9 ms·
> More control over your privacy and data And yet their messaging strategy is to push a carrier standard with what I consider an egregious oversight: end to en
by schoolornot 6y ago
> More control over your privacy and data
And yet their messaging strategy is to push a carrier standard with what I consider an egregious oversight: end to end encryption. You know, that thing Apple and Signal have had since the beginning of time.
Even worse, Google decided to auto-enroll millions of devices into their RCS hub meaning it's receiving device text messages in cleartext. How do you like dem apples? And you thought the metadata collecting was bad.
- notatoad 6y agotheir messaging strategy is to support any messaging app you want to use as a first-class experience. SMS or RCS notifications aren't treated as any special case that gets priority over any other messaging app. If you want to use signal as your primary messaging app, android is happy to support that.
- bredren 6y agoIs SMS the default configuration for messaging on new Android devices these days?
- nradov 6y agoWhat kind of default are you asking about? You can open any app you want and send a message.
- Spivak 6y agoI think they're talking about the fact that on Android you select a single default app to manage your text messages.
- notatoad 6y agoYes, there's a default app to handle SMS. And Google would like you to use Google Messages for that, which is inherently non-private because SMS (and RCS) aren't private. but there's nothing about SMS that makes it a default other than it's what most people use. You have to open an app to send a message, there's no default way of sending a message where you aren't choosing an app first, and if you want something private and secure, you can choose something other than SMS.
- bredren 6y agoI think by 'default' I meant on the home screen of apps on a factory-new Android phone, presumably one messenger app is pre-installed and on that list. Perhaps, even configured as part of a phone onboarding experience. I was guessing this would be an SMS-based app.
- tssva 6y agoIt is usually a SMS-based app but it is not the same one for all factory-new Android phones. Some manufacturers will ship with Google Messages and some such as Samsung have their own messaging apps which will be the default in most but not all cases. If purchased through a carrier sometimes the default app will be the carrier's messaging app even if the phone manufacturer has their own.
- etbebl 6y agoThis must be the disconnect. As an Android user, it wouldn't occur to me that the "default" messaging app (usually something barebones and ugly) would influence how I send my messages. I just use whatever app I want, SMS or not. But unlike Android, Apple managed to popularize its own all-in-one messaging solution and in so doing brought encryption to more conversations. Google could try to do something like that with Android, but thus far they've simply remained agnostic.
- damnyou 6y agoI'm guessing they're an iOS user, where the built-in messaging app iMessage is treated as more special than other messaging apps.
- bredren 6y agoIt is much more special, because afaik it is the only one that can hook into SMS coming from the carrier. Other messenger apps can be downloaded and installed, but they can only do digital messaging. If you are on Android and you use Signal, but text some random other android user's phone number that uses a pure sms messaging app, is any part of that conversation encrypted?
- damnyou 6y agoIf the other phone is associated with a Signal account at all (regardless of operating system), it will use the Signal transport, otherwise SMS. The Signal UI makes it clear when you're sending unencrypted text messages.
- dforrestwilson 6y agoBe real. Opting for security and privacy vs a default lack thereof.
- lern_too_spel 6y agoYou mean like on-by-default plain text backups on iCloud? The difference is that on Android, you can change to an app that is actually secure (without a MITM key server vulnerability like iMessage) and have it be used by everything.
- damnyou 6y agoAs the other commenter points out, Apple's hands are just as dirty as Google's in this matter. iMessage is only end-to-end encrypted if you turn off cloud backups, and most people have them on so in practice it's not so. And turning them off on your end doesn't help either if even one participant in the conversation has them on. WhatsApp has the exact same problem with unencrypted backups. End-to-end encryption at large scale is not really something American mega-corporations can provide, unfortunately.
- dforrestwilson 6y agoDid not know that. Thanks!
- pulse7 6y agoIt is this, so called "end to end encryption" which is actually not "end to end", but "end to end plus NSA", but they are not allowed to say "plus NSA" so they say only "end to end" - without "plus NSA"...
- t-writescode 6y agoWhat are you talking about?
- archgoon 6y agoSorry; I must have missed something, what are you referring to? Is Google (or Apple?) pushing something that isn't end to end but claiming that it is? I seem to recall that Zoom did something like that, but not Google or Apple.
- tw04 6y agoThis x100. Friendly reminder for everyone once again that Google was "all in" on "allo". Their main engineer (I believe) was absolutely hyped to talk up all the things they had done to secure messaging - then all the features magically got walked back. https://www.theverge.com/2016/9/21/12994362/allo-privacy-message-logs-google https://www.theverge.com/2016/9/21/12994362/allo-privacy-mes... I feel like a broken record but: Apple for the love of god stop pulling a RIM/Blackberry and make Messenger available on Windows and Android and charge a fee if you have to.
- snazz 6y agoApple probably won’t make iMessage available outside of its own devices because it’s a major lock-in and network effect for iOS. Some people switch to iPhones simply because their friends won’t include them in an iMessage group chat or something similar. MMS is a truly terrible messaging experience by comparison.
- rorykoehler 6y agoI don’t know anyone who uses iMessage. I’m writing this on an iPhone and I don’t even know what iMessage is.
- maxdo 6y agothe blue bubble is iMessage the green one that always slowly receive messages and no typing indicator, images, videos , gifs, payments thats your rare android friend :)
- rorykoehler 6y agoI just checked. It seems I deleted it from my phone. A chat app that is tied to an OS? Why not just use Signal, Telegram or WhatsApp etc
- mikestew 6y agoWhy not just use Signal, Telegram or WhatsApp etc Because I already have a perfectly serviceable message app that comes with the phone by default. Do the three in your list interoperate with each other, is that why you're suggesting them?
- Nursie 6y agoEven more egregious IMHO, is that they set up shadow APNs on android devices, at the behest of the carriers, and route all tethered traffic via them. This is so the carriers can measure and limit tethering separately. The security issue here is that if you have a VPN client running on your phone, tethered traffic still goes in plaintext to the public internet via the hidden APN. Not cool.
- dleslie 6y agoThat _is_ grotesque. I wish I had something to add; particularly like "here's a reasonable alternative", but there really isn't.
- fsflover 6y ago> I wish I had something to add; particularly like "here's a reasonable alternative", but there really isn't. Yes, there are: https://en.wikipedia.org/wiki/Pinephone https://en.wikipedia.org/wiki/Pinephone and https://en.wikipedia.org/wiki/Librem_5 https://en.wikipedia.org/wiki/Librem_5.
- rorykoehler 6y agoWhy are they so under specced ?
- JoshTriplett 6y agoThey're first-generation devices, so the focus is on getting the device experience right, not on having flagship specifications. If they get the experience right, they'll likely come out with higher-spec devices in the future.
- noir_lord 6y agoEconomies of scale. If I want to buy 20 million of something the wholesale will give me a better price than if I want 2000. The marginal cost goes down with the number produced as well.
- YarickR2 6y agoDoes everyone want or need end to end encryption ? Like, majority of my SMS messages are alerts from various services I'm responsible for; I can't care less if they are encrypted
- fsflover 6y agohttps://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Nothing_to_hide_argument
- Jtsummers 6y ago1. E2E is a nice to have, not a strict need for me. 2. SMS is miserably useless on some carriers (notably when I had T-Mobile and for my friends still on T-Mobile). 3. MMS is miserably useless, period. 4. International SMS/MMS can be expensive, is more unreliable than domestic, and often unavailable. Given 2-4, I avoid SMS/MMS as much as possible. Given that E2E is available (WhatsApp, Signal, others), and those services are reliable, available, and useful, I may as well use an E2E system. The privacy aspects are a great additional feature that they offer.
- Tarq0n 6y agoThis is a kind of faulty reasoning that I've been seeing a lot lately, reasoning by majority case. If you receive 999 trivial text messages and then 1 with critical private information then it is still really bad for the defaults to not be private.
- headmelted 6y agoApple is only end-to-end encrypted until it isn’t though. iCloud Backups are still stored in the clear, solely to enable snooping.
- threeseed 6y agoiCloud Backups are encrypted but just not using the on-device key. Meaning that Apple can decrypt it when they are requested by authorities. https://support.apple.com/en-au/HT202303 https://support.apple.com/en-au/HT202303
- dividuum 6y agoSounds like clear text with extra steps. Given that iCloud data is stored on third-party services, using crypto is a necessary implementation step, but from the user's point of view it seems mostly irrelevant and isn't really different from storing it in clear-text at Apples servers directly. It's disappointing.
- threeseed 6y agoSecurity is not an area where you want to be sloppy with your choice of words. It is not clear text. It is encrypted and Apple has the key. The reason the distinction is important is that if it were clear text NSA/FBI etc could gain physical access to the servers and read the backups without Apple's knowledge or approval.
- JetSpiegel 6y ago> It is encrypted and Apple has the key. > The reason the distinction is important is that if it were clear text NSA/FBI etc could gain physical access to the servers and read the backups without Apple's knowledge or approval. Where does Apple store the keys? On the very same machines? It's like having a bulletproof lock, and storing the key under the potted plant.
- maxerickson 6y ago
- JoshTriplett 6y agoRCS is only used if you otherwise would have used SMS, which is also not end-to-end encrypted. I certainly think they should have added encryption, but RCS doesn't make things any worse than it already is, or make anything plaintext that would have been encrypted.
- thu2111 6y agoThey can't, it makes no sense to add such encryption to SMS. The end user would have to manually manage keys. It didn't make sense on WhatsApp or iMessage either of course but for different reasons - there the problem is the apps are a monopoly for that service. They can update at any time and alter the encryption as they see fit. They already did this to stop people forwarding messages on WhatsApp, which makes a mockery of the concept of e2e encryption.
- rrrrrrrrrrrryan 6y agoGoogle's always said e2ee is on the RCS roadmap, and evidence of it is already in some Google Messages builds. [1] It seems they decided the main hurdle is just to get all the carriers on board, and a basic version of RCS up and running on all the Android phones, and encryption didn't make it into the MVP. [1] https://www.theverge.com/2020/5/23/21268577/google-messages-end-to-end-encryption-rcs https://www.theverge.com/2020/5/23/21268577/google-messages-...