This is actually talking directly to the iMessage service. It's hitting https://service.ess.apple.com:443 (and https://service2.ess.apple.com:443 when authenticating) and not being proxied through any third-party servers. That being said, it does look like the app reports basic analytics but nothing sensitive.
> That being said, it does look like the app reports basic analytics but nothing sensitive.
Are you referring to the seemingly-encrypted network connection over port 5332 to a server in China at IP address 222.77.191.206 that has traffic that precisely correlates to me sending and receiving messages using the application? [edit: Which happens to be the value of the resource ServerId in the APK?]
That's crazy. The protocol for iMessage is so complicated that I gave up very quickly after getting IP banned many, many times, it's an incredibly sensitive service to things like this. At the time I just wanted to be able to check if an email address was iMessage-supported, but it required piles of signatures and other authorisation.
It will get banned on Apple's end so quickly, but not before it's used to send mountains of spam.
Haha, same here. Instead I wrote an app that uses the iMessage Mac client to insert a mail address into the to: field and check whether it supports iMessage. And then I use pixelbuffer data to figure out whether the mail address has the correct iMessage supported color in the ui. Works great, but is a bit slow.
That is just looking for embedded URLs: it totally fails to notice the IP address hardcoded into the APK (222.77.191.206) that seems to be used every time you send/receive a message.
They can start by getting Google and other major app stores to pull the app for copyright / trademark infringement on the term "iMessage", then they can sue the developer for the same (he's public with his identity).
Beyond that all they need to do is include some form of digital signing in the login process which he can't duplicate and jobs a good un.
Alternatively they may say that they don't care and leave it alone as it strengthens iMessage as a platform.
But my guess is that this won't end well. Isn't it trademarks that you have to defend or you lose them? If that's the case then Apple at the very least need to have him change the name and so on.
Digital signing on the login process? Could you be more specific? I was under the impression that verifying data is coming from an 'approved clients' over a reverse engineered protocol is impossible.
Reminder: iMessage's "encryption" is open to the NSA. (What's more, Apple partners with the NSA.) Not sure why you'd want to submit to the surveillance state.
<sarcasm>
Because if you connect to an iMessage client that also sends your packets to China, the MSS and the NSA get stuck trying to both look at your packets. We call it Two Stooges Syndrome. Your information is safe. No, it doesn't make you invincible
</sarcasm>
There is some truth to your statement. For example, we will never know if PG would shut down HN if required to hand over the private logs. So yes, our posts can be cross-referenced with other online profiles, etc.
Now, should the conclusion be "we should stop communicating electronically"? That would be a severe restriction to free speech and thus advancement of our species. So, no.
Maybe the right direction is to migrate the discussion towards encrypted and distributed forums. RetroShare offers such a feature (amongst others): http://retroshare.sourceforge.net/
This is truly impressive!