enigma) that are now known to have flaws

Re:Seriously now (0)

Anonymous Coward | about a year ago | (#43363911)

If it ain't open source, don't trust it!

Re:Hmm... (1)

Anonymous Coward | about a year ago | (#43362031)

This is EXACTLY what I came in here to either post, or see if it was posted.

The second any kind of legal entity publicly announces that X messages cannot be read by them... I instantly think that reading those messages is EXACTLY what they're capable of doing. Probably more easily than any other form of communication. In fact, the first thought in my head continues and thinks that they're probably trying to get more people to use this service, since they probably have a backdoor to see a stream of everything in realtime.

If I was actually concerned about having something not accessed by the feds, I'd write it down and mail it in a letter. There's still a distinct chance it can be opened/etc, but there's a significantly better chance that it'll get through unopened simply due to the extra effort and physical presence of a person required to do so. Or if more data needs to be sent, mail some product... a toy or some such, open it, and hide a microSD card or something in it. If you'd need it transferred faster (faster than say... same-day service), well... you get to roll the dice and see if your data gets lost in the noise online.

Thankfully, I'm a worthless peon living a boring existence.

Re:Hmm... (0)

Anonymous Coward | about a year ago | (#43362725)

"Thankfully, I'm a worthless peon living a boring existence." ...and that's EXACTLY what some kind of nefarious, anti-establishment, digital terrorist would want us ALL to think.

WE'RE HIP TO YOUR GAMES, PEON!!!

Re:Hmm... (1)

dav1dc (2662425) | about a year ago | (#43362631)

I guess we'll just have to read the message over their shoulder while they're typing it on the public subway - HA, encryption deciphered! #OldSkewlSocialHack ^_^

Re:Hmm... (0)

Anonymous Coward | about a year ago | (#43363035)

What if you took a peice of aluminum sheet and wrapped it around the top inch or 1/2 inch of the device?

A state where police work is easy... (5, Insightful)

Anonymous Coward | about a year ago | (#43361405)

... is also known as a "police state."

Re:A state where police work is easy... (5, Insightful)

oh_my_080980980 (773867) | about a year ago | (#43361461)

Hi, let me introduce you to the Patriot Act.

:D (0, Offtopic)

tracius01 (2541214) | about a year ago | (#43361435)

Now im gonna use IMessage to sell my drugs!

Re::D (4, Funny)

John Napkintosh (140126) | about a year ago | (#43361483)

Hey, I'd like to buy some of those drugs. Hit me up on iMessage at 407-TOTALLY-NOT-A-COP.

Re::D (0)

Anonymous Coward | about a year ago | (#43361683)

If your a cop, you have to spell it out in your phone number, right?

Re::D (0)

Anonymous Coward | about a year ago | (#43361891)

you're*

Re::D (1)

Em Adespoton (792954) | about a year ago | (#43361999)

Hey, I'd like to buy some of those drugs. Hit me up on iMessage at 407-TOTALLY-NOT-A-COP.

When questioned, he'll just say his number is 407-TOTALLY-ONU-A-COP -- and that this should have been warning enough.

Of course, iMessage doesn't use numbers so it'd more likely be "addicted2drugs13@precinct32.sd.ca.us"

O RLY? (0)

Anonymous Coward | about a year ago | (#43361439)

Or maybe "the powers that be" want us to believe this ?

Re:O RLY? (1)

hawguy (1600213) | about a year ago | (#43361895)

Or maybe "the powers that be" want us to believe this ?

That was my thought too - why else would the government come out and say "If you want to send secret messages that we can't read, make sure you use iMessage. We can't read anything you send with iMessage, no siree bob, those messages are safe from us! We are no longer recommending rot13, now iMessage is the best way to send a secret message."

Easy Police Work is not a Constitutional Right (5, Insightful)

ScottCooperDotNet (929575) | about a year ago | (#43361453)

A security hole left open for the good guys is also a security hole left open for the bad guys.

Re:Easy Police Work is not a Constitutional Right (5, Interesting)

SirGarlon (845873) | about a year ago | (#43361493)

And "law enforcement" can be either.

Just cause... (2)

Eugriped3z (1549589) | about a year ago | (#43361863)

I know you think you're protecting your rights, but it doesn't mean you aren't facilitating trafficking meth, heroin or the next big thing in soma-jolting chemistry when you advocate for an untappable form of communication. Your right to privacy is actually a proscription against unreasonable use of governmental power. It's not absolute, and it's not guaranteed the 'evil corporation' we all like to whine and bitch about shouldn't be subject to compliance for such measures as reasonable surveillance. I don't like assuming that there's an unfriendly, obtrusive ear, eye or nose pressed to my privates either, but there are bigger evils out there than the DEA.

Re:Just cause... (0)

Anonymous Coward | about a year ago | (#43362089)

It already exists - it's called encryption. The cat is out of the bag on that. The only way to stop encryption is to get people to stop using it or to not adopt it to begin with.

Second, if you seriously think drugs are that big of a deal then maybe you should be lobbying the government to invest in education about drugs rather than penalizing drug users and mounting an all-out assault on our civil liberties in what has been a failed war to stop drugs.

Personally I consider the drug war to be much more harmful than the harm some drugs have caused some people, therefore I find nothing in your post to agree with.

I'll continue encrypting my communications and advocating others do the same.

Re:Just cause... (1)

fustakrakich (1673220) | about a year ago | (#43362091)

...but there are bigger evils out there than the DEA

Yeah, the IRS... Both can steal your property without any due process. Heh, so can the local sheriff under RICO. Our right to privacy is as absolute as we can make it. It just depends on the size of our guns, which are kinda puny compared to theirs, which kind of makes your point. "Might makes right(s)". It protects and violates them.

Re:Just cause... (1)

PPH (736903) | about a year ago | (#43362141)

"That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that has been long and generally approved." - Benjamin Franklin

Encryption is Freedom (3, Insightful)

ScottCooperDotNet (929575) | about a year ago | (#43362449)

I know you think you're protecting your rights, but it doesn't mean you aren't facilitating trafficking meth, heroin or the next big thing in soma-jolting chemistry when you advocate for an untappable form of communication.

Or facilitating free speech in places where saying the wrong thing [wikipedia.org] leads to torture and imprisonment [wikipedia.org] or worse [wikipedia.org] . There will always be illegal things, but the greater right to free secure speech, I believe, takes precedence over stopping drugs / child porn / cause of the decade.

Your right to privacy is actually a proscription against unreasonable use of governmental power. It's not absolute, and it's not guaranteed the 'evil corporation' we all like to whine and bitch about shouldn't be subject to compliance for such measures as reasonable surveillance.

You means the government that retroactively gives itself powers to invade our rights [techdirt.com] ? There's not much checks-and-balances going on in America.

I don't like assuming that there's an unfriendly, obtrusive ear, eye or nose pressed to my privates either, but there are bigger evils out there than the DEA.

So you're of the opinion that if one has done nothing wrong, one has nothing to hide. How can you enjoy your bread and circuses when your head is buried in the sand?

Re:Just cause... (1)

losfromla (1294594) | about a year ago | (#43362825)

There is nothing inherently immoral in the use, or trafficking of meth, heroin, or the next big thing in soma-jolting chemistry. It is only illegal by government fiat. In a free country one should be free to recreate with drugs and injure oneself in self-chosen manners provided it doesn't infringe upon someone else's freedom. True freedom is freedom to do as one wishes while not causing direct harm to others.

Re:Just cause... (1)

gagol (583737) | about a year ago | (#43362973)

With good parenting, there would be no need to delegate good behaviour to the authority...

Re:Just cause... (1)

Lazere (2809091) | about a year ago | (#43363005)

You know, if drugs and other victimless crimes were legalized, we wouldn't have to worry about whether they were communicating about it secretly, would we? I know you think you're advocating helping good law enforcement, but unnecessary spying seems, well... unnecessary. Someone below used a Ben Franklin quote, and I think I'll use another. "Those who would trade liberty for security deserve neither." Personally, I'd rather have a few more drug dealers around than have to worry about how many agencies could be spying on me for my "protection".

Hipsters attack the USA. (3, Funny)

concealment (2447304) | about a year ago | (#43361465)

When I see terrorists in skinny jeans, ironic tshirts and wayfarers, on their iPhones plotting the demise of the Great Satan, then I'll worry.

Re:Hipsters attack the USA. (1)

Tokolosh (1256448) | about a year ago | (#43362481)

You mean the Occupy people?

It's on CNET... (2)

BAKup (40339) | about a year ago | (#43361473)

It could just be something that CBS told them to print. I don't trust a word they say now.

Sadly, no... (3, Interesting)

nweaver (113078) | about a year ago | (#43361489)

iMessage keeps messages secret from the carrier, but it can't keep the messages secret from the feds.

Apple has to be able to know the user's private key to allow them to log in new devices, at least when the user logs into Apple using their Apple password. And therefore, with a warrant, so can the police.

Now Apple could use a technique where your password is hashed one way to create your iMessage key, and hashed a different way to be sent to Apple for logging in. But this doen't seem likely, as a login to iCloud (using a user's apple Password) on the web interface sends the password to Apple where its hashed on their end for login validation. So unless the iPhone/Mac iCloud login uses a different technique, Apple must (at a minimum) be able to access the user's iMessage key when the user logs into Apple.

And its far more likely that Apple (and therefore the police with a search warrant) can get the user's iMessage key whenever they want.

Re:Sadly, no... (1)

nweaver (113078) | about a year ago | (#43361523)

Oh, and thanks to @SteveBellovin for the suggestion on how Apple could (but does not seem) to do things in a secure manner.

Re:Sadly, no... (0)

Anonymous Coward | about a year ago | (#43361759)

But they want this information without needing that pesky warrant...

Re:Sadly, no... (1)

guruevi (827432) | about a year ago | (#43362421)

I don't think you know how things work in encryption these days...

You don't need the username/password information to encrypt things. iMessage and most of the communication of short messages between Apple devices and between Apple's cloud and the devices is based on the XMPP system which uses simple S/MIME to encrypt similar to how e-mail encryption works. It's end-to-end encryption. Could Apple build-in something to transfer the private keys from the client to the server and intercept it there - sure - but that would be 1) against the XMPP standard, 2) easily noticed and exploitable, 3) may even be illegal.

Re:Sadly, no... (1)

Nixoloco (675549) | about a year ago | (#43363653)

I don't think you know how things work in encryption these days...

You don't need the username/password information to encrypt things. iMessage and most of the communication of short messages between Apple devices and between Apple's cloud and the devices is based on the XMPP system which uses simple S/MIME to encrypt similar to how e-mail encryption works. It's end-to-end encryption. Could Apple build-in something to transfer the private keys from the client to the server and intercept it there - sure - but that would be 1) against the XMPP standard, 2) easily noticed and exploitable, 3) may even be illegal.

Where did you read that iMessage is using the S/MIME Encryption extension to XMPP or that it is using XMPP? I haven't seen anything to suggest this. I suspect this is simply that iMessage is properly using TLS/SSL connections to their servers making snooping difficult. They can probably still snoop by subpoenaing Apple for the records. According to wikipedia [wikipedia.org] and other [anandtech.com] sources [imfreedom.org] , the protocol is actually a binary protocol based on Apple Push Notification Service [apple.com] .

Re:Sadly, no... (2)

mark-t (151149) | about a year ago | (#43362471)

Where is it written that iMessage is using the user's key that is shared with Apple? What's preventing the iMessage app from generating its own key pairs and using them?

And it doesn't even ever have to transmit either of them as long as the encryption keys exhibit a property of commutativity, even when further encrypted with other such keys. Only encrypted data would ever be on the channel and the only way to decrypt it would be to act as a MitM for the entire communication.

Which the carrier could technically do... but the carrier doesn't eavesdrop.

Re:Sadly, no... (1)

rabtech (223758) | about a year ago | (#43362475)

Can you clarify your sources for this? I was under the impression that the new Apple Push Notification system (on which iMessage is based) does a standard certificate request to the auth service (after logging in with your Apple ID), then uses that certificate to encrypt the APN connection. So at no time does Apple have your private key.

What I don't know is whether the service does a similar key exchange between the sender and recipients so the message contents are never decrypted on Apple's servers. In theory the device could simply generate a key for each unique conversation, do the public key exchange, then be sure the body was safe, the headers and overall body would themselves be encrypted over the secure connection between your device and Apple using the client and server certificates you got when you turned on iMessage on the device.

Again.... (3, Insightful)

Waveguide04 (811184) | about a year ago | (#43361521)

PGP all over again. BAN it, it must be evil! How could someone expect to talk to their friends and family without being in the clear for anyone to see. The nerve.

Want to use iMessage privately? Read and agree. (1)

SirGarlon (845873) | about a year ago | (#43361601)

I have not read the terms of service and privacy policies for iMessage because I don't currently use any iDevices. But I would be very surprised if the terms of service and privacy policies for iMessage gave any reasonable assurances of actual privacy. Most other companies don't.

I don't even... (1)

Anonymous Coward | about a year ago | (#43361621)

The US is pressuring companies to leave holes in their software. That's really bad for security. For a car reference, its like asking BMW to tape a spare key to the roof of their sports cars. If police need to move the car or search it for drugs, it will be super convenient!

If you want to intercept messages, the legal way is to just get a warrant from a judge, detain the two endpoints (yes you can do that to people), and search away. If they are selling drugs, most likely one of the two can also be charged with possession.

Re:I don't even... (3, Funny)

PPH (736903) | about a year ago | (#43361949)

Judges are so 20th Century.

Re:I don't even... (1)

Anonymous Coward | about a year ago | (#43362095)

Thankfully in the 21st and 22nd Century we have Judge Dredd.

Is there really a reason to mention Apple? (1)

king neckbeard (1801738) | about a year ago | (#43361681)

I understand that iMessage uses encryption, so cops can't just eavesdrop on messages, even with a warrant. While iMessage may be the most popular, the principle would apply to any messenger that uses similar levels of encryption. There's almost certainly nothing unique about iMessage and considerably better options probably exist for those wishing to keep their messages secret. Even if the DEA specifically mentions iMessage, there's no reason to not mention that anything that uses encryption follows the same principle.

Re:Is there really a reason to mention Apple? (1)

DocSavage64109 (799754) | about a year ago | (#43361963)

iMessage is important because it is built in to the iphone's text-messaging app. As a user, there is no appreciable difference between the two, and you often don't even notice which path your messages are using.

Re:Is there really a reason to mention Apple? (1)

TigerPlish (174064) | about a year ago | (#43362379)

As a user, there is no appreciable difference between the two, and you often don't even notice which path your messages are using

My mileage varied:

1. iMessages are easy to spot, they have blue bubbles instead of Green

2. iMessages usually arrive nearly-instantaneously, but many times they'll arrive minutes after they were sent, in some cases hours. Or the next day.

3. iMessages seem to dupe. A lot.

3. iMessages seem to dupe. A lot.

4. iMessages seem to choke when sent along with video or pictures if you're out in 3G-land.

Re:Is there really a reason to mention Apple? (1)

DocSavage64109 (799754) | about a year ago | (#43362727)

Funny. I've had 3 and 4 happen with text messages when I don't have good cell reception.

Re:Is there really a reason to mention Apple? (1)

king neckbeard (1801738) | about a year ago | (#43362761)

That's not really a positive in regards to privacy. 'Your messages may or may not be secure' is not reassuring when it's trivial to get secure communications.

Not sure if it's actually encrypted. (1)

Andy Dodd (701) | about a year ago | (#43361703)

If you read the memo, it's "should be considered encrypted", even if the reality is - their inteceptor/monitoring devices are too stupid to recognize APNS traffic and log/parse it.

This information could be completely cleartext and iMessage may only provide "security through obscurity". Although APNS is PROBABLY tunneled through SSL or something similar, meaning intercepts are only possible if you do it at Apple.

I wouldn't be surprised if Google Talk were just as difficult for feds.

File:/// (0)

Anonymous Coward | about a year ago | (#43361705)

Just send File:/// as an iMessage and you are sure to keep it private.

Jitsi, Retroshare (4, Insightful)

Hatta (162192) | about a year ago | (#43361723)

Don't rely on closed source to keep your secrets. Since we can't verify that the Feds haven't pressured Apple into giving them a back door, we have to assume they have. The article here could easily be propaganda encouraging people to use compromised software.

Use something like Jitsi or Retroshare if you care about your privacy. Anything else should be considered the equivalent of standing on the street corner with a megaphone.

Re:Jitsi, Retroshare (2)

silas_moeckel (234313) | about a year ago | (#43361823)

They even say they can the article looks more like them whining that they might have to get a second warrant etc for apple and that it's not real time.

Re:Jitsi, Retroshare (0)

Anonymous Coward | about a year ago | (#43362989)

Personally, I use OTR (which is what Jitsi uses for encrypting IMs) when I'm at a desktop but support for encryption on smartphones is woefully lacking, so when I IM from my phone, it's unencrypted (well, encrypted to the server, but not end-to-end). The two programs you recommend only run on desktop OSes, so while people may use them when at home, they can't use them when out and about. This is not a strict technical limitation, but realistically it means encryption doesn't get used much.

not just iPhone... (3, Informative)

lamber45 (658956) | about a year ago | (#43361727)

On the Android platform, there are third-party, open-source apps available for encrypted voice [google.com] and SMS [google.com] . Those are just the ones I'm familiar with; there may be others.

Re:not just iPhone... (0)

Anonymous Coward | about a year ago | (#43362793)

Right, but the problem is that ANDROID ITSELF is built for snooping, by a company that is a convicted snooper. So while your app may be encrypted, Android is likely passing your messages through Google (and hence FBI) servers as well so you are JUST as exposed! Apple is really the only company that has consistently demonstrated absolute regard for the privacy of end users.

Think different.
Think BETTER.
Think Apple.

Re:not just iPhone... (0)

Anonymous Coward | about a year ago | (#43363083)

Why not just add a little snippet of code that screenshots and sends the image unencrypted to the NSA honeyp ...err, messaging server?

The user would never know.

Re:not just iPhone... (0)

Anonymous Coward | about a year ago | (#43363175)

LOL, third-party apps for Android from .... Google? ;)

Classic disinformation ;) (1, Insightful)

Assmasher (456699) | about a year ago | (#43361737)

If I was the feds, that's exactly what I would 'leak' were it easy for me to read iMessages...

Re:Classic disinformation ;) (1)

Spy Handler (822350) | about a year ago | (#43361977)

no, the decentralized nature of iMessage is not to the feds' liking. If they could somehow push the public into using a certain platform, they'd choose Facebook messenger.

Couldn't they... (1)

SternisheFan (2529412) | about a year ago | (#43361833)

...just ask Apple?

Re:Couldn't they... (1)

mark-t (151149) | about a year ago | (#43362493)

There's nothing saying that Apple has the information necessary to decrypt the messages either.

Re:Couldn't they... (1)

tlambert (566799) | about a year ago | (#43362955)

...just ask Apple?

Yes, they could. If you read the reverse engineered protocol on the wikipedia link up top, then you will see that the end points are an Apple server, just like iChat uses. The virtual circuit makes a stop at the Apple server, which is the endpoint, and the Apple server decrypts the message and then reencrypts it for the recipient, or if the recipient isn't an iDevice user, sends it cleartext via the normal proxy channels through the carriers of both parties.

So it's rather trivial to interpose an MITM on the Apple server.

Google chat does the same thing, except with Google servers in the middle, which is why there is such latency in the audio between when it's sent and when it's output at the other end. Other services either side-band end-to-end to avoid the latency (but there's still an interposition capability on the main band) - for example, Skype - but very few offer true end-to-end, unless you consider one of the ends to be the providers server, rather than the person you are talking to.

Re:Couldn't they... (1)

ArtemaOne (1300025) | about a year ago | (#43363033)

No, they would need a warrant. Law enforcement prefers to sculpt laws so they are exempt from as much red tape as possible. Makes sense, but most of that red tape is known as your rights.

I call bullshit (1)

fustakrakich (1673220) | about a year ago | (#43362433)

Truly effective encryption is not available to the public [wikipedia.org] .

Re:I call bullshit (1)

WaffleMonster (969671) | about a year ago | (#43362957)

Truly effective encryption is not available to the public

OTP is truly effective and easy enough to use it can be done on paper without a computer.

All you need is to exchange a pool of high quality actually random garbage with your drug dealer buddies. Given storage capacity of a typical micro SD card a thumbnail sized pool enables the holders to exchange messages with each other day and night from anywhere in the world for the rest of their lives with impunity.

No quantum computer or scary three letter agency has any chance in hell of cracking your conversations ever regardless of any unforseeable technological advance.

Only problem is they can still crack you or your shady buddies with impunity which is why the tired old LEA "going dark" arguments against encryption don't work. If you can get a warrant to break the encryption you can get a warrant to install recording devices and get the information a different way.

The FBI's push to make "information services" CALEA accessible is discusting. They just don't care or think about anyone or anything but their own mission.

Re:I call bullshit (1)

Lazere (2809091) | about a year ago | (#43363117)

This seems like it would be pretty easy to route around. Just don't patent it. (Apparently FLOSS really is the way we want to do things these days)

Re:I call bullshit (0)

Anonymous Coward | about a year ago | (#43363529)

Sure it is. [wikipedia.org] I'd trust something that's been peer-reviewed over "Suite A" any day; the last time the NSA released one of their sooper-secrit private algorithms (Skipjack), Adi Shamir broke it in less than 24 hours.

Yes, absolutely (0)

Anonymous Coward | about a year ago | (#43362667)

I would completely trust in a commercial system nobody can examine, even though proven cryptosystems published in peer-reviewed journals have existed for decades, and their implementations are completely free.

There are basically two ways this can go: Either law enforcement is lying through their teeth about not being able to read it (they're allowed to do that). Or they're really stymied, which means Apple will be forced to nerf or remove the encryption feature.

Meanwhile, gnupg.

Reading the entire article helps (1)

dav1dc (2662425) | about a year ago | (#43362689)

'Not designed to be government-proof'

Apple has disclosed little about how iMessage works, but a partial analysis sheds some light on the protocol. Matthew Green, a cryptographer and research professor at Johns Hopkins University, wrote last summer that because iMessage has "lots of moving parts," there are plenty of places where things could go wrong. Green said that Apple "may be able to substantially undercut the security of the protocol" -- by, perhaps, taking advantage of its position during the creation of the secure channel to copy a duplicate set of messages for law enforcement.

Creator of PGP Has Already Fixed This (4, Interesting)

FsG (648587) | about a year ago | (#43363127)

PGP Creator Phil Zimmerman has a new business, Silent Circle [silentcircle.com] , that does proper encryption for voice and SMS on mobile devices.

Re:Creator of PGP Has Already Fixed This (1)

countach (534280) | about a year ago | (#43363705)

Yep. If the Feds ask for a backdoor into iMessage, the bad guys will just use something else.

Honeypot (0)

Anonymous Coward | about a year ago | (#43363393)

Honeypot, that is all.

Many Ways to Read iMessage (0)

Anonymous Coward | about a year ago | (#43363693)

I agree that it's not difficult to obtain decrypted iMessages. I set up my iPad to receive the same txts/imessages as my iphone using only my iTunes account and password, readily available from Apple for a proper DEA request. It's not man-in-the-middle-style decryption, but it is undetectable, real-time, plain text duplication of the data, which is even better.

If the DEA can get the device there are several softwares which will pull down and archive every text and imessage sent or received by the device. I ran such a program against my iPhone last week and it indicated over 10,000 messages, so probably going back to when I first started using this system, 2-3 years ago. I wasn't paying close attention, but I'm pretty sure this includes the imessages and not only TXTs. This method is probably only useful after arrest, but it seems comprehensive and provides data from before surveillance was initiated. (I don't delete my messages, so I don't know to what extent doing so would prevent the software from obtaining it.) Again, not decryption between two devices, but pretty useful in prosecution.

So this is likely FUD intended to lull the surveilled into a sense of relaxation. Even if it's true that they can't decrypt between 2 Apple devices, they don't need to.

BlackBerry Messenger is better (0)

Anonymous Coward | about a year ago | (#43363891)

BBM is much better at keeping your messages secret.

Answer (0)

Anonymous Coward | about a year ago | (#43363905)

Get Overplay.net VPN service.

No more eyes on you

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>