38 ms·

Wouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ? So it will stay the same for p

Wouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ? So it will stay the same for people in your contact list but a new touch to load for message from unknown person

CyberRage 5y ago
That might sound good in theory by in practice it's unlikely to go well(by default). Many services from banks to healthcare utilize SMS as a main way of communicating with end-users. many rely on dynamic numbers. Moreover, spoofing SMS messages is not that hard. Messaging apps whether it is SMS or alternatives like whatsapp, telegram etc. will always offer a powerful vector to infect devices.
- lostmsu 5y ago
  I think banks don't use inline media in their messages too often.
  - CyberRage 5y ago
    It is part of my job. many banks do. often embarrassingly so.
- KaiserPro 5y ago
  you have made an argument against _never_ parsing media from untrusted _SMSs_ This is iMessage, and instead of _never_ parsing, requiring user action to parse. It will cut out the majority of the noclick exploits, and make iphones safer for most people. This of course doesn't protect against spear phishing. But it should give apple time to fix their shit.
est31 5y ago
https://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs
- xvector 5y ago
  A reasonable trade-off would be disabling parsing for people not in your contacts list.
- harg 5y ago
  For the general population this probably applies, but in the case of this exploit it looks like it's targeted at specific individuals. If you were someone being targeted by an oppressive government, for example, you might be a bit more cautious when clicking on suspicious-looking incoming media so I think the suggestion has value.
  - est31 5y ago
    Fair point. The point still stands but in a weaker way though. Even people who say/claim they care make mistakes. The idea is that contacts can still send you media without prior approval. Do their children never make mistakes? Do their spouses/gardeners/etc.?

CyberRage 5y ago

That might sound good in theory by in practice it's unlikely to go well(by default). Many services from banks to healthcare utilize SMS as a main way of communicating with end-users. many rely on dynamic numbers. Moreover, spoofing SMS messages is not that hard. Messaging apps whether it is SMS or alternatives like whatsapp, telegram etc. will always offer a powerful vector to infect devices.

lostmsu 5y ago
I think banks don't use inline media in their messages too often.
- CyberRage 5y ago
  It is part of my job. many banks do. often embarrassingly so.
KaiserPro 5y ago
you have made an argument against _never_ parsing media from untrusted _SMSs_ This is iMessage, and instead of _never_ parsing, requiring user action to parse. It will cut out the majority of the noclick exploits, and make iphones safer for most people. This of course doesn't protect against spear phishing. But it should give apple time to fix their shit.

est31 5y ago

https://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs

xvector 5y ago
A reasonable trade-off would be disabling parsing for people not in your contacts list.
harg 5y ago
For the general population this probably applies, but in the case of this exploit it looks like it's targeted at specific individuals. If you were someone being targeted by an oppressive government, for example, you might be a bit more cautious when clicking on suspicious-looking incoming media so I think the suggestion has value.
- est31 5y ago
  Fair point. The point still stands but in a weaker way though. Even people who say/claim they care make mistakes. The idea is that contacts can still send you media without prior approval. Do their children never make mistakes? Do their spouses/gardeners/etc.?