545
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 22 Mar 2024
545 points (97.4% liked)
Technology
59559 readers
1895 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
How would a third party client guarantee e2e encryption with iMessage?
And by what mechanism was that company enabling that bridge? Did that mechanism store iCloud credentials? Did it encrypt the drives the users iCloud data could have been downloaded to? Did they have access to iMessages in clear text before forwarding them?
The entire web is built on standardized e2e encryption schemes fought for by techie nerds so that we don't have these problems there.
I'm not a programmer, but this doesn't seem hard. The API could specify a cryptographic standard. Third party clients don't need access to iCloud data, just the API to pass message and attachment content in encrypted form with a standardized handshake.
What am I missing?
And what data would this client be handling via the API?
Even Signal discourages third party apps for this reason you are indeed missing.
Signal is open source. That's why they warn against using third party closed source apps which cannot be security audited.
iMessage is a proprietary app that cannot be security audited. An open source alternative would be more secure, not less.
https://www.tomsguide.com/news/fake-signal-and-telegram-apps-sneak-malware-into-thousands-of-android-phones-delete-these-right-now
The signal code is there for transparency and individual use, not for redistribution. Again, this is signal themselves discouraging users from third party apps for things that have and will happen.