4 ms·

Contrary to the article, blocking ALL media besides plain text from random senders who aren't in your contacts is exactly what most people would want and should

Contrary to the article, blocking ALL media besides plain text from random senders who aren't in your contacts is exactly what most people would want and should be the default. I don't see any downsides to that approach.

bb123 5y ago
I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard: * I ask a seller on FB marketplace to send me some pictures of an item * I need to send pictures of some documents to my solicitor * A new friend I've just met in a bar tries to send me her contact card * My mechanic tries to send me a PDF of the invoice for his work Sure, there are ways around all of these, but it makes iMessage (or any messaging service) a lot less useful.
- dannyw 5y ago
  All of this can be on a "Tap to view" basis for the first media received. Right now, iMessage processes everything in the background upon receiving. That enables zero click, instantly delete message attacks. The only trace you have is a random imessage sound, or vibrate, with no corresponding notification. Can be tuned to send at 4am when most people have do not disturb on.
  - KaiserPro 5y ago
    This a million times. Whatsapp of all things has this. (mostly to save on bandwidth, because whatsapp as all about efficiency at one point) There is no real reason to auto process untrusted data. I would have thought we'd learnt from the years of exploits outlook dealt with in the late 90s/early 2000s.
    - ricktdotorg 5y ago
      Sometimes my dad sends me photos over Whatsapp, and I have noticed that they appear in my Photos app before I have opened/viewed the actual Whatsapp message. I assume that this is happening because i have given Whatsapp access to my Photos. But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments.
      - KaiserPro 5y ago
        for those that don't know how to turn it off: settings -> storage & data -> media auto download > But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments. For me at least, on iOS whatsapp doesn't insert pictures and video into my photostream even if I tap "download"
  - cmg 5y ago
    Except people want to view the content. If they think my friend has sent a picture, or a business has sent an invoice, they're likely to click it. Especially in the 3 receiving situations that bb123 outlined (1, 3 and 4) you're not likely to have the contact info, or it's plausible that the person could be using another phone to send that message. Now - I know to check the sender, don't click strange links, all of that. I run trainings on how to avoid phishing and improve personal & organizational digital security. But it comes down to the fact that people are using technology as a tool. Apple made headway with BlastDoor but it's clearly not good enough.
upofadown 5y ago
Perhaps this idea could be extended to treating content differently for all messages from unverified identities. Getting people to verify identities in an end to end encryption system is a huge problem. This could provide a conceptual hook that would mean that unverified contacts were untrustworthy contacts. This would be a state, rather than something that you get nagged about from time to time. Otherwise an attacker will usually be able to figure out a way to fake a message from someone already in your contact list. Of course iMessage doesn't do identity verification which is why it does not have effective end to end encryption in the first place. So they would have to solve that, perhaps larger problem, first.
webinvest 5y ago
Or anyone that you haven’t replied to yet. I text many people who aren’t in my contacts.

bb123 5y ago

I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard: * I ask a seller on FB marketplace to send me some pictures of an item * I need to send pictures of some documents to my solicitor * A new friend I've just met in a bar tries to send me her contact card * My mechanic tries to send me a PDF of the invoice for his work Sure, there are ways around all of these, but it makes iMessage (or any messaging service) a lot less useful.

dannyw 5y ago
All of this can be on a "Tap to view" basis for the first media received. Right now, iMessage processes everything in the background upon receiving. That enables zero click, instantly delete message attacks. The only trace you have is a random imessage sound, or vibrate, with no corresponding notification. Can be tuned to send at 4am when most people have do not disturb on.
- KaiserPro 5y ago
  This a million times. Whatsapp of all things has this. (mostly to save on bandwidth, because whatsapp as all about efficiency at one point) There is no real reason to auto process untrusted data. I would have thought we'd learnt from the years of exploits outlook dealt with in the late 90s/early 2000s.
  - ricktdotorg 5y ago
    Sometimes my dad sends me photos over Whatsapp, and I have noticed that they appear in my Photos app before I have opened/viewed the actual Whatsapp message. I assume that this is happening because i have given Whatsapp access to my Photos. But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments.
    - KaiserPro 5y ago
      for those that don't know how to turn it off: settings -> storage & data -> media auto download > But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments. For me at least, on iOS whatsapp doesn't insert pictures and video into my photostream even if I tap "download"
- cmg 5y ago
  Except people want to view the content. If they think my friend has sent a picture, or a business has sent an invoice, they're likely to click it. Especially in the 3 receiving situations that bb123 outlined (1, 3 and 4) you're not likely to have the contact info, or it's plausible that the person could be using another phone to send that message. Now - I know to check the sender, don't click strange links, all of that. I run trainings on how to avoid phishing and improve personal & organizational digital security. But it comes down to the fact that people are using technology as a tool. Apple made headway with BlastDoor but it's clearly not good enough.

upofadown 5y ago

Perhaps this idea could be extended to treating content differently for all messages from unverified identities. Getting people to verify identities in an end to end encryption system is a huge problem. This could provide a conceptual hook that would mean that unverified contacts were untrustworthy contacts. This would be a state, rather than something that you get nagged about from time to time. Otherwise an attacker will usually be able to figure out a way to fake a message from someone already in your contact list. Of course iMessage doesn't do identity verification which is why it does not have effective end to end encryption in the first place. So they would have to solve that, perhaps larger problem, first.

webinvest 5y ago

Or anyone that you haven’t replied to yet. I text many people who aren’t in my contacts.