Hacker News new | ask | show | jobs
by msh 1800 days ago
Then you could just as well get a iPod touch or iPad mini.
1 comments

Neither of those has a vibrate motor to let me know about notifications. They also can't be used to pair to an Apple Watch.

I know this because I used to carry an iPad Mini in my pants pocket.

Then buy an iPhone, and turn off iCloud Backup in Settings, it's not hard to do. Then your iMessages are fully E2E Encrypted.
Nope, because they get escrowed by the other end of the iMessage conversation.

Also, the whole point of disabling iMessage (in this thread) is to close the iMessage-related zero click exploits described in TFA.

The other end of the conversation escrows the key on any messenger. Otherwise how would you read the message? Unless you consider Snapchat, but that's not End to End Encrypted.

And are you really sure that Signal or your preferred messengers don't also have Zero-Click exploits? After all, they aren't sandboxed to the degree iMessage is with BlastDoor.

>"BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"

https://twitter.com/billmarczak/status/1416801514685796352

Except that almost every other secure messenger is guilty of the same thing. And they don't sandbox at all, whereas BlastDoor at least tries to.
Snapchat claims to be end to end encrypted, last I looked.

Signal does not escrow endpoint keys in an iCloud Backup, so your first statement is incorrect.

This is false. Snapchat has "snaps" protected, but text messages and group messages are not end to end encrypted.

Also, Signal putting your escrow keys in iCloud? I don't think you know what you are talking about. You can set iMessage to not put your keys in iCloud like I said above by turning off iCloud Backup which makes it fully End-to-End with your own key on your device, just like Signal.

If you are worried about the other party having their conversations being backed up, tell them to disable iCloud Backup. If you are this worried about the privacy of your communications, hopefully the other party would be as well.

And Signal and any other E2E messenger is absolutely storing copies of your key on the recipient's phone, just like iMessage would. If it didn't, there'd be no way to verify that a message was sent from the same sender.

...or I could just use a truly-secure option that doesn't destroy my personal security model. Owning an iDevice presents a considerable security risk to my current setup.
There is no such thing as a "truly-secure option." As anyone truly concerned about security will tell you.

You will be forced to make compromises somewhere unless you want to live under a rock in the desert. You can't drive without a State ID, can't get a home loan without credit, can't work without a Social Security Number except under limited circumstances, can't make money without reporting to the IRS, and so on. It's entirely about what compromises you want to make, and the tradeoffs therein.

> can't work without a Social Security Number except under limited circumstances

Something like 96% of human beings don't have a social security number. Many of them work.

Like the nation you live in doesn't have its own Tax Authority with information on you, and doesn't have its own ID Number you need to use for working.

The technicals are different, the point is the same.

I don't count on a "truly secure" option existing, I just manage my risk by reducing the amount of Big Tech thumbs in my personal pie. Apple, much like Amazon, Microsoft and Facebook, have no right to any of my personal information, end of story.
I just wanna know how big are your pants pockets