8 ms·

It’s worth noting that MMS is also how group messages are sent (SMS is 1:1 only). > The most popular messenger app in Switzerland and worldwide is WhatsApp. Ho

It’s worth noting that MMS is also how group messages are sent (SMS is 1:1 only). > The most popular messenger app in Switzerland and worldwide is WhatsApp. However, we do not recommend WhatsApp or Telegram for security reasons (problematic encryption and non-transparent data protection guidelines). But compared to MMS...

zibzab 5y ago
Yeah, no end-to-end encryption and all that. But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison.
- AniseAbyss 5y ago
  Easier for government to infiltrate a local mobile operator than getting into WhatsApp/Telegram/Signal etc. The revolution will be WhatsApped.
  - uf00lme 5y ago
    It might be easier for local government to control telcos but much more difficult for a foreign government when compared to what might be a secret court warrant etc.
    - AniseAbyss 5y ago
      If your opponent is the US government you are already doomed.
- ChuckNorris89 5y ago
  >But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison. Your comparison doesn't make sense. MMS has no need for 0-days as it's a basic communication protocol that has zero security to begin with. That's like saying "but how many 0-days does TCP-IP have?"
  - zibzab 5y ago
    Zero security in what sense? Is confidentiality of your messages the only thing you care about? Even that you won't get to keep once hit by a WhatsApp vulnerability.
    - ChuckNorris89 5y ago
      >once hit by a WhatsApp vulnerability Meh, and once you get hit by a car, you will die. But what are the realistic odds of that happening? You can also get hit by a an IOS or Android RCE 0-day, so you might as well give up using a smartphone if you feel the security risk is that high. Also, many of those RCE exploits used MMS for payload delivery, so your point of MMS shielding you from exploits is moot. In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure.
      - hulitu 5y ago
        > In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure. Well, most consumers do not accept the same argument for http vs https.
        ChuckNorris89 5y ago
        Ok, but what does that have to do with it? I never made any arguments on http vs https, so why are you going off topic? Consumers don't have any tradeoffs on https vs insecure http so this comparison is not even in the same ballpark.
      - zibzab 5y ago
        Dude, you are completely missing the point. All I am saying is that replacing a simple and well tested system with a complex and barely evaluated system is bad for security. And for the record, ALMOST ALL recent high profile hacks were related to WhatsApp.
- mjg59 5y ago
  MMS is a vehicle into your phone's media decoding stack, and there have definitely been vulnerabilities demonstrated using MMS as the delivery mechanism (eg,https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-1-introduction-to-qmage.html?m=1 https://googleprojectzero.blogspot.com/2020/07/mms-exploit-p...)
- advisedwang 5y ago
  At least one: https://www.theregister.com/2020/05/08/samsung_android_patches/ https://www.theregister.com/2020/05/08/samsung_android_patch... (https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://bugs.chromium.org/p/project-zero/issues/detail?id=20...)
izacus 5y ago
MMS is also used by Apple iPhone devices when sending group messages, images and media to non-Apple users. This functionality will now probably break, especially since Apple refuses to implement RCS protocol which would make cross-phone brand messaging comparable to iMessage itself.
- pmontra 5y ago
  How about switching to one or more among Telegram, WhatsApp, Messenger etc? Basically it's what everybody does in Europe. I'm getting SMSes only from banks, credit card companies and (sadly) 2FA. MMS, maybe one in the last 20 years because they used to be insanely expensive.
- sbuk 5y ago
  > Apple refuses to implement RCS protocol… And rightfully so. Apple supporting it won’t help the folks in Switzerland because Swisscom don’t support it. And why would they? They are clearly simplifying (cost saving) the stack. RCS is a poorly designed protocol with little to no carrier support outside of the US.
  - joenathanone 5y ago
    Chicken meet egg.
    - sbuk 5y ago
      I’d say not. Bad protocol that cost the carriers to use and no customer wants to pay for meet commercial reality would be more accurate.
  - akvadrako 5y ago
    Swisscom does support RCS https://community.swisscom.ch/t5/Telephony-Knowledge-Base/RCS-introducing-the-future-of-SMS-Message/ta-p/612475 https://community.swisscom.ch/t5/Telephony-Knowledge-Base/RC...
efitz 5y ago
Every group message I have received (100%) via MMS has been spam.
- zdragnar 5y ago
  When my family communicates via text, it is almost exclusively through MMS. YMMV.

zibzab 5y ago

Yeah, no end-to-end encryption and all that. But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison.

AniseAbyss 5y ago
Easier for government to infiltrate a local mobile operator than getting into WhatsApp/Telegram/Signal etc. The revolution will be WhatsApped.
- uf00lme 5y ago
  It might be easier for local government to control telcos but much more difficult for a foreign government when compared to what might be a secret court warrant etc.
  - AniseAbyss 5y ago
    If your opponent is the US government you are already doomed.
ChuckNorris89 5y ago
>But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison. Your comparison doesn't make sense. MMS has no need for 0-days as it's a basic communication protocol that has zero security to begin with. That's like saying "but how many 0-days does TCP-IP have?"
- zibzab 5y ago
  Zero security in what sense? Is confidentiality of your messages the only thing you care about? Even that you won't get to keep once hit by a WhatsApp vulnerability.
  - ChuckNorris89 5y ago
    >once hit by a WhatsApp vulnerability Meh, and once you get hit by a car, you will die. But what are the realistic odds of that happening? You can also get hit by a an IOS or Android RCE 0-day, so you might as well give up using a smartphone if you feel the security risk is that high. Also, many of those RCE exploits used MMS for payload delivery, so your point of MMS shielding you from exploits is moot. In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure.
    - hulitu 5y ago
      > In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure. Well, most consumers do not accept the same argument for http vs https.
      - ChuckNorris89 5y ago
        Ok, but what does that have to do with it? I never made any arguments on http vs https, so why are you going off topic? Consumers don't have any tradeoffs on https vs insecure http so this comparison is not even in the same ballpark.
    - zibzab 5y ago
      Dude, you are completely missing the point. All I am saying is that replacing a simple and well tested system with a complex and barely evaluated system is bad for security. And for the record, ALMOST ALL recent high profile hacks were related to WhatsApp.
mjg59 5y ago
MMS is a vehicle into your phone's media decoding stack, and there have definitely been vulnerabilities demonstrated using MMS as the delivery mechanism (eg,https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-1-introduction-to-qmage.html?m=1 https://googleprojectzero.blogspot.com/2020/07/mms-exploit-p...)
advisedwang 5y ago
At least one: https://www.theregister.com/2020/05/08/samsung_android_patches/ https://www.theregister.com/2020/05/08/samsung_android_patch... (https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://bugs.chromium.org/p/project-zero/issues/detail?id=20...)

izacus 5y ago

MMS is also used by Apple iPhone devices when sending group messages, images and media to non-Apple users. This functionality will now probably break, especially since Apple refuses to implement RCS protocol which would make cross-phone brand messaging comparable to iMessage itself.

pmontra 5y ago
How about switching to one or more among Telegram, WhatsApp, Messenger etc? Basically it's what everybody does in Europe. I'm getting SMSes only from banks, credit card companies and (sadly) 2FA. MMS, maybe one in the last 20 years because they used to be insanely expensive.
sbuk 5y ago
> Apple refuses to implement RCS protocol… And rightfully so. Apple supporting it won’t help the folks in Switzerland because Swisscom don’t support it. And why would they? They are clearly simplifying (cost saving) the stack. RCS is a poorly designed protocol with little to no carrier support outside of the US.
- joenathanone 5y ago
  Chicken meet egg.
  - sbuk 5y ago
    I’d say not. Bad protocol that cost the carriers to use and no customer wants to pay for meet commercial reality would be more accurate.
- akvadrako 5y ago
  Swisscom does support RCS https://community.swisscom.ch/t5/Telephony-Knowledge-Base/RCS-introducing-the-future-of-SMS-Message/ta-p/612475 https://community.swisscom.ch/t5/Telephony-Knowledge-Base/RC...

efitz 5y ago

Every group message I have received (100%) via MMS has been spam.

zdragnar 5y ago
When my family communicates via text, it is almost exclusively through MMS. YMMV.