5 ms·

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly u

A small way to reduce attack surface - have iMessage just setup for your iCloud email address instead of phone number. Phone numbers are becoming increasingly useless. > In fact, Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely. There's a checkbox in Settings > Messages that does exactly this? It seems strange they published this.

kevingadd 5y ago
Maybe what they mean is that some or all of the iMessage code is still running on the device even if you disable it?
- judge2020 5y ago
  SMS will still enter through Messages.app if you have SMS enabled through your carrier and plan. But no, iMessage is not used when it's disabled.
easton 5y ago
SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.
- gruez 5y ago
  >SMS is also exploitable though, right it's less feature rich, so presumably there's less attack surface.
- codetrotter 5y ago
  > you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-only plans available in Norway support BankID, or if you need a regular subscription like I have now in order to use that.
  - vxNsr 5y ago
    I know both TMobile and ATT frown upon this and have been known to shut down accounts that do this. Data only is for non-phone accounts in their eyes and anyone trying to circumvent that is committing some sorta fraud (in their eyes).
  - p49k 5y ago
    Data-only subscriptions can still receive SMS messages in my experience, you just can't send them.
    - hexa22 5y ago
      And you still need them because some services only provide sms verification.
      - hirako2000 5y ago
        And we don't need those services. We just want them for convenience. The data only plans is is good path to follow, it at least makes it more obvious each time a service clearly wants too much personal data.
        lpghatguy 5y ago
        Okay then, let me just go close my bank account then. It's just a convenience. :P
        hirako2000 5y ago
        It is a convenience difficult to live without I can give you that. But so many other services we can't imagine living without require a cellular number. Accepting a flawed authentication mechanism and legal but abusive privacy breaches is what have kept them up and running. This threat demonstrates how difficult it is to keep us safe from hacks. We can keep our bank account and one day have to deal with fraud recovery, or we can ask them to stop, some banks 2fa activation via a voice call. Until banks cease to dominate and control our finances, we should at least do what we can protect ourselves from their incompetence.
CyberRage 5y ago
whatsapp doesn't rely on SMS protocols nor does it rely solely on phone numbers but is still being exploited quite often. Instant-Messaging = Worthy target for exploits. Just like web-browsers get exploited after years of patching.
- passerby1 5y ago
  >whatsapp doesn't rely on SMS protocols Wrong. Whatsapp relies on SMS as 2FA OTP.
  - saagarjha 5y ago
    I don't think that is the context that the commenter was using when they said WhatsApp doesn't rely on SMS.
  - CyberRage 5y ago
    Well that has nothing to do with the subject. the subject is zero-click exploits, this is not regarding authentication. The point of these apps is that I can get content(picture, message, video etc) to your local device and it get processed.
sneak 5y ago
iCloud isn't end to end encrypted for the most part - anyone security conscious should be avoiding iCloud in the first place.
SV_BubbleTime 5y ago
> email address instead of phone number. Phone numbers are becoming increasingly useless. Fantastic way to not have people send you messages anymore. Phone numbers are technically becoming useless. They are practically still the by far dominant choice when someone goes to send you a new message. We’ve had decades of texting phone numbers to reinforce this.
rsync 5y ago
"... Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely." You can do this already. If you "manage" your iphone with Apple Configurator you have fine-grained control over every little thing it does. You can disable imessage (and many other things like the app store, etc.)
- neilalexander 5y ago
  You can disable iMessage just by going into the Settings and turning the “iMessage” toggle to off. You don’t need to supervise the device or install a profile.
mrweasel 5y ago
> Phone numbers are becoming increasingly useless. Not really, there's a ton of government services that require you to have a phone number (depending on where you live). I don't see any real suggestion for an alternative to having a phone number. If nothing else, to receiving notification. You can't really rely on iMessage, WhatsApp, Signal and similar services, you need one system that you're sure will cover 98% for all people. 3. parties can't even integrate into many of these services. You could use email, but I don't really see how that's any better and many seniors will use SMS, but not email to any great extend. SMS is still the only unified messaging service you can be sure that all your friends and family will have.
- tofukid 5y ago
  I use voip.ms and have SMS forwarded to my email. I can also reply via email. I only use a phone number for services that require one. Family and friends I will use email, iMessage, or Signal.
  - mrweasel 5y ago
    So you do still have a phone number, just not a SIM.
BiteCode_dev 5y ago
Nope, when I'm on the go, I certainly have a way better communication using phone calls than whatever VOIP du jour. Phone numbers, like emails, are very robust and reliable, interoperable, not centralized to one entity, and the quality of service vs cost ratio is excellent. Not to mention text messages: - they work no matter if the person is using whatsapp, telegram, signal or the new hype stuff - no GAFAM is collecting my text history to sell me ads - they require no internet connection There are 3 things that we must absolutely cherish and preserve in this race for tech: cash, emails and phone numbers. They are a beacon of stability in this sea of ever moving innovation greed. And I say that while I'm thinking about setting up an IFPS website, compiling python 3.10 beta to test it and buy a secondary e-ink screen for my laptop. I'm not technophobic.
- mavhc 5y ago
  Email and SMS aren't reliable, you've no way to know if they've been read. SMS is unencrypted so someone's harvesting your data. They require a cell tower connection, that's only 1 step away from an internet connection, probably 0 in many cases. Cash and Phone numbers are trivial to steal.
  - thebean11 5y ago
    > Email and SMS aren't reliable, you've no way to know if they've been read. Most people do not want this feature. 9/10 of my iMessage contacts turn off read receipts; I bet the number would be similar on Facebook/Whatsapp if they allowed it.
  - BiteCode_dev 5y ago
    > Email and SMS aren't reliable, you've no way to know if they've been read. For me, ephemerality, one-shot, and unidirectionality are characteristics, not issues. > SMS is unencrypted so someone's harvesting your data. There is not a single entity that is getting all of it, which is the most important to me. Encryption is nice, but for most of my communications, that's not the most important feature. > They require a cell tower connection, that's only 1 step away from an internet connection, probably 0 in many cases. I'm regularly in situations where the phone works, but not internet. On the move, or in the country side. > Cash and Phone numbers are trivial to steal. Sure, and so is a bike. But I don't always want to take the bus.
fuj 5y ago
> Phone numbers are becoming increasingly useless. What living in a bubble looks like...

kevingadd 5y ago

Maybe what they mean is that some or all of the iMessage code is still running on the device even if you disable it?

judge2020 5y ago
SMS will still enter through Messages.app if you have SMS enabled through your carrier and plan. But no, iMessage is not used when it's disabled.

easton 5y ago

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

gruez 5y ago
>SMS is also exploitable though, right it's less feature rich, so presumably there's less attack surface.
codetrotter 5y ago
> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-only plans available in Norway support BankID, or if you need a regular subscription like I have now in order to use that.
- vxNsr 5y ago
  I know both TMobile and ATT frown upon this and have been known to shut down accounts that do this. Data only is for non-phone accounts in their eyes and anyone trying to circumvent that is committing some sorta fraud (in their eyes).
- p49k 5y ago
  Data-only subscriptions can still receive SMS messages in my experience, you just can't send them.
  - hexa22 5y ago
    And you still need them because some services only provide sms verification.
    - hirako2000 5y ago
      And we don't need those services. We just want them for convenience. The data only plans is is good path to follow, it at least makes it more obvious each time a service clearly wants too much personal data.
      - lpghatguy 5y ago
        Okay then, let me just go close my bank account then. It's just a convenience. :P
        hirako2000 5y ago
        It is a convenience difficult to live without I can give you that. But so many other services we can't imagine living without require a cellular number. Accepting a flawed authentication mechanism and legal but abusive privacy breaches is what have kept them up and running. This threat demonstrates how difficult it is to keep us safe from hacks. We can keep our bank account and one day have to deal with fraud recovery, or we can ask them to stop, some banks 2fa activation via a voice call. Until banks cease to dominate and control our finances, we should at least do what we can protect ourselves from their incompetence.

CyberRage 5y ago

whatsapp doesn't rely on SMS protocols nor does it rely solely on phone numbers but is still being exploited quite often. Instant-Messaging = Worthy target for exploits. Just like web-browsers get exploited after years of patching.

passerby1 5y ago
>whatsapp doesn't rely on SMS protocols Wrong. Whatsapp relies on SMS as 2FA OTP.
- saagarjha 5y ago
  I don't think that is the context that the commenter was using when they said WhatsApp doesn't rely on SMS.
- CyberRage 5y ago
  Well that has nothing to do with the subject. the subject is zero-click exploits, this is not regarding authentication. The point of these apps is that I can get content(picture, message, video etc) to your local device and it get processed.

sneak 5y ago

iCloud isn't end to end encrypted for the most part - anyone security conscious should be avoiding iCloud in the first place.

SV_BubbleTime 5y ago

> email address instead of phone number. Phone numbers are becoming increasingly useless. Fantastic way to not have people send you messages anymore. Phone numbers are technically becoming useless. They are practically still the by far dominant choice when someone goes to send you a new message. We’ve had decades of texting phone numbers to reinforce this.

rsync 5y ago

"... Citizen Lab researchers and others suggest that Apple should simply provide an option to disable iMessage entirely." You can do this already. If you "manage" your iphone with Apple Configurator you have fine-grained control over every little thing it does. You can disable imessage (and many other things like the app store, etc.)

neilalexander 5y ago
You can disable iMessage just by going into the Settings and turning the “iMessage” toggle to off. You don’t need to supervise the device or install a profile.

mrweasel 5y ago

> Phone numbers are becoming increasingly useless. Not really, there's a ton of government services that require you to have a phone number (depending on where you live). I don't see any real suggestion for an alternative to having a phone number. If nothing else, to receiving notification. You can't really rely on iMessage, WhatsApp, Signal and similar services, you need one system that you're sure will cover 98% for all people. 3. parties can't even integrate into many of these services. You could use email, but I don't really see how that's any better and many seniors will use SMS, but not email to any great extend. SMS is still the only unified messaging service you can be sure that all your friends and family will have.

tofukid 5y ago
I use voip.ms and have SMS forwarded to my email. I can also reply via email. I only use a phone number for services that require one. Family and friends I will use email, iMessage, or Signal.
- mrweasel 5y ago
  So you do still have a phone number, just not a SIM.

BiteCode_dev 5y ago

Nope, when I'm on the go, I certainly have a way better communication using phone calls than whatever VOIP du jour. Phone numbers, like emails, are very robust and reliable, interoperable, not centralized to one entity, and the quality of service vs cost ratio is excellent. Not to mention text messages: - they work no matter if the person is using whatsapp, telegram, signal or the new hype stuff - no GAFAM is collecting my text history to sell me ads - they require no internet connection There are 3 things that we must absolutely cherish and preserve in this race for tech: cash, emails and phone numbers. They are a beacon of stability in this sea of ever moving innovation greed. And I say that while I'm thinking about setting up an IFPS website, compiling python 3.10 beta to test it and buy a secondary e-ink screen for my laptop. I'm not technophobic.

mavhc 5y ago
Email and SMS aren't reliable, you've no way to know if they've been read. SMS is unencrypted so someone's harvesting your data. They require a cell tower connection, that's only 1 step away from an internet connection, probably 0 in many cases. Cash and Phone numbers are trivial to steal.
- thebean11 5y ago
  > Email and SMS aren't reliable, you've no way to know if they've been read. Most people do not want this feature. 9/10 of my iMessage contacts turn off read receipts; I bet the number would be similar on Facebook/Whatsapp if they allowed it.
- BiteCode_dev 5y ago
  > Email and SMS aren't reliable, you've no way to know if they've been read. For me, ephemerality, one-shot, and unidirectionality are characteristics, not issues. > SMS is unencrypted so someone's harvesting your data. There is not a single entity that is getting all of it, which is the most important to me. Encryption is nice, but for most of my communications, that's not the most important feature. > They require a cell tower connection, that's only 1 step away from an internet connection, probably 0 in many cases. I'm regularly in situations where the phone works, but not internet. On the move, or in the country side. > Cash and Phone numbers are trivial to steal. Sure, and so is a bike. But I don't always want to take the bus.

fuj 5y ago

> Phone numbers are becoming increasingly useless. What living in a bubble looks like...