this post was submitted on 10 Jan 2024
103 points (91.9% liked)
Technology
59466 readers
3168 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
No shit Sherlock. The encryption uses the phone number of the user for hashing. Building a rainbow table for all phone numbers is childsplay.
They use a weakness in the protocol to identify the senders number. They can't see what they send, but who sent something and when and to who.
Someone correct me if I’m wrong, but it looks like there are two hashes. A short one based on the iCloud account’s email address or phone number, and a long 2048-bit RSA identity that gets stored on the device after logging into iCloud.
It looks like the short identity is basically just used for that initial airdrop screen where you find available targets to airdrop to, but the actual longer, more secure, hash is required for the actual file transfer.
That might explain why finding airdrop contacts is kind of snappy, but there is a bit of a delay after you initiate a transfer.
https://support.apple.com/guide/security/airdrop-security-sec2261183f4/web
Edit: one more thought. If this really was that easy to crack, wouldn’t China have done this years ago? The CCP has been targeting Airdrop for a long long time.
Sounds about right. Might be they have some man in the middle shenannigans going on with permanently installed hardware in the subway, but I doubt it. That would be a race condition that you might win with a lot more signal strength, but still...