Technology

59340 readers

5442 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

Apple Announces 'Groundbreaking' New Security Protocol for iMessage (www.macrumors.com)

submitted 8 months ago by [email protected] to c/[email protected]

21 comments fedilink hide all child comments

Apple Announces 'Groundbreaking' New Security Protocol for iMessage::Apple today announced a new post-quantum cryptographic protocol for iMessage called PQ3. Apple says this "groundbreaking" and...

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 4 points 8 months ago (1 children)

I don't use Apple devices, so my preferences aren't particularly relevant, but...

I would rather have better E2EE than RCS. Really I don't care for RCS at all. The last thing I want is for carriers to have any control over my messaging. I want my chats to be available on all devices even if I drop my phone into a volcano. I want to just use the internet without weird carrier networking. RCS is nicer than RCS I guess, but lipstick on a pig. My carrier should just worry about connecting me to the internet, not wasting their time making deals with Google to host some weird phone-number connected chat app.

[–] [email protected] 2 points 8 months ago* (last edited 8 months ago) (1 children)

I would rather have better E2EE

and

I want my chats to be available on all devices even if I drop my phone into a volcano

are kinda conflicting goals. If the chats are easily available on a new device without you manually syncing the key, that means the key exists somewhere in the cloud outside of your control, which is the opposite of good E2EE.

You can still achieve both goals, but it would involve you exporting the key, storing it somewhere, and then importing it to a new device from where you stored it.

[–] [email protected] 1 points 8 months ago

They aren't conflicting goals. Multi-device E2EE is available in protocols like Matrix and WhatsApp.

In the simplest case multi-device E2EE can be implemented as a group chat, and when you add a new device to your account you automatically add it to all of your rooms. So any protocol that supports mutli-user E2EE can support multi-device E2EE. Of course there are more efficient implementations.

it would involve you exporting the key, storing it somewhere, and then importing it to a new device from where you stored it.

Yes, you need to have a copy of the key, if the last copy is lost any E2EE solution will fail closed. If you have multiple devices this is probably already solved. (For example Matrix where when you log in with a new device it will ask you to verify from an existing device.)

But the point stands that if I am on vacation with a laptop and a phone and I lose my phone with proper multi-device I can continue to use my laptop seamlessly. (It already has a key)

You can also make "offline" backups and import to new devices. This may be less convenient but it can be easier to make offline backups than having globally distributed full computers. There are other solutions as well like escrow where a key is protected by a password or HSM devices. Although these are not as strong as never giving the key to a third-party.