• 0 Posts
  • 152 Comments
Joined 1 year ago
cake
Cake day: June 19th, 2023

help-circle


  • In short: The per message AES key is derived from the contacts public RSA key.

    Erm that’s not how it actually works. Though in your defence, “in short” is pretty hard to achieve here.

    The real headache though isn’t encrypting the messages. It’s making sure that only the intended recipient has the decryption key for your message. That’s where E2EE messaging gets complex and frankly Apple doesn’t do the best job.

    It’s theoretically possible with iMessage, especially in a nation state level attack, for a compromised device to be one of the recipients your encrypted message is sent to. Wether “theoretically” is “actually in practice” happening is hard to judge, because nation state attacks are normally hidden by court mandated disclosure suppression orders.

    The way Signal is architected, it wouldn’t be possible to comply with a court order like that. Unfortunately that means some Signal based messaging services will be forced to exit the UK since laws coming into effect next year will give them no other choice. It’ll be interesting to see if signal based services (like Google RCS) also walk or will they weaken their encryption in order to be able to comply.

    The fact at least one nation state is passing laws that force “encrypted” messaging services to have the vulnerability that iMessage has is a pretty strong smoke signal that attacks like that are happening…




  • Oof that’s bad.

    Although it should be noted that in well designed apps this should only be metadata. The push notification should just tell the phone that “content is available”, which will power up the CPU, launch the app in the background, download your actual message/etc, decrypt it, and finally put a notification on the lock screen.

    Metadata is obviously useful to law enforcement, but unless the app is really poorly written they shouldn’t be getting your actual notification alerts. Those should be E2EE and therefore can’t be disclosed.

    Unfortunately the notification system does allow messages to be sent without encryption. Perhaps they should remove that feature.


  • No… When you send a “blue bubble” photo on an iPhone the file size is around 1.5MB. When you send a “green bubble” photo I think they’re resized down to less than 300KB.

    Any photo larger than that won’t be delivered by some carriers. Also while iMessage photos default to HEIF format - the same compression algorithm as Blue Ray videos - MMS uses JPEG which doesn’t have a target file size feature. All you have is the width/height in pixels and an arbitrary “quality” scale.

    To guarantee your photo will never be over 300KB you need to set the width/height/quality to a number that will often be under 100KB… and that’s what Apple does.

    Android has a size setting, and you’ll get a delivery failure error if you set it too high for the recipient’s carrier… a lot of carriers do support larger photos… But Apple doesn’t bother with that - they want it to “just work”. Which means 100KB for green bubble photos.

    The reality is quality is always going to suffer - converting an image from HEIF to JPEG is a bad idea - it’ll never look anywhere near as good as the original no matter what resolution or quality the compression is set to.

    Also… iPhones don’t even take ordinary photos… by default every “photo” is a short video. When you send those to another iPhone, they get the video. Green bubbles either get a still image or worse a 100KB five second video.






  • What would they diagnose?

    Combustion Engine? Don’t have one. Transmission? Don’t have one. Emission Control System? Don’t have emissions. Spark Plugs? Nope. Fuel System? No. Exhaust? No. Alternator? No. Battery charger? you can see that on the dashboard. Starter motor? Nope. Battery Status? Also on the dashboard. Vehicle speed… on the dash. Engine idle… no. Air Flow Sensor? No air flow. Intake Manifold Pressure… no intake. Throttle position… only really relevant if you have a clutch or torque converter which EVs don’t have (you would notice, very quickly, if the throttle position detected pressing the pedal when you’re not pressing it in an EV…

    That’s the list of standard ODB-II diagnostics. Some cars do more than that, but those are the ones they have to do. And none of them are relevant.



  • Speaking as an Australian we’re also not super great at embracing the whole renewables thing

    Erm… Australia has the more rooftop solar (32% of households) than any other country in the world and one state (south Australia) already has enough wind turbines to cover 100% of their overnight power consumption when the weather is favourable - with more being deployed (not to mention their grid is connected tot he rest of the nation, which is also investing in wind and hydro, so if it’s windy somewhere else that’s good enough).

    We’re also moving pretty fast into hydrogen… in part because we have more power than we can use, so selling it (in the form of green hydrogen) makes sense.

    We also have a dying but massive fossil fuel industry, and they spread a lot of FUD… but the reality is those power companies aren’t price competitive with renewable and never will be. They have no future and they’re just trying to delay the inevitable as long as possible.






  • It sounds like you could’ve taken that car back for a warranty claim… depending on your state it should be able to do about 30 miles after either 8 or 15 years, and your was doing less than 20 at 9 years… I assume you were in an eight year state?

    Having said that, draining the battery fully every day will absolutely kill it. It’s not good for the battery to be empty that often… an EV with a 300 mile range and the same driving pattern could probably go well over a million miles on the original battery. That’s far longer than the typical life of a modern ICE engine (unless its an engine specifically intended for commercial fleets - those last longer).

    Of course, a battery that can do 300 miles is very expensive.