undefined | Better HN

0 pointsgrgar2y ago0 comments

But the verification code is stored in the contact card, so the parent comment still stands. Anything that can access contacts, e.g. apps or iCloud (since Contacts are not part of Advanced Data Protection i.e. E2E encryption), can modify the verification code in the contact used by Messages for validation.

0 comments

lilyball2y ago

According to https://security.apple.com/blog/imessage-contact-key-verific..., the actual verified hash of the account key is stored in an end-to-end encrypted CloudKit container and merely linked to from the contact card.

_rs2y ago

Oh interesting, that is not at all clear based on the Contacts UI which shows it like any other field

varenc2y ago

The iOS Contact APIs shouldn't allow modifying this.

You can also try exporting the contact to a vCard .vcf file using the Share Contact button. I believe the iMessage key verification info won't be included. (But as you noted the most important thing is that it can't be modified)

blurrybird2y ago

That’s just good UI design. Make complex stuff look dead simple.

brookst2y ago

Are you saying the iOS contacts API lets apps read and write the verification code? That seems like terrible design. What need would a 3P app have for that capability?

isodev2y ago

No, there is no way for apps to read and write this information.

j / k navigate · click thread line to collapse