this post was submitted on 08 Dec 2023
132 points (95.8% liked)
Technology
58757 readers
4376 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Well I stand corrected. I didn't think Apple would do anything, or if they did, it would be a while.
They've done nothing about Beeper Cloud, so I thought they were sitting on their hands. Maybe because those connections are from actual Macs, so harder to isolate and prevent.
Still going to be entertaining to watch, especially the point about SMS being unencrypted, and the recent article about iMessage having a significant security issue in not having Forward Secrecy, since your RSA key doesn't change.
Even the CEO of Beeper said there was no way Apple could take them down without interrupting service for iPhone users.
I guess he was wrong!
Or, maybe he knew he was bluffing a little (I doubt he fully believed they couldn't do this).
Like ad blocking, this looks like a cat/mouse game, and this dev looks like he really understands what Apple does. So it should be an interesting thing to watch.
Probably not a good idea to underestimate a multiple trillion dollar company
deleted
Not sure I would call it poor encryption. As yet, no one's cracked that large of an RSA key.
I'd certainly call it less than advertised, and needing some updates like increase the RSA key, separate the encrypted message from the AES key, and use other mechanisms so it doesn't have a single point if failure (the RSA key).
They also need to change the identifiers, since that has a risk of MITM attacks.
But yea, they've had 4 or 5 years and done nothing. That's BAD.