17 ms·

Most businesses, consumers, and developers universally continue to ignore the primary reason that iMessage is a closed platform, rather than an app on every pla

Most businesses, consumers, and developers universally continue to ignore the primary reason that iMessage is a closed platform, rather than an app on every platform as iTunes is: Apple is using device serial numbers for anti-spam, supported by a fully-authenticated hardware and software stack that does not allow user modification. This permits Apple to simply “console ban” any Apple device that spams on iMessage. This makes it prohibitively expensive to send spam over iMessage. They have been doing so since iMessage was launched. Android offers no such attestation that I’m aware of. Windows, on Pluton, could offer this attestation securely — and that is a key deliverable of Pluton. It’s easy, then, to predict what Apple’s first non-Apple platform will be: Microsoft Windows 12, only if secure-booted, with Pluton-signed attestation that the kernel is unmodified. And it’s easy to predict how Apple will implement anti-spam: by applying “console” bans to specific Pluton chips by their serial number. If Android wants to join the party, then Android phone builders need to implement secure boot with hardware-signed attestation of non-rooted-ness, in the style of Apple T2 + macOS or Microsoft Pluton + Secure Boot. Until then, Apple iMessage will remain single platform. (I recognize that this is extremely unpalatable to device hackers, but the same freedom to modify an OS kernel that hackers desire is also the freedom to spam all users, as we have seen repeatedly with all messaging software platforms operated without hardware-backed attestation for the past thirty years — including email, Jabber, and HN itself.) (No, I do not work at Apple.)

upbeat_general 4y ago
This is just wrong because as others have pointed out, you can have a fully virtualized macOS environment with no secure boot or any kind and iMessage will run just fine. Also, since basically every device that receives message also receives sms, isn’t this irrelevant?
gofreddygo 4y ago
So the reason to track and identify every app on every device and have a switch to remotely brick it is to reduce spam ? My BS detectors just tripped. Would you be ok if your home had the same "security" features? Say BigCo home builders install a front door, sensors, cameras and scanners in your home that allow them to monitor track and remotely lock you out of your home, your water and power supply ? Their reason? ... so that they can shutdown "bad neighbors" and keep the neighborhood "clean". And remember there's no fkin way you can get rid of those scanners, cameras and other control mechanisms. But ya'know they gave you a piece of paper that says "we respect your privacy" with BigCo logo on it ? I don't get why Apple, MS or anyone should be able to get away with this.
lern_too_spel 4y ago
Attestation is service that can only be provided by the builder of the phone. Most commercially available Android phones provide this, and banks and DRM rely on it. https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation and https://developer.android.com/google/play/integrity/overview https://developer.android.com/google/play/integrity/overview
- altairprime 4y ago
  That API is not useful for anti-spam purposes, as individual devices cannot be banned for spamming by their serial number. Quoting that page: > The API is not designed to fulfill the following use cases: > Contain signals for app-specific use-cases, such as device identifiers
  - lern_too_spel 4y ago
    That can be built trivially using this API. The app stores an identifier, which it knows has not been tampered with because of attestation. Giving apps access to a unique device identifier shared across apps is a privacy leak but can be obtained with the proper scary permission.
    - altairprime 4y ago
      > Giving apps access to a unique device identifier shared across apps is a privacy leak Correct: 'Non-heuristic antispam' and 'Private device identifiers' are incompatible requirements, unless you introduce another expensive obstacle to overcome. Spamming depends on cheap/free sock puppet accounts. The cost per account is inversely proportional to the value it holds to spammers. That cost can be in Apple's iMessage terms: $100+ per serial number, all devices must include burned-in serial number attestation in their server communications. Or that cost can be in bureaucracy: $10 per notarized "account signup request with verified citizenship", but now all communications can be associated with the notary's logs of your citizenship ID number. There is no way to stop spam without incurring one or another cost to each user. Apple's method doesn't care who you are, so long as you possess Apple hardware. The Pluton method wouldn't either. What other methods exist that are unconcerned with the exact identity of the user, but still make spamming unprofitable?
dt2m 4y ago
This is a great point which I haven't heard before in this age-old debate. But until Apple's dominance starts to wane, there's no chance in hell they will provide iMessage for other platforms unless forced by regulation. If push comes to shove, they can implement heuristics which run texts from non-Apple devices through a harder spam filter. Spam isn't non-existent on the iMessage network, and there already seems to be a rudimentary spam filter in place.
- jacooper 4y ago
  Well Apple is going to be forced anyway, the EU's Digital Markets Act will be enforced soon. And fines are up to 20% of global revenue.
  - ghaff 4y ago
    Is iMessage a "Number-independent interpersonal communication services (e.g., messengers)"? It's a messenger but it's based on phone numbers AFAIK--unlike something like WhatsApp.
    - rdsnsca 4y ago
      It is, I use it from my Mac Mini without owing an iPhone.
    - frumper 4y ago
      You can sign up and use an email for iMessage through wifi
      - ghaff 4y ago
        Ah. I've only used it as a default SMS alternative on Apple devices including iPhone.
  - Seanambers 4y ago
    As an iPhone user I do not like EU dictating how Apple software should work at all. The same with chargers as well. Sure we can all have a discussion about how it should work - but having bureaucrats decide is the worst idea ever.
wilde 4y ago
This doesn’t work though. I receive enough iMessage spam specifically through Apple ids that I wish I could disable the ability to message me unless you use a phone number.
- Tagbert 4y ago
  I believe that is SMS spam originating from outside of iMessage
  - frumper 4y ago
    I definitely get iMessage spam
    - rootusrootus 4y ago
      If you're 100% sure it's iMessage and not SMS, report it to Apple. They can ban that account.
      - altairprime 4y ago
        They’ll ban the entire device used to send it, not just the one account. But see also elsethread “wait, how do I know this was delivered over iMessage”, since MMS allows the From field to be an email address.
        selectodude 4y ago
        On the top of the first message it'll either say Text Message or iMessage. If it's an iMessage and you delete the thread without replying, it'll ask if you want to report the message as spam.
        deleted 4y ago
        [deleted]
      - neop1x 4y ago
        How would you prove the account is sending spam? By sending them screenshots? Will they believe you? This could be used to ban a neighbor I don't like. Or does Apple spy all conversations so they can check themselves? :P
kelnos 4y ago
I'd rather live in a world with spam than a world where corporations get to decide what I run on my devices, and cripple a bunch of critical applications if I decide I want to, y'know, actually do whatever I want with the hardware I own. I'm not unsympathetic to Apple's difficulties and goals here (assuming this spam problem is actually the reason, though I'm skeptical that there aren't also self-serving reasons that would be sufficient for Apple), but I'm so tired of society's slide toward "security at any cost, and to hell with freedom" since the 9/11 attacks over 20 years ago. (It's possible and likely that slide has been going on much longer, but I was a teenager in the 90s and not really aware of such things. But I think it's undeniable that the aftermath of 9/11 was a big turning point for the surveillance state and for average citizens being so scared of everything that they'd be willing to give up essential freedoms just to quell that fright.)
- rootusrootus 4y ago
  > I'd rather live in a world with spam than a world where corporations get to decide what I run on my devices, and cripple a bunch of critical applications if I decide I want to, y'know, actually do whatever I want with the hardware I own. Egads, no. The abuse heaped on me by Apple pales in comparison to the spam phone calls and emails I get. If I start getting spam via iMessage, I'll be an extremely unhappy camper. It already happens with text messages and that's bad enough.
  - kelnos 4y ago
    Sounds like other people in this thread already get a lot of iMessage spam, so I guess you've just been lucky? And it shows that this attestation junk doesn't actually curb the spam problem, so it's just an analogue of security theater. Anyhow, sure, if you want to give away your freedom to actually own your devices, just so you don't get spam... I guess that's your choice. I just don't want to be locked into a system where that's the only choice. Regardless, iPhones also receive SMSes. If it's impossible to spam over iMessage, they'll just use SMS. If it becomes impossible to spam over SMS, then presumably Apple can implement similar measures for iMessage that don't require us all to have hermetically-sealed, locked-down devices.
AnthonyMouse 4y ago
This is a lawyer excuse. I've had Signal for years and the number of spam messages I've received over it is none. It's not a real problem. SMS on the other hand... but iPhones receive SMS too, don't they?
- altairprime 4y ago
  Signal is not a profitable target for spammers. Those using it are least likely to be caught by spam.
  - deleted 4y ago
    [deleted]
- Spivak 4y ago
  Hate to be the bearer of bad news but that’s because Signal is teeny tiny. If Signal makes it to a billion users I guarantee it will happen to them.
  - AnthonyMouse 4y ago
    SMS is bigger than even iMessage, so if you can spam everyone with iMessage and more by using SMS, why would anyone bother with iMessage?
    - 8note 4y ago
      Bigger doesn't necessarily mean more profitable. IMessage is full of profitable phone owners
      - goosedragons 4y ago
        That receive messages over SMS in the same app... What's the advantage of iMessage spam? Group chat spam? Higher quality video spam? Is that worth all the effort to do your spamming only on Apple devices?
    - 4y ago
robbomacrae 4y ago
And yet I get plenty of spam via text on my iPhone. What is more, I cannot block numbers from texting me (unless there's an option I haven't found). What is more, a clearly spam text will stay as an alert number grabbing at my attention until I open up and see whatever spam image text was sent my way to dismiss it which is surely a security risk. I used to work at Apple but this messaging stuff is really damning.
stusmall 4y ago
It isn't about opening up iMessage. The article is about using RCS instead of SMS/MMS as the fallback. It's a pretty reasonable ask that will raise the quality of service when texting with the majority of the market. They can continue to lock down iMessage however they want.
- terrorOf 4y ago
- aaaaaaaaata 4y ago
  It's not a "reasonable" ask if you're Apple, selfish, and therefore want iMessage to remain superior to SMS at all costs, because it's part of your luxury appeal.
  - rahkiin 4y ago
    It also not reasonable because a lot of countries, also in europe, do not have RCS support on their networks. Or the right version of RCS.
    - RealStickman_ 4y ago
      Most people in Europe don't use iMessage though.
stetrain 4y ago
That has nothing to do with allowing RCS alongside SMS and iMessage. My iPhone gets plenty of spam SMS messages, alongside my iMessage chats. The sanctity of iMessage communications doesn't stop that. Swapping SMS for RCS support messages doesn't increase the spam surface.
JustSomeNobody 4y ago
This is about adopting RCS, NOT about pushing iMessage to other platforms.
- altairprime 4y ago
  This post is about Google pushing RCS to other platforms. I’m pointing out why their competitor, Apple, has not done the same with RCS’s competitor, iMessage. It’s an apples-to-apples comparison, and I consider it relevant to be mindful of this particular difference when considering RCS. Google could have implemented crypto-signed device identifier attestation as a mandatory requirement for RCS, which would have given them considerable leverage against iMessage. Why wouldn’t they? What was more important to them than stopping texting spam?
  - JustSomeNobody 4y ago
    > This post is about Google pushing RCS to other platforms. RCS doesn't belong to Google. It's a standard.
  - dcow 4y ago
    > which would have given them considerable leverage against iMessage. Citation needed.
Rackedup 4y ago
That is just ridiculous. I don't get random spam on Matrix/Element... it even handles video calls and more... Do you get spam calls on your iphone?
- ace2358 4y ago
  Yet… But seriously, we all know spam and abuse from bad actors is a huge problem for any sort or platform. Email, phone calls, physical mail. Sometimes people will put fliers on your car window to spam it. Same with VPS providers. Even my router gets random pings and port scans. Forums have to fight bots. It goes on. I have even gotten iMessage spam, which can easily be reported. It comes in waves and goes away.
- Gigachad 4y ago
  I get spam on Matrix. And Matrix is hardly used so these are just people trolling rather than having some kind of organized entity behind it. As far as I know there is really no anti spam measures on the network.
- Macha 4y ago
  I do get random spam on Matrix/Element, a couple of times a month. I am in some big public channels though, which may make me a lower hanging target to find my matrix ID to send spam to
- smachiz 4y ago
  The number of people using Matrix/Element is so small and relatively sophisticated that it probably has a super low expected value for spammers. Not true for iMessage at all...
  - ptman 4y ago
    Matrix userbase is much larger than IRC. In my experience IRC spam is still worse, but matrix spam will grow more common as the platform grows. But matrix.org devs are aware and have some plans for spam. Distributed/federated reputation...
shireboy 4y ago
The gist of the article has been a soapbox of mine for years. We wouldn't stand for "you can only send Gmail email to other Gmail users" (Fidonet people know), and shouldn't settle for similar with messaging. That said, this spam angle is an aspect I hadn't fully considered.
- kazinator 4y ago
  How easily can you mail a Google calendar item to Google user, using non-Google software?
  - deadbunny 4y ago
    Doesn't it fall back to a .ics file?
  - nl 4y ago
    Very easily. The ICS standard is supported by everything.
  - x0x0 4y ago
    Calendar sorta works -- the meetings yes, but things like suggesting a new time or co-viewing calendars to find a time don't.
- altairprime 4y ago
  Google closed down their Jabber gateway because they couldn’t stop the endless flood of spam into their userbase. If they had instead required device identifier attestations to accompany all Jabber messages, they could have left that API open for everyone to use, and simply banned device identifiers used for spamming. I wish they’d done so, instead of just giving up and closing their doors to Jabber.
  - zaik 4y ago
    Do you have any good source on why Google decided to shut down their XMPP service? I'd really like to read about it. Not sure about the spam thing, after all they also provide a federating email service.
tadfisher 4y ago
> If Android wants to join the party, then Android phone builders need to implement secure boot with hardware-signed attestation of non-rooted-ness, in the style of Apple T2 + macOS or Microsoft Pluton + Secure Boot. Until then, Apple iMessage will remain single platform. This exists and has existed for years, via the SafetyNet Attestation API [1]. [1]: https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation
- altairprime 4y ago
  As indicated elsethread, that API doc expressly declares near the top that it is not usable for device identifiers. Without device identifiers, there is no way to stop spammers.
  - dcow 4y ago
    1. No, you don't need device IDs to stop spammers. 2. I don't think you know what you're talking about. Android supports the device attestation: https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation > ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. https://datatracker.ietf.org/doc/draft-bweeks-acme-device-attest/ https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at... It feels like you've concocted some narrative to support your incredibly speculative original comment about how Apple does this because spam. You're clearly wrong. You can do attested compute on Android as others have been trying to point out.
    - altairprime 4y ago
      Okay, I’ll assume you’re right, which considerably worsens the case for RCS: Google could have given us device-signed messaging with RCS, so that users and carriers could block devices for spamming regardless of the source address. Google didn’t. They had the power to do so in RCS using their own APIs, and yet they chose not to offer an effective protection. How is this failure by Google a selling point for RCS? Why would anyone consider RCS at all without device attestation? We don’t need yet another abuse-laden, unidentifiable-source chat protocol. We need a material improvement in quality of life for users, not a veneer of fancy bells and whistles on top of the same plague of spam as today.
thayne 4y ago
If that is the main reason, then why not use RCS when communicating with Android devices, and their own proprietary system when communicating with other iPhones. And or push to add an optional attestation to RCS that apple can use.
saulrh 4y ago
How does unmodified software relate in any way to the ability to console-ban bad actors? It's apple's servers, apple's accounts, and apple's devices. They are perfectly capable of burning a private key into the fuses of every device they sell, keeping a revocation list, and requiring a valid signature from an unrevoked key to log in and send messages. You can't get around that with any quantity of homebrew or custom software. Same reason that you don't see spam on Nintendo Switch games - if Nintendo bans your hardware you're not getting back online unless you buy a new Switch, and that's enough of a cost to make spam uneconomical. You can't do that with Android because maintaining a single revocation list across many manufacturers would be impossible - or because Google would have to host it and they'd get mobbed by angry HNers frothing at the mouth about their privacy - but Apple is totally capable of it and already gets a free pass on whatever walled garden shenanigans they can imagine.
cbsmith 4y ago
I mean... the spam texting I get is annoying, but it doesn't seem much different between iOS vs. Android devices...
GekkePrutser 4y ago
I never get spam on any other networks either. Be it WhatsApp, telegram, signal or even matrix. It's not that big a problem apparently, and doesn't require giving up that much control. On the other hand I social never use iMessage. It's not very popular here in Spain at all because of the Apple-only thing. Android is far bigger in marketshare here.
runjake 4y ago
You can build a hackintosh, generate a serial number, and get on iMessage without any fully-authenticated hardware or even a legitimate secondary Apple device. Spammers use these setups to iMessage spam to great effect. I think the onus is on Apple to open the platform.
calsy 4y ago
Any limitations/restrictions that Apple imposes on their devices that usually provides them some competitive advantage is ALWAYS explained away as 'protecting' the user. It's a joke how often this corporate spin is used as an excuse.
calsy 4y ago
The device still receives SMS messages, which makes all that wonderful iMessage security completely useless when receiving spam SMS messages with fake headers.
sangnoir 4y ago
> Until then, Apple iMessage will remain single platform. This seems to be a strawman - no one is asking for cross-platfrom iMessage, just for Apple to upgrade it's officially-supported cross-platform messaging stack (SMS) from the 90s.
pxeboot 4y ago
> Apple is using device serial numbers for anti-spam, supported by a fully-authenticated hardware and software stack that does not allow user modification. This can't be true. It is trivial to get iMessage working in a macOS VM with randomly generated hardware IDs.
- altairprime 4y ago
  If it was as simple as that, we would all endlessly be plagued by iMessage spam. It isn’t.
  - aaaaaaaaata 4y ago
    Roll IPs...? What else needed?
  - worthless-trash 4y ago
    It is, but spammers are not clever.
    - sbuk 4y ago
      That attitude is what gets people phished. They are generally very clever, but will take the path of least resistance. If you accuse them of anything, it’s laziness.
  - f311a 4y ago
    Well, I had like four spam messages from the same people (but different Apple IDs) in the past few months.
harles 4y ago
iMessage spam has been through the roof for me the last couple of months. 1 or 2 messages a day with no obvious reporting mechanism. Whatever Apple is doing, it’s not working and it’s disingenuous to claim this is the reason iMessage isn’t on Android.
a2128 4y ago
I'm having trouble understanding how this is a good solution... If a customer purchases a used iPhone from another person, and that person had used it for spam, is the customer now screwed and unable to message their friends without buying a new phone?
matheusmoreira 4y ago
> the same freedom to modify an OS kernel that hackers desire is also the freedom to spam all users Yes, and that is absolutely fine. Computer freedom is more important than the ability to prevent spam. It should be illegal to prevent the rooting of devices or even put up any roadblocks for the user. It doesn't really matter how much this freedom impacts their networks. The freedom to run whatever software we want and interoperate with everything without being discriminated against should be our inviolable right.
comex 4y ago
You can disable Secure Boot on a Mac and still use iMessage. In this state, it would still be theoretically possible to attest to some kind of unique hardware ID, as the Secure Enclave is still locked down. But even if it weren't, it would be good enough to just distribute a unique key with each device. Sure you could take it off the device, but who cares? If it got banned, you'd still need to buy a new device for a new key. …But given the sibling comment (by pxeboot) about using iMessage in a VM, I'm not sure whether any of this is actually done.
- mantas 4y ago
  iMessage works on Hackintosh too
  - altairprime 4y ago
    Spamming doesn’t, however, as it requires a lot of serial number lookups and creates a very identifiable trail of behavior just to get a single device working. Scaling that process up to spamming would be unprofitable and risk being caught.
Calamitous 4y ago
Then why do I still get texting spam on my iPhone?
gandalfff 4y ago
Would it be possible to have Android devices that have attestation, but with a one-way switch to disable attestation and allow users to root?
- dcow 4y ago
  Android does have it. OP is making ridiculously false claims to support some incredibly speculative spam prevention narrative that simply isn't true.
mjevans 4y ago
A good enough and low hanging fruit solution to spam is an allowed list. Generally allow contacts (initially at least). Track spam feedback by age against contacts. If someone does end up in a spam list (and they don't rack up a high score across multiple targets), let them know they're in such a list and where to start looking to resolve that issue. A good enough solution for this is to have number carriers attest to have verified the government issued ID of the individual in question; and if spam happens shortly after that to yield the government ID number of that individual. An alternate form I've considered, for email, is to pay a postage (transfer + storage) micro-transaction fee, and possibly an attention fee for prompt review. The custom might be to refund these in cases of legitimate messages.
- altairprime 4y ago
  I have received zero spam messages over iMessage in maybe ten years, without using an allow list. Why, as a consumer, would I tolerate the degree of effort you describe when I have a perfect zero-effort solution available today?
soperj 4y ago
“I am concerned that the iMessage on Android would simply serve to remove and obstacle to iPhone families giving their kids Android phones,” Craig Federighi, Apple software senior vice president, wrote in 2013." They'll find another reason not to implement it on other platforms.
- altairprime 4y ago
  Consider whether Apple has changed their position about shipping key functionalities of their platform to non-Apple devices in the decade since then, in light of (for example) their purchase of and continued offerings of Android-friendly Beats products, their beta of Apple Music as a webpage in any browser, and their TV services app spreading to every smart television platform that competes with Apple TVs.
  - Zak 4y ago
    Those other products have their own revenue streams. Apple would not profit from allowing access to iMessage without owning an Apple device.
  - soperj 4y ago
    You can't even get their browser on another platform.
tomxor 4y ago
> This permits Apple to simply “console ban” any Apple device that spams on iMessage. This does nothing to protect users from non-Apple devices.
yalogin 4y ago
Thank you. I have tried explaining this to people but the “freedom” people overwhelmingly flood the discussion and prevent any meaningful debate about it. Of course for them that point is not debatable but still for majority of people no spam is a huge deal.
bergenty 4y ago
What’s the point though. People still receive spam that doesn’t originate in the iMessage ecosystem. The end result is the same.
donatj 4y ago
I don't see what any of this has to do with Apple not supporting RCS.
BiteCode_dev 4y ago
> Apple is using device serial numbers for anti-spam, supported by a fully-authenticated hardware and software stack that does not allow user modificatio Ah, perfect tracking. Let's add that to Pluton list of promises.
dzikimarian 4y ago
There are literally emails leaked, that say iMessage is closed, because Apple wants monopoly in this area. Yet in every thread recently someone spreads FUD how without uncle's Apple protection, bad world will hurt you, when reality shows that's nonexistent problem on other platforms.
- altairprime 4y ago
  I’m celebrating the antispam properties of device attestation, not asking anyone to trust Apple. I’m quite upset that Google RCS doesn’t include device attestation. It would have helped us get rid of text spam in carrier messaging, and made a convincing case for adoption by telcos. Imagine being able to block text spam by the equipment sending it. Imagine being able to block phone spam by the equipment calling you. It’s a missed opportunity for Google and for all of us.
  - dzikimarian 4y ago
    You wrote: > Most businesses, consumers, and developers universally continue to ignore the primary reason that iMessage is a closed platform, rather than an app on every platform as iTunes is: Apple is using device serial numbers for anti-spam. That statement is false. Primary reason is, that Apple wanted to lock customers in their ecosystem. You can read about it here: https://www.theverge.com/2021/4/27/22406303/imessage-android-eddy-cue-emails-apple-epic-deposition https://www.theverge.com/2021/4/27/22406303/imessage-android... Also attestation doesn't stop spam (see other responses in this thread) and is harmful mechanism that will lead to more walled gardens.
williamscales 4y ago
raxxorraxor 4y ago
> and that is a key deliverable of Pluton But there are very important key disadvantages that come with that. And I don't believe fighting spam is Microsofts MO. Just open Edge and look at the ads. This is very close to selling penis enlargement pills. "device hackers" - seriously? You mean people that like to have control about what their devices do. Installing software you want should never be hacking. That aside I am very skeptical of forcing Apple to open their messaging. The responsibility to choose a different medium is on the user.
trissylegs 4y ago
You can connect to iMessage from a hackintosh though?
dcow 4y ago
What do you mean Android doesn't have an analog? It has both secure boot and device attestation. It has multiple APIs that can be used to design applications requiring varying levels of trusted computing context. There's the high-level SafeyNet API which essentially lets you assert that you're running on a non-modified device running non-modified software in the context of a verified boot: * https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation It also has the lower-level Keymaster 3 API (since 2017) which provides HSM-signed certificates with the device attestiation extension, including the system trust level and verified device identifiers: * https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation * https://datatracker.ietf.org/doc/draft-bweeks-acme-device-attest/ https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at... Microsoft is the one that's late to party... And your hypothesis seems pretty dependent on an argument that Apple can't build iMessaging on other platforms because they're the only platform with device attestation. That's simply not true. If Apple wanted iMessage on other platforms, they've had at least 5 years to build it in the way you theorize must be required.
- execveat 4y ago
  There are multiple public bypasses for SafetyNet. Many 3rd party roms provide them out-of-the-box. Granted, Apple's attestation is bypassable as well. Furthermore, others mentioned that a large portion of SMS-spam originates from the FluBot infected Android devices. Well, the only reason FluBot does not infect iPhones is laziness - it is perfectly doable at scale using custom configuration profiles.
  - dcow 4y ago
    Yep good point. Are there bypasses for the hsm-backed signed attestation?
throwaway290 4y ago
I get imessage spam every day. I report junk every time, but it seems like they have infinite accounts.
deleted 4y ago
[deleted]
kalleboo 4y ago
There are literally multiple internal Apple emails released through court testimony where Apple executives clearly explain how important iMessage is to lock-in to iPhone and how if parents can just buy an Android and install an iMessage app it would mean disaster. In none of these emails is spam or privacy or security even mentioned. The primary reason Apple is doing it for platform lock-in, plain and simple. They literally said so themselves internally. Any other explanation is fanboyism.
- runeks 4y ago
  > There are literally multiple internal Apple emails released through court testimony where Apple executives clearly explain how important iMessage is to lock-in to iPhone and how if parents can just buy an Android and install an iMessage app it would mean disaster. I’m genuinely interested. Do you have a link?
- altairprime 4y ago
  You misunderstand. I don’t care about Apple’s desire for lock-in at all. I want Google RCS to implement, and make mandatory, secured device identifier attestation. I want to be able to block the actual hardware devices that spam me through carrier messaging. RCS could have offered that, and doesn’t. What a shame.
  - lern_too_spel 4y ago
    Why does RCS need to do that? RCS replaces SMS as the baseline interoperable protocol, not the iMessage protocol.
alickz 4y ago
From the tech emails it seems they're more concerned about lockin than security. https://twitter.com/techemails/status/1463558823109660677?lang=en https://twitter.com/techemails/status/1463558823109660677?la... >short version - don't make mail, calendar, iMessage work on Android and it's impossible to switch
- jason0597 4y ago
  > https://twitter.com/techemails/ https://twitter.com/techemails/ Slightly off-topic, but wow. What an absolutely brilliant twitter account.
mort96 4y ago
But... this is ridiculous on its face. SMS and iMessage both live in the Messages app. The only thing you achieve by locking down iMessage is that spam messages appear as green bubbles in Messages instead of as blue bubbles in Messages. It does literally nothing to prevent spam.
rowanG077 4y ago
I literally never receive spam on telegram. And I have been using it for years. And by never I really mean never. I'm very doubtful spam is the crux of the issue here.
pca006132 4y ago
Or this is because more iTunes users means more potential customers to their iTunes store, i.e. more revenue when it is cross platform. While opening up iMessage will not incease their revenue but makes people easier to switch to other platform such as Android. It is not like other platforms cannot deal with spam...
yunohn 4y ago
Apple apologists always find some wacky reason to justify things, but this is the first I’m hearing of “iMessage exists to prevent spam”… Have you used WhatsApp or Telegram? Neither need hardware attestation. No spam, in the decade I’ve used them. I have an iPhone and a Pixel, neither have spam. Unless the gov allows free-for-all SMS, which is not the case in the continents I’ve lived in. Sounds like a uniquely US problem, which iMessage can’t stop? You still get them, and Apple just hides them in a folder. What are you on about really?
bearmode 4y ago
You're talking as if spam via text messages is a common occurence? I've had maybe one spammy text message on Android in the last 10 years, even though most websites I use have my phone number. Spammy phone calls are constant, but Apple doesn't do anything to prevent that.
martius 4y ago
SMS spam isn't a thing on iOS?
jerryzh 4y ago
I have two cell phone, android and iOS. On Android I install my own spam filter message app and see no spam at all. On contrary, I still get plenty of spam from iMessage. So I don't think it works.
MetroWind 4y ago
Are we really at the point where letting a corporation decide what we can/cannot do on our own hardware is a good thing now? Though the more I think about it the more I realize that we are indeed already at that point, and people really think that's a good thing. That's really sad to me.
s3p 4y ago
Since iMessage is restricted to those with an Apple ID, what's stopping them from releasing cross-platform apps that function only if the user has a valid Apple device? I think it's a business choice, not a spam one.

upbeat_general 4y ago

This is just wrong because as others have pointed out, you can have a fully virtualized macOS environment with no secure boot or any kind and iMessage will run just fine. Also, since basically every device that receives message also receives sms, isn’t this irrelevant?

gofreddygo 4y ago

So the reason to track and identify every app on every device and have a switch to remotely brick it is to reduce spam ? My BS detectors just tripped. Would you be ok if your home had the same "security" features? Say BigCo home builders install a front door, sensors, cameras and scanners in your home that allow them to monitor track and remotely lock you out of your home, your water and power supply ? Their reason? ... so that they can shutdown "bad neighbors" and keep the neighborhood "clean". And remember there's no fkin way you can get rid of those scanners, cameras and other control mechanisms. But ya'know they gave you a piece of paper that says "we respect your privacy" with BigCo logo on it ? I don't get why Apple, MS or anyone should be able to get away with this.

lern_too_spel 4y ago

Attestation is service that can only be provided by the builder of the phone. Most commercially available Android phones provide this, and banks and DRM rely on it. https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation and https://developer.android.com/google/play/integrity/overview https://developer.android.com/google/play/integrity/overview

altairprime 4y ago
That API is not useful for anti-spam purposes, as individual devices cannot be banned for spamming by their serial number. Quoting that page: > The API is not designed to fulfill the following use cases: > Contain signals for app-specific use-cases, such as device identifiers
- lern_too_spel 4y ago
  That can be built trivially using this API. The app stores an identifier, which it knows has not been tampered with because of attestation. Giving apps access to a unique device identifier shared across apps is a privacy leak but can be obtained with the proper scary permission.
  - altairprime 4y ago
    > Giving apps access to a unique device identifier shared across apps is a privacy leak Correct: 'Non-heuristic antispam' and 'Private device identifiers' are incompatible requirements, unless you introduce another expensive obstacle to overcome. Spamming depends on cheap/free sock puppet accounts. The cost per account is inversely proportional to the value it holds to spammers. That cost can be in Apple's iMessage terms: $100+ per serial number, all devices must include burned-in serial number attestation in their server communications. Or that cost can be in bureaucracy: $10 per notarized "account signup request with verified citizenship", but now all communications can be associated with the notary's logs of your citizenship ID number. There is no way to stop spam without incurring one or another cost to each user. Apple's method doesn't care who you are, so long as you possess Apple hardware. The Pluton method wouldn't either. What other methods exist that are unconcerned with the exact identity of the user, but still make spamming unprofitable?

dt2m 4y ago

This is a great point which I haven't heard before in this age-old debate. But until Apple's dominance starts to wane, there's no chance in hell they will provide iMessage for other platforms unless forced by regulation. If push comes to shove, they can implement heuristics which run texts from non-Apple devices through a harder spam filter. Spam isn't non-existent on the iMessage network, and there already seems to be a rudimentary spam filter in place.

jacooper 4y ago
Well Apple is going to be forced anyway, the EU's Digital Markets Act will be enforced soon. And fines are up to 20% of global revenue.
- ghaff 4y ago
  Is iMessage a "Number-independent interpersonal communication services (e.g., messengers)"? It's a messenger but it's based on phone numbers AFAIK--unlike something like WhatsApp.
  - rdsnsca 4y ago
    It is, I use it from my Mac Mini without owing an iPhone.
  - frumper 4y ago
    You can sign up and use an email for iMessage through wifi
    - ghaff 4y ago
      Ah. I've only used it as a default SMS alternative on Apple devices including iPhone.
- Seanambers 4y ago
  As an iPhone user I do not like EU dictating how Apple software should work at all. The same with chargers as well. Sure we can all have a discussion about how it should work - but having bureaucrats decide is the worst idea ever.

wilde 4y ago

This doesn’t work though. I receive enough iMessage spam specifically through Apple ids that I wish I could disable the ability to message me unless you use a phone number.

Tagbert 4y ago
I believe that is SMS spam originating from outside of iMessage
- frumper 4y ago
  I definitely get iMessage spam
  - rootusrootus 4y ago
    If you're 100% sure it's iMessage and not SMS, report it to Apple. They can ban that account.
    - altairprime 4y ago
      They’ll ban the entire device used to send it, not just the one account. But see also elsethread “wait, how do I know this was delivered over iMessage”, since MMS allows the From field to be an email address.
      - selectodude 4y ago
        On the top of the first message it'll either say Text Message or iMessage. If it's an iMessage and you delete the thread without replying, it'll ask if you want to report the message as spam.
      - deleted 4y ago
        [deleted]
    - neop1x 4y ago
      How would you prove the account is sending spam? By sending them screenshots? Will they believe you? This could be used to ban a neighbor I don't like. Or does Apple spy all conversations so they can check themselves? :P

kelnos 4y ago

I'd rather live in a world with spam than a world where corporations get to decide what I run on my devices, and cripple a bunch of critical applications if I decide I want to, y'know, actually do whatever I want with the hardware I own. I'm not unsympathetic to Apple's difficulties and goals here (assuming this spam problem is actually the reason, though I'm skeptical that there aren't also self-serving reasons that would be sufficient for Apple), but I'm so tired of society's slide toward "security at any cost, and to hell with freedom" since the 9/11 attacks over 20 years ago. (It's possible and likely that slide has been going on much longer, but I was a teenager in the 90s and not really aware of such things. But I think it's undeniable that the aftermath of 9/11 was a big turning point for the surveillance state and for average citizens being so scared of everything that they'd be willing to give up essential freedoms just to quell that fright.)

rootusrootus 4y ago
> I'd rather live in a world with spam than a world where corporations get to decide what I run on my devices, and cripple a bunch of critical applications if I decide I want to, y'know, actually do whatever I want with the hardware I own. Egads, no. The abuse heaped on me by Apple pales in comparison to the spam phone calls and emails I get. If I start getting spam via iMessage, I'll be an extremely unhappy camper. It already happens with text messages and that's bad enough.
- kelnos 4y ago
  Sounds like other people in this thread already get a lot of iMessage spam, so I guess you've just been lucky? And it shows that this attestation junk doesn't actually curb the spam problem, so it's just an analogue of security theater. Anyhow, sure, if you want to give away your freedom to actually own your devices, just so you don't get spam... I guess that's your choice. I just don't want to be locked into a system where that's the only choice. Regardless, iPhones also receive SMSes. If it's impossible to spam over iMessage, they'll just use SMS. If it becomes impossible to spam over SMS, then presumably Apple can implement similar measures for iMessage that don't require us all to have hermetically-sealed, locked-down devices.

AnthonyMouse 4y ago

This is a lawyer excuse. I've had Signal for years and the number of spam messages I've received over it is none. It's not a real problem. SMS on the other hand... but iPhones receive SMS too, don't they?

altairprime 4y ago
Signal is not a profitable target for spammers. Those using it are least likely to be caught by spam.
- deleted 4y ago
  [deleted]
Spivak 4y ago
Hate to be the bearer of bad news but that’s because Signal is teeny tiny. If Signal makes it to a billion users I guarantee it will happen to them.
- AnthonyMouse 4y ago
  SMS is bigger than even iMessage, so if you can spam everyone with iMessage and more by using SMS, why would anyone bother with iMessage?
  - 8note 4y ago
    Bigger doesn't necessarily mean more profitable. IMessage is full of profitable phone owners
    - goosedragons 4y ago
      That receive messages over SMS in the same app... What's the advantage of iMessage spam? Group chat spam? Higher quality video spam? Is that worth all the effort to do your spamming only on Apple devices?
  - 4y ago

robbomacrae 4y ago

And yet I get plenty of spam via text on my iPhone. What is more, I cannot block numbers from texting me (unless there's an option I haven't found). What is more, a clearly spam text will stay as an alert number grabbing at my attention until I open up and see whatever spam image text was sent my way to dismiss it which is surely a security risk. I used to work at Apple but this messaging stuff is really damning.

stusmall 4y ago

It isn't about opening up iMessage. The article is about using RCS instead of SMS/MMS as the fallback. It's a pretty reasonable ask that will raise the quality of service when texting with the majority of the market. They can continue to lock down iMessage however they want.

terrorOf 4y ago
aaaaaaaaata 4y ago
It's not a "reasonable" ask if you're Apple, selfish, and therefore want iMessage to remain superior to SMS at all costs, because it's part of your luxury appeal.
- rahkiin 4y ago
  It also not reasonable because a lot of countries, also in europe, do not have RCS support on their networks. Or the right version of RCS.
  - RealStickman_ 4y ago
    Most people in Europe don't use iMessage though.

stetrain 4y ago

That has nothing to do with allowing RCS alongside SMS and iMessage. My iPhone gets plenty of spam SMS messages, alongside my iMessage chats. The sanctity of iMessage communications doesn't stop that. Swapping SMS for RCS support messages doesn't increase the spam surface.

JustSomeNobody 4y ago

This is about adopting RCS, NOT about pushing iMessage to other platforms.

altairprime 4y ago
This post is about Google pushing RCS to other platforms. I’m pointing out why their competitor, Apple, has not done the same with RCS’s competitor, iMessage. It’s an apples-to-apples comparison, and I consider it relevant to be mindful of this particular difference when considering RCS. Google could have implemented crypto-signed device identifier attestation as a mandatory requirement for RCS, which would have given them considerable leverage against iMessage. Why wouldn’t they? What was more important to them than stopping texting spam?
- JustSomeNobody 4y ago
  > This post is about Google pushing RCS to other platforms. RCS doesn't belong to Google. It's a standard.
- dcow 4y ago
  > which would have given them considerable leverage against iMessage. Citation needed.

Rackedup 4y ago

That is just ridiculous. I don't get random spam on Matrix/Element... it even handles video calls and more... Do you get spam calls on your iphone?

ace2358 4y ago
Yet… But seriously, we all know spam and abuse from bad actors is a huge problem for any sort or platform. Email, phone calls, physical mail. Sometimes people will put fliers on your car window to spam it. Same with VPS providers. Even my router gets random pings and port scans. Forums have to fight bots. It goes on. I have even gotten iMessage spam, which can easily be reported. It comes in waves and goes away.
Gigachad 4y ago
I get spam on Matrix. And Matrix is hardly used so these are just people trolling rather than having some kind of organized entity behind it. As far as I know there is really no anti spam measures on the network.
Macha 4y ago
I do get random spam on Matrix/Element, a couple of times a month. I am in some big public channels though, which may make me a lower hanging target to find my matrix ID to send spam to
smachiz 4y ago
The number of people using Matrix/Element is so small and relatively sophisticated that it probably has a super low expected value for spammers. Not true for iMessage at all...
- ptman 4y ago
  Matrix userbase is much larger than IRC. In my experience IRC spam is still worse, but matrix spam will grow more common as the platform grows. But matrix.org devs are aware and have some plans for spam. Distributed/federated reputation...

shireboy 4y ago

The gist of the article has been a soapbox of mine for years. We wouldn't stand for "you can only send Gmail email to other Gmail users" (Fidonet people know), and shouldn't settle for similar with messaging. That said, this spam angle is an aspect I hadn't fully considered.

kazinator 4y ago
How easily can you mail a Google calendar item to Google user, using non-Google software?
- deadbunny 4y ago
  Doesn't it fall back to a .ics file?
- nl 4y ago
  Very easily. The ICS standard is supported by everything.
- x0x0 4y ago
  Calendar sorta works -- the meetings yes, but things like suggesting a new time or co-viewing calendars to find a time don't.
altairprime 4y ago
Google closed down their Jabber gateway because they couldn’t stop the endless flood of spam into their userbase. If they had instead required device identifier attestations to accompany all Jabber messages, they could have left that API open for everyone to use, and simply banned device identifiers used for spamming. I wish they’d done so, instead of just giving up and closing their doors to Jabber.
- zaik 4y ago
  Do you have any good source on why Google decided to shut down their XMPP service? I'd really like to read about it. Not sure about the spam thing, after all they also provide a federating email service.

tadfisher 4y ago

> If Android wants to join the party, then Android phone builders need to implement secure boot with hardware-signed attestation of non-rooted-ness, in the style of Apple T2 + macOS or Microsoft Pluton + Secure Boot. Until then, Apple iMessage will remain single platform. This exists and has existed for years, via the SafetyNet Attestation API [1]. [1]: https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation

altairprime 4y ago
As indicated elsethread, that API doc expressly declares near the top that it is not usable for device identifiers. Without device identifiers, there is no way to stop spammers.
- dcow 4y ago
  1. No, you don't need device IDs to stop spammers. 2. I don't think you know what you're talking about. Android supports the device attestation: https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation > ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. https://datatracker.ietf.org/doc/draft-bweeks-acme-device-attest/ https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at... It feels like you've concocted some narrative to support your incredibly speculative original comment about how Apple does this because spam. You're clearly wrong. You can do attested compute on Android as others have been trying to point out.
  - altairprime 4y ago
    Okay, I’ll assume you’re right, which considerably worsens the case for RCS: Google could have given us device-signed messaging with RCS, so that users and carriers could block devices for spamming regardless of the source address. Google didn’t. They had the power to do so in RCS using their own APIs, and yet they chose not to offer an effective protection. How is this failure by Google a selling point for RCS? Why would anyone consider RCS at all without device attestation? We don’t need yet another abuse-laden, unidentifiable-source chat protocol. We need a material improvement in quality of life for users, not a veneer of fancy bells and whistles on top of the same plague of spam as today.

thayne 4y ago

If that is the main reason, then why not use RCS when communicating with Android devices, and their own proprietary system when communicating with other iPhones. And or push to add an optional attestation to RCS that apple can use.

saulrh 4y ago

How does unmodified software relate in any way to the ability to console-ban bad actors? It's apple's servers, apple's accounts, and apple's devices. They are perfectly capable of burning a private key into the fuses of every device they sell, keeping a revocation list, and requiring a valid signature from an unrevoked key to log in and send messages. You can't get around that with any quantity of homebrew or custom software. Same reason that you don't see spam on Nintendo Switch games - if Nintendo bans your hardware you're not getting back online unless you buy a new Switch, and that's enough of a cost to make spam uneconomical. You can't do that with Android because maintaining a single revocation list across many manufacturers would be impossible - or because Google would have to host it and they'd get mobbed by angry HNers frothing at the mouth about their privacy - but Apple is totally capable of it and already gets a free pass on whatever walled garden shenanigans they can imagine.

cbsmith 4y ago

I mean... the spam texting I get is annoying, but it doesn't seem much different between iOS vs. Android devices...

GekkePrutser 4y ago

I never get spam on any other networks either. Be it WhatsApp, telegram, signal or even matrix. It's not that big a problem apparently, and doesn't require giving up that much control. On the other hand I social never use iMessage. It's not very popular here in Spain at all because of the Apple-only thing. Android is far bigger in marketshare here.

runjake 4y ago

You can build a hackintosh, generate a serial number, and get on iMessage without any fully-authenticated hardware or even a legitimate secondary Apple device. Spammers use these setups to iMessage spam to great effect. I think the onus is on Apple to open the platform.

calsy 4y ago

Any limitations/restrictions that Apple imposes on their devices that usually provides them some competitive advantage is ALWAYS explained away as 'protecting' the user. It's a joke how often this corporate spin is used as an excuse.

calsy 4y ago

The device still receives SMS messages, which makes all that wonderful iMessage security completely useless when receiving spam SMS messages with fake headers.

sangnoir 4y ago

> Until then, Apple iMessage will remain single platform. This seems to be a strawman - no one is asking for cross-platfrom iMessage, just for Apple to upgrade it's officially-supported cross-platform messaging stack (SMS) from the 90s.

pxeboot 4y ago

> Apple is using device serial numbers for anti-spam, supported by a fully-authenticated hardware and software stack that does not allow user modification. This can't be true. It is trivial to get iMessage working in a macOS VM with randomly generated hardware IDs.

altairprime 4y ago
If it was as simple as that, we would all endlessly be plagued by iMessage spam. It isn’t.
- aaaaaaaaata 4y ago
  Roll IPs...? What else needed?
- worthless-trash 4y ago
  It is, but spammers are not clever.
  - sbuk 4y ago
    That attitude is what gets people phished. They are generally very clever, but will take the path of least resistance. If you accuse them of anything, it’s laziness.
- f311a 4y ago
  Well, I had like four spam messages from the same people (but different Apple IDs) in the past few months.

harles 4y ago

iMessage spam has been through the roof for me the last couple of months. 1 or 2 messages a day with no obvious reporting mechanism. Whatever Apple is doing, it’s not working and it’s disingenuous to claim this is the reason iMessage isn’t on Android.

a2128 4y ago

I'm having trouble understanding how this is a good solution... If a customer purchases a used iPhone from another person, and that person had used it for spam, is the customer now screwed and unable to message their friends without buying a new phone?

matheusmoreira 4y ago

> the same freedom to modify an OS kernel that hackers desire is also the freedom to spam all users Yes, and that is absolutely fine. Computer freedom is more important than the ability to prevent spam. It should be illegal to prevent the rooting of devices or even put up any roadblocks for the user. It doesn't really matter how much this freedom impacts their networks. The freedom to run whatever software we want and interoperate with everything without being discriminated against should be our inviolable right.

comex 4y ago

You can disable Secure Boot on a Mac and still use iMessage. In this state, it would still be theoretically possible to attest to some kind of unique hardware ID, as the Secure Enclave is still locked down. But even if it weren't, it would be good enough to just distribute a unique key with each device. Sure you could take it off the device, but who cares? If it got banned, you'd still need to buy a new device for a new key. …But given the sibling comment (by pxeboot) about using iMessage in a VM, I'm not sure whether any of this is actually done.

mantas 4y ago
iMessage works on Hackintosh too
- altairprime 4y ago
  Spamming doesn’t, however, as it requires a lot of serial number lookups and creates a very identifiable trail of behavior just to get a single device working. Scaling that process up to spamming would be unprofitable and risk being caught.

Calamitous 4y ago

Then why do I still get texting spam on my iPhone?

gandalfff 4y ago

Would it be possible to have Android devices that have attestation, but with a one-way switch to disable attestation and allow users to root?

dcow 4y ago
Android does have it. OP is making ridiculously false claims to support some incredibly speculative spam prevention narrative that simply isn't true.

mjevans 4y ago

A good enough and low hanging fruit solution to spam is an allowed list. Generally allow contacts (initially at least). Track spam feedback by age against contacts. If someone does end up in a spam list (and they don't rack up a high score across multiple targets), let them know they're in such a list and where to start looking to resolve that issue. A good enough solution for this is to have number carriers attest to have verified the government issued ID of the individual in question; and if spam happens shortly after that to yield the government ID number of that individual. An alternate form I've considered, for email, is to pay a postage (transfer + storage) micro-transaction fee, and possibly an attention fee for prompt review. The custom might be to refund these in cases of legitimate messages.

altairprime 4y ago
I have received zero spam messages over iMessage in maybe ten years, without using an allow list. Why, as a consumer, would I tolerate the degree of effort you describe when I have a perfect zero-effort solution available today?

soperj 4y ago

“I am concerned that the iMessage on Android would simply serve to remove and obstacle to iPhone families giving their kids Android phones,” Craig Federighi, Apple software senior vice president, wrote in 2013." They'll find another reason not to implement it on other platforms.

altairprime 4y ago
Consider whether Apple has changed their position about shipping key functionalities of their platform to non-Apple devices in the decade since then, in light of (for example) their purchase of and continued offerings of Android-friendly Beats products, their beta of Apple Music as a webpage in any browser, and their TV services app spreading to every smart television platform that competes with Apple TVs.
- Zak 4y ago
  Those other products have their own revenue streams. Apple would not profit from allowing access to iMessage without owning an Apple device.
- soperj 4y ago
  You can't even get their browser on another platform.

tomxor 4y ago

> This permits Apple to simply “console ban” any Apple device that spams on iMessage. This does nothing to protect users from non-Apple devices.

yalogin 4y ago

Thank you. I have tried explaining this to people but the “freedom” people overwhelmingly flood the discussion and prevent any meaningful debate about it. Of course for them that point is not debatable but still for majority of people no spam is a huge deal.

bergenty 4y ago

What’s the point though. People still receive spam that doesn’t originate in the iMessage ecosystem. The end result is the same.

donatj 4y ago

I don't see what any of this has to do with Apple not supporting RCS.

BiteCode_dev 4y ago

> Apple is using device serial numbers for anti-spam, supported by a fully-authenticated hardware and software stack that does not allow user modificatio Ah, perfect tracking. Let's add that to Pluton list of promises.

dzikimarian 4y ago

There are literally emails leaked, that say iMessage is closed, because Apple wants monopoly in this area. Yet in every thread recently someone spreads FUD how without uncle's Apple protection, bad world will hurt you, when reality shows that's nonexistent problem on other platforms.

altairprime 4y ago
I’m celebrating the antispam properties of device attestation, not asking anyone to trust Apple. I’m quite upset that Google RCS doesn’t include device attestation. It would have helped us get rid of text spam in carrier messaging, and made a convincing case for adoption by telcos. Imagine being able to block text spam by the equipment sending it. Imagine being able to block phone spam by the equipment calling you. It’s a missed opportunity for Google and for all of us.
- dzikimarian 4y ago
  You wrote: > Most businesses, consumers, and developers universally continue to ignore the primary reason that iMessage is a closed platform, rather than an app on every platform as iTunes is: Apple is using device serial numbers for anti-spam. That statement is false. Primary reason is, that Apple wanted to lock customers in their ecosystem. You can read about it here: https://www.theverge.com/2021/4/27/22406303/imessage-android-eddy-cue-emails-apple-epic-deposition https://www.theverge.com/2021/4/27/22406303/imessage-android... Also attestation doesn't stop spam (see other responses in this thread) and is harmful mechanism that will lead to more walled gardens.

williamscales 4y ago

raxxorraxor 4y ago

> and that is a key deliverable of Pluton But there are very important key disadvantages that come with that. And I don't believe fighting spam is Microsofts MO. Just open Edge and look at the ads. This is very close to selling penis enlargement pills. "device hackers" - seriously? You mean people that like to have control about what their devices do. Installing software you want should never be hacking. That aside I am very skeptical of forcing Apple to open their messaging. The responsibility to choose a different medium is on the user.

trissylegs 4y ago

You can connect to iMessage from a hackintosh though?

dcow 4y ago

What do you mean Android doesn't have an analog? It has both secure boot and device attestation. It has multiple APIs that can be used to design applications requiring varying levels of trusted computing context. There's the high-level SafeyNet API which essentially lets you assert that you're running on a non-modified device running non-modified software in the context of a verified boot: * https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation It also has the lower-level Keymaster 3 API (since 2017) which provides HSM-signed certificates with the device attestiation extension, including the system trust level and verified device identifiers: * https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation * https://datatracker.ietf.org/doc/draft-bweeks-acme-device-attest/ https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at... Microsoft is the one that's late to party... And your hypothesis seems pretty dependent on an argument that Apple can't build iMessaging on other platforms because they're the only platform with device attestation. That's simply not true. If Apple wanted iMessage on other platforms, they've had at least 5 years to build it in the way you theorize must be required.

execveat 4y ago
There are multiple public bypasses for SafetyNet. Many 3rd party roms provide them out-of-the-box. Granted, Apple's attestation is bypassable as well. Furthermore, others mentioned that a large portion of SMS-spam originates from the FluBot infected Android devices. Well, the only reason FluBot does not infect iPhones is laziness - it is perfectly doable at scale using custom configuration profiles.
- dcow 4y ago
  Yep good point. Are there bypasses for the hsm-backed signed attestation?

throwaway290 4y ago

I get imessage spam every day. I report junk every time, but it seems like they have infinite accounts.

deleted 4y ago

[deleted]

kalleboo 4y ago

There are literally multiple internal Apple emails released through court testimony where Apple executives clearly explain how important iMessage is to lock-in to iPhone and how if parents can just buy an Android and install an iMessage app it would mean disaster. In none of these emails is spam or privacy or security even mentioned. The primary reason Apple is doing it for platform lock-in, plain and simple. They literally said so themselves internally. Any other explanation is fanboyism.

runeks 4y ago
> There are literally multiple internal Apple emails released through court testimony where Apple executives clearly explain how important iMessage is to lock-in to iPhone and how if parents can just buy an Android and install an iMessage app it would mean disaster. I’m genuinely interested. Do you have a link?
altairprime 4y ago
You misunderstand. I don’t care about Apple’s desire for lock-in at all. I want Google RCS to implement, and make mandatory, secured device identifier attestation. I want to be able to block the actual hardware devices that spam me through carrier messaging. RCS could have offered that, and doesn’t. What a shame.
- lern_too_spel 4y ago
  Why does RCS need to do that? RCS replaces SMS as the baseline interoperable protocol, not the iMessage protocol.

alickz 4y ago

From the tech emails it seems they're more concerned about lockin than security. https://twitter.com/techemails/status/1463558823109660677?lang=en https://twitter.com/techemails/status/1463558823109660677?la... >short version - don't make mail, calendar, iMessage work on Android and it's impossible to switch

jason0597 4y ago
> https://twitter.com/techemails/ https://twitter.com/techemails/ Slightly off-topic, but wow. What an absolutely brilliant twitter account.

mort96 4y ago

But... this is ridiculous on its face. SMS and iMessage both live in the Messages app. The only thing you achieve by locking down iMessage is that spam messages appear as green bubbles in Messages instead of as blue bubbles in Messages. It does literally nothing to prevent spam.

rowanG077 4y ago

I literally never receive spam on telegram. And I have been using it for years. And by never I really mean never. I'm very doubtful spam is the crux of the issue here.

pca006132 4y ago

Or this is because more iTunes users means more potential customers to their iTunes store, i.e. more revenue when it is cross platform. While opening up iMessage will not incease their revenue but makes people easier to switch to other platform such as Android. It is not like other platforms cannot deal with spam...

yunohn 4y ago

Apple apologists always find some wacky reason to justify things, but this is the first I’m hearing of “iMessage exists to prevent spam”… Have you used WhatsApp or Telegram? Neither need hardware attestation. No spam, in the decade I’ve used them. I have an iPhone and a Pixel, neither have spam. Unless the gov allows free-for-all SMS, which is not the case in the continents I’ve lived in. Sounds like a uniquely US problem, which iMessage can’t stop? You still get them, and Apple just hides them in a folder. What are you on about really?

bearmode 4y ago

You're talking as if spam via text messages is a common occurence? I've had maybe one spammy text message on Android in the last 10 years, even though most websites I use have my phone number. Spammy phone calls are constant, but Apple doesn't do anything to prevent that.

martius 4y ago

SMS spam isn't a thing on iOS?

jerryzh 4y ago

I have two cell phone, android and iOS. On Android I install my own spam filter message app and see no spam at all. On contrary, I still get plenty of spam from iMessage. So I don't think it works.

MetroWind 4y ago

Are we really at the point where letting a corporation decide what we can/cannot do on our own hardware is a good thing now? Though the more I think about it the more I realize that we are indeed already at that point, and people really think that's a good thing. That's really sad to me.

s3p 4y ago

Since iMessage is restricted to those with an Apple ID, what's stopping them from releasing cross-platform apps that function only if the user has a valid Apple device? I think it's a business choice, not a spam one.