3 ms·

I know you mean well, but uninformed "why don't they just...?" ideas are a pet peeve of mine. I'll leave it at that. You may want to read up on the particulars

I know you mean well, but uninformed "why don't they just...?" ideas are a pet peeve of mine. I'll leave it at that. You may want to read up on the particulars of the Messages component known as "BlastDoor". Start here: https://support.apple.com/guide/security/how-imessage-sends-and-receives-messages-sec70e68c949/web https://support.apple.com/guide/security/how-imessage-sends-... And then Google for terms like "messages blastdoor" for more in-depth particulars. Here's one such good result: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

extreme_eagle 5y ago
I know perfectly well how BlastDoor works, and I think maybe you are not the audience that this is intended for. This is not a "Why don't they just". It is an exact solution which resolves the issue in a way which is radically alternative to the current structure. They are trying to abstract the parsing, what must be done is prevent it entirely and relegate the flow of messages to the user-side. Assume that the attacker will inherently compromise the messaging structure and make it to where they don't have access to it instead.
- runjake 5y ago
  Yeah, I guess I am misunderstanding what you are trying to say, then, because from my interpretation, this more or less sounds like BlastDoor, but with an added user/contact component. Adding the user component sounds like an interesting idea, but you've still got to parse the/a payload to get to that. And if you're looking to a zero trust style model, you definitely don't want security decisions put to users (aka "Grandpa Bob"), as demonstrated by email spam/phishing/malware.
  - rdtwo 5y ago
    Most users aren’t affected by this level of attack but some people need the extra security and can live with the inconvenience

extreme_eagle 5y ago

I know perfectly well how BlastDoor works, and I think maybe you are not the audience that this is intended for. This is not a "Why don't they just". It is an exact solution which resolves the issue in a way which is radically alternative to the current structure. They are trying to abstract the parsing, what must be done is prevent it entirely and relegate the flow of messages to the user-side. Assume that the attacker will inherently compromise the messaging structure and make it to where they don't have access to it instead.

runjake 5y ago
Yeah, I guess I am misunderstanding what you are trying to say, then, because from my interpretation, this more or less sounds like BlastDoor, but with an added user/contact component. Adding the user component sounds like an interesting idea, but you've still got to parse the/a payload to get to that. And if you're looking to a zero trust style model, you definitely don't want security decisions put to users (aka "Grandpa Bob"), as demonstrated by email spam/phishing/malware.
- rdtwo 5y ago
  Most users aren’t affected by this level of attack but some people need the extra security and can live with the inconvenience