5 ms·

I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard: * I ask a seller on FB marketplace to send me some

by bb123 5y ago

I wouldn't want this at all. Just off the top of my head I can think of a ton of use cases this makes hard: * I ask a seller on FB marketplace to send me some pictures of an item * I need to send pictures of some documents to my solicitor * A new friend I've just met in a bar tries to send me her contact card * My mechanic tries to send me a PDF of the invoice for his work Sure, there are ways around all of these, but it makes iMessage (or any messaging service) a lot less useful.

dannyw 5y ago
All of this can be on a "Tap to view" basis for the first media received. Right now, iMessage processes everything in the background upon receiving. That enables zero click, instantly delete message attacks. The only trace you have is a random imessage sound, or vibrate, with no corresponding notification. Can be tuned to send at 4am when most people have do not disturb on.
- KaiserPro 5y ago
  This a million times. Whatsapp of all things has this. (mostly to save on bandwidth, because whatsapp as all about efficiency at one point) There is no real reason to auto process untrusted data. I would have thought we'd learnt from the years of exploits outlook dealt with in the late 90s/early 2000s.
  - ricktdotorg 5y ago
    Sometimes my dad sends me photos over Whatsapp, and I have noticed that they appear in my Photos app before I have opened/viewed the actual Whatsapp message. I assume that this is happening because i have given Whatsapp access to my Photos. But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments.
    - KaiserPro 5y ago
      for those that don't know how to turn it off: settings -> storage & data -> media auto download > But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments. For me at least, on iOS whatsapp doesn't insert pictures and video into my photostream even if I tap "download"
- cmg 5y ago
  Except people want to view the content. If they think my friend has sent a picture, or a business has sent an invoice, they're likely to click it. Especially in the 3 receiving situations that bb123 outlined (1, 3 and 4) you're not likely to have the contact info, or it's plausible that the person could be using another phone to send that message. Now - I know to check the sender, don't click strange links, all of that. I run trainings on how to avoid phishing and improve personal & organizational digital security. But it comes down to the fact that people are using technology as a tool. Apple made headway with BlastDoor but it's clearly not good enough.

by bb123 5y ago

dannyw 5y ago

All of this can be on a "Tap to view" basis for the first media received. Right now, iMessage processes everything in the background upon receiving. That enables zero click, instantly delete message attacks. The only trace you have is a random imessage sound, or vibrate, with no corresponding notification. Can be tuned to send at 4am when most people have do not disturb on.

KaiserPro 5y ago
This a million times. Whatsapp of all things has this. (mostly to save on bandwidth, because whatsapp as all about efficiency at one point) There is no real reason to auto process untrusted data. I would have thought we'd learnt from the years of exploits outlook dealt with in the late 90s/early 2000s.
- ricktdotorg 5y ago
  Sometimes my dad sends me photos over Whatsapp, and I have noticed that they appear in my Photos app before I have opened/viewed the actual Whatsapp message. I assume that this is happening because i have given Whatsapp access to my Photos. But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments.
  - KaiserPro 5y ago
    for those that don't know how to turn it off: settings -> storage & data -> media auto download > But, it does appear that attachment/image processing is happening via Whatsapp without my control/without my viewing the message + its attachments. For me at least, on iOS whatsapp doesn't insert pictures and video into my photostream even if I tap "download"
cmg 5y ago
Except people want to view the content. If they think my friend has sent a picture, or a business has sent an invoice, they're likely to click it. Especially in the 3 receiving situations that bb123 outlined (1, 3 and 4) you're not likely to have the contact info, or it's plausible that the person could be using another phone to send that message. Now - I know to check the sender, don't click strange links, all of that. I run trainings on how to avoid phishing and improve personal & organizational digital security. But it comes down to the fact that people are using technology as a tool. Apple made headway with BlastDoor but it's clearly not good enough.