Comment on China claims it has cracked Apple Airdrop’s encryption to identify senders | CNN Business
Nomad@infosec.pub 5 months ago
No shit Sherlock. The encryption uses the phone number of the user for hashing. Building a rainbow table for all phone numbers is childsplay.
They use a weakness in the protocol to identify the senders number. They can’t see what they send, but who sent something and when and to who.
Ghostalmedia@lemmy.world 5 months ago
Someone correct me if I’m wrong, but it looks like there are two hashes. A short one based on the iCloud account’s email address or phone number, and a long 2048-bit RSA identity that gets stored on the device after logging into iCloud.
It looks like the short identity is basically just used for that initial airdrop screen where you find available targets to airdrop to, but the actual longer, more secure, hash is required for the actual file transfer.
That might explain why finding airdrop contacts is kind of snappy, but there is a bit of a delay after you initiate a transfer.
support.apple.com/guide/security/…/web
ripcord@lemmy.world 5 months ago
Thank you, incidentally, for contributing so much to Lemmy. You are great.
Ghostalmedia@lemmy.world 5 months ago
Thanks! Right back at ya!
Nomad@infosec.pub 5 months ago
Sounds about right. Might be they have some man in the middle shenannigans going on with permanently installed hardware in the subway, but I doubt it. That would be a race condition that you might win with a lot more signal strength, but still…