@Rhino Yeah I stopped eating candy too. Here in the US, pretty much every store has a wall full of candy. I used to walk by drooling, now I walk by revolted by the thought of actually sitting there and eating entire bags of candy like I used to
Dunno, I guess it neutralizes it somehow ... but I know that if you eat too spicy foods you should either eat a spoon of sugar or drink milk over it. So I'd guess it's sugar in one form or another that's easily digestible. And perhaps combined with enzymes in saliva. Tho that's a guess.
funny enough those are also the ways to neutralize tannins in some unripe fruits
And it depends on what kind of spicy. Anything that's capsaicin-based (e.g.: peppers), do milk/citrus. Anything mustard-based (e.g.: wasabi), water's okay.
@TildalWave No, I think it's something about the acid.
just went to a stream processing event where they compared Amazon, Azure and Google (each company presented their approach). Was super interesting to see how they approach it, each in their own way.
My guess is that they're deriving the key from some details on your account (probably not the password), that they aren't necessarily storing anywhere, but they could probably re-create it at will if they wanted to, in order to decrypt all your stuff
They probably could, you're right
Hopefully they wouldn't do that, but you never know
It says that keys are "non-migratory", meaning that the key can't be moved to another device
So it does raise an interesting question of how you're able to read messages between devices. But I think that iMessage key is used for the TLS connection to the server, not for the messages themselves. I'm not really sure
@ChrisCirefice I don't think they're storing anything unless the recipient's device is unable to receive messages, but I'm sure it's encrypted with a key they know (If they do encrypt at all, something we have no proof of - and only source code would be a valid proof)
@André Yeah, I'm not familiar enough with different encryption types to know what they're doing. If iMessage uses an asymmetric key for the TLS that is unique-per-device, then they might be storing the messages with a symmetric key that is tied to the account itself, stored on their servers and transferred to the new device on sign-in.
I guess the only way to really see that would be to Wireshark setting up a new device and sign-in to see what's being sent out and received lol. But I would hope, at the very least that they aren't storing the messages in plain text on the server, and I doubt they are. But they probably have the keys. Big corporations always seem to anyway.
Page 13 of that article also says that iCloud token is put in the Keychain "after first unlock". Maybe the symmetric key is derived from that? I guess that would make sense, and would tie it to the iCloud account
@ChrisCirefice they use a custom protocol on top of HTTPS. I don't know if it's actually encryption or just obfuscation, but it seems like base64-encoded binary data (didn't decode it unfortunately), so I'm afraid packet captures won't give you any insight
@André Well, I suppose that that makes sense. I guess we'll never know unless one of us becomes an Apple security engineer! And I don't plan to, so I guess it'll always be a secret haha.
@ChrisCirefice I don't either, and yeah it'll remain a secret unless someone reverse-engineers enough of the iMessage client software and publishes how it works (I recall some chinese Android app that could successfully send/receive Imessages via a server running their unofficial client, so it's definitely doable)
@André Hmm, interesting. Unfortunately I don't have the expertise to mess around with that, nor the time. Well, anyway thanks for coming to chat to discuss! Back to work :)
@ChrisCirefice what I do know though is to never trust any security guidelines/documents unless backed by source code which you can prove it's that same code that runs on your device. Until you have that proof, don't trust the device with anything you don't want its manufacturer (or its country's government) to know.
@ChrisCirefice same here. You're welcome, have a nice day. (:
btw it wasnt about HIM knowing the people's names - he could have pulled it from wikipedia, or maybe he's a polymath, either way it doesnt matter - it was about the supposed professional not having a clue about the field he is supposedly an expert in.
like if you didnt know who Alan Turing is, or never heard of Bruce Schneier.
If a company tries to cold-call to sell me something, I will black list them. Even if I originally wanted their product
As I hate it so much
If I actually see adverts I tend to write to the marketing directors of those companies to tell them how I plan to persuade people not to use their products
I nearly hate marketing folks as much as politicians. Nearly
I need help with my homework assignment,
The question asked is:
can you explain me which design principle between
Least Privilege
Fail-Safe Defaults
Economy of Mechanism
Complete Mediation
Open Design
Separation of Privilege
Least Common Mechanism
Psychological Acceptabi...
The purpose of tags is to indicate what the question is about. homework only indicates the context in which the question may have been asked, which is useless.
@LvB see, some SE sites have tried having a homework tag, and the only effect this had was disputes on its usage.
@LvB exactly. Arbitrarily. Imagine the debate around subjective questions and whether or not to close them, only over the pointless issue of a tag all in full view of the OP.
(and if they're here to help deal with CA compromises then clearly a more-trusted-authority-than-the-CA should post them, which leads to some interesting questions so as to the nature of such an authority)
An ideally asked homework question should look like any another question, showing research, insight and a highlight of where the OP needs clarification.
@Rhino I just did not feel like writing an entire essay without knowing what OP knew. Especially with students and beginners, if they don't expose the judgement/thought mistakes they are making then I cannot verify that I repaired those mistakes
@Rhino I see the points your making and I did not think that far ahead when tagging it such. I agree with your reasoning and will adopt it to my reviewing ;)
@SteveDL I know. Sometimes it's hard for people to understand that a) the more detail you provide the better we can help and b) if you go through the process of working out what you don't know precisely, you might answer your own question.
I always thought that that is the way you go about solving this type of questions. @Rhino. I often adjust my awnsers based on comments and updates on this site because of that believe
@LvB I meant more for question askers, but it's completely valid to update an answer if the OP requests clarification. That's kinda the purpose of comments :)
if what's asked doesn't answer my Q and I manage to find out as much as I can, and I still can't answer it... boom, one question. Doesn't happen often usually because someone else has asked it or I've read the answer somewhere, but still from time to time.
In response to Logjam I want to prove I hardend my services.
I know that the DH param has to be 2048 bits atleast and self generated. but I am unable to find a way to actually check this for something other than a HTTPS site.
(thats I can do here)
I would like to check my other SSL protected se...
I need help with my homework assignment,
The question asked is:
can you explain me which design principle between
Least Privilege
Fail-Safe Defaults
Economy of Mechanism
Complete Mediation
Open Design
Separation of Privilege
Least Common Mechanism
Psychological Acceptabi...
In response to Logjam I want to prove I hardend my services.
I know that the DH param has to be 2048 bits atleast and self generated. but I am unable to find a way to actually check this for something other than a HTTPS site.
(thats I can do here)
I would like to check my other SSL protected se...
