Comment on Nothing Phone builds a blue bubble iMessage bridge while Google and Apple fight over RCS
GenderNeutralBro@lemmy.sdf.org 11 months ago
They’ve stated that they are using Mac minis as relays. They claim that they do not store messages or credentials, but I don’t see how that’s possible if it relies on a Mac or iOS relay server that they control.
LWD@lemm.ee 11 months ago
SHITPOSTING_ACCOUNT@feddit.de 11 months ago
They might be able to relay them in a way that the end to end encryption is actually handled on the phone and the relay only relays encrypted messages.
That would likely still give them a capability to MitM but it’s plausible that they couldn’t passively intercept the messages.
LWD@lemm.ee 11 months ago
KairuByte@lemmy.dbzer0.com 11 months ago
Absolutely. The iMessage network isn’t some unknowable beast, it “just” requires an Apple device be involved and activated to work. In order to spoof that far, you’d essentially need to emulate quite a bit on device.
infinitepcg@lemmy.world 11 months ago
You give them the credentials for your Apple account. The security concept is “trust me bro” and that’s really the best they can do unless Apple helps them (which they have no reason to)
realharo@lemm.ee 11 months ago
“Trust me bro” always the security concept of any service where you don’t control the client - that includes regular iMessage (you have to trust Apple) and Google’s RCS (you have to trust Google).
kirklennon@kbin.social 11 months ago
They'd need to control the app on both phones in order to control what it's encrypting/decrypting. Their system only works because they've got a device in the middle separately decrypting/re-encrypting each message. Google's Messages app can't read iMessages; Apple's Messages app can't read Google's proprietary encrypted RCS messages.
Of course if you want universally cross-platform messaging, complete with full-resolution photos and available with end-to-end encryption, there's this crazy new technology called "email." I feel like there's a missed opportunity for making setting up S/MIME easier.
Rootiest@lemmy.world 11 months ago
If it’s anything like Beeper 's Matrix bridge then it’s E2EE Matrix encrypted between your device and the bridge server and then using Apple’s iMessage encryption between the bridge server and Apple/the other user.
The weak point is always going to be the bridge software as by necessity the message must be decrypted there to re-encrypt for iMessage.
At least in Beeper/Matrix the bridge software is open source and one can host their own bridge while continuing to use the existing Beeper/Matrix main server.
Doing so gives you no-trust security since the Beeper/Matrix host cannot decrypt the messages between you and the bridge you control.