DannyMacNothing Phone builds a blue bubble iMessage bridge while Google and Apple fight over RCS
GenderNeutralBroThey’ve stated that they are using Mac minis as relays. They claim that they do not store messages or credentials, but I don’t see how that’s possible if it relies on a Mac or iOS relay server that they control.
The best they can do is pinkie-promise to not intercept your messages and send a copy to law enforcement. But Nothing Corp can only guarantee… Nothing.
And yet, this article acts as if you’re using end-to-end encryption:
messaging Android users will use encrypted RCS chats, while messaging iPhone users will use encrypted iMessage chats.
They might be able to relay them in a way that the end to end encryption is actually handled on the phone and the relay only relays encrypted messages.
That would likely still give them a capability to MitM but it’s plausible that they couldn’t passively intercept the messages.
It’s true I am assuming, but I’m basing my assumptions on existing open source projects that allow you to “hack” iMessage texts onto Android by setting up your own Mac Mini.
I can’t even start to imagine how they would use the Mac as only a partial relay that would be married to a particular Android device in order to only decrypt iMessages on it. Maybe they figured it out, but if they did, I would want it open source, with as many pairs of eyes on it as humanly possible!
They might be able to relay them in a way that the end to end encryption is actually handled on the phone and the relay only relays encrypted messages.
They'd need to control the app on both phones in order to control what it's encrypting/decrypting. Their system only works because they've got a device in the middle separately decrypting/re-encrypting each message. Google's Messages app can't read iMessages; Apple's Messages app can't read Google's proprietary encrypted RCS messages.
Of course if you want universally cross-platform messaging, complete with full-resolution photos and available with end-to-end encryption, there's this crazy new technology called "email." I feel like there's a missed opportunity for making setting up S/MIME easier.
On second thought… Wouldn’t they have to reverse engineer at least part of the application, and at that point, would they even need Macs?
KairuByteAbsolutely. The iMessage network isn’t some unknowable beast, it “just” requires an Apple device be involved and activated to work. In order to spoof that far, you’d essentially need to emulate quite a bit on device.
I have experimented a little bit with Intel Hackintoshes, and iMessage has been one of the more difficult components of the process. If they truly managed this reverse engineering, they’d really be opening Pandora’s Box with Apple… Maybe in a legal sense.
I don’t think I would trust Nothing to develop this software and just hand it out for free on their hardware. “Software (Hardware?) as a Service” is bad enough, but this seems like it could be legally fraught.
You give them the credentials for your Apple account. The security concept is “trust me bro” and that’s really the best they can do unless Apple helps them (which they have no reason to)
“Trust me bro” always the security concept of any service where you don’t control the client - that includes regular iMessage (you have to trust Apple) and Google’s RCS (you have to trust Google).