5 ms·

> I'd rather live in a world with spam […] That is a personal choice, and I choose to not have spam on my phone. Several months ago I was subjected to a floodg

> I'd rather live in a world with spam […] That is a personal choice, and I choose to not have spam on my phone. Several months ago I was subjected to a floodgate of good ol' fashioned SMS spam that lasted several weeks. There was no way to stop the spam because the phone was receiving it through the legacy SMS channel coming specifically from Android devices infected with Flubot; the bulk of spam now comes from unpatched Android devices because hardware vendors stop releasing security updates after a short cycle, or due to loose default app permissions set on the device. I ended up creating a support ticket with my mobile telco and soon I received the following reply from a human being: What you have encountered is, as you may have guessed, not a legitimate SMS notification. This particular message is designed to entice you to click on a link, and doing so would potentially expose your device to malicious software. This malicious software is trying to target Android devices, so, if you are an Android user, you should take particular care with such messages. Note that you may receive this message even if you do not use Android devices - the website link is simply being sent to a number of random telephone numbers in the hopes that an Android user will receive it, and manually bypass the built-in security protections and install the malicious software presented by the website. In other words, if you use an iPhone, you can still receive these SMS messages (often claiming to be relating to a voicemail or parcel delivery), but there is no direct risk to your iPhone by simply receiving the SMS. Nor is there currently any risk to your iPhone if you happen to click on the link that is in these SMS messages. If you use Android, you should avoid permitting your device to install any software that did not come from the official Google Play store. > … where corporations get to decide what I run on my devices … Corporations, such as Google, make decisions for users without getting their consent nor without informing the users. If you sign into a Google account in a web browser on your phone, for instance, the sign-in will also silently and non-consentually sign you into your Google account across all Google apps installed on the device without informing you. The corporations, good or bad or anything in between, must be bound by the code of conduct they ought not to be allowed to get out from: must request the explicit user consent first.

kelnos 4y ago
> That is a personal choice, and I choose to not have spam on my phone. The problem here is that we are talking about a (possible, hypothetical) measure that blocks spam, but requires phones to be 100% locked down and unmodified from the factory. I categorically refuse to accept that sort of thing. If you will accept that, then you are a part of the problem. In reality, though, there are plenty of ways to combat spam that do not require us to have locked-down phones and move closer and closer to a corporate nanny state. Your shitty telco is actually fully capable of blocking spam like what you've received, but they have chosen not to. > Corporations, such as Google, make decisions for users without getting their consent nor without informing the users. Sure, but at present I can wipe my phone and install GrapheneOS or CalyxOS or whatever, and Google will not be able to make any decisions as to what I do on my phone. I get that they make other random decisions for us. Sure, that's inevitable. If I want to use Google Docs or whatever, they will make decisions about how my data is used, and what features are present in the product, etc. I accept that, and am ok with that. But if I'm sold a piece of general-purpose hardware, I expect to be able to do whatever I want with it. > If you sign into a Google account in a web browser on your phone, for instance, the sign-in will also silently and non-consentually sign you into your Google account across all Google apps installed on the device without informing you. Maybe if you use Chrome, but... I don't. So that doesn't happen to me.
- inkyoto 4y ago
  > The problem here is […] I categorically refuse to accept that sort of thing. It is a perceived problem specifically for you (and, based on the arguments presented so far, it appears to solely based on the personal dislike rather than on objective grounds). If you refuse to accept it, that is solely your personal choice, and I, for one, have no objections to you being able to exercise freedoms to make your own choice(s). > If you will accept that, then you are a part of the problem. You have neither moral nor any other right to inflict the sense of collective guilt upon anyone, including myself, who has an opinion distinct from that of yours. What is an adjudged problem for you, is a feature (and not a bug) for some, and is a conscious compromise for some others. I am in the latter category as I have consciously consented to the trade-off after weighing up pros and cons of alternatives existing at the time – it became my personal informed choice. > In reality, though, there are plenty of ways to combat spam that do not require us to have locked-down phones … Combating text message spam requires a non-trackable, universal digital identity which is a non-solved problem. SMS and RCS do not solve this problem as they both allow a digital identity to assume one persona exactly: the device owner's phone number. iMessage, o the other hand, offers a stop-gap solution and allows iMessage users to assume one of the many personas (either a default phone number or one of the email addresses registered with iMessage), and it allows the user to select the specific persona on their own volition. Countering spam is a bonus and optional feature that comes as a byproduct of the iMessage way of tackling the identity management, and is not a requirement. Allowing multiple personas in iMessage also allows the user to disassociate themselves from their phone number, change it however frequently they want yet allow their friends circle and relatives to stay in touch via another persona (email address(es) registered with iMessage) – a useful feature when the iMessage user moves to live overseas. A successful and a badly needed replacement for SMS (the protocol) will have to solve the identity management problem (as well as a morass of present SMS and RCS security vulnerabilities) first before it can become a viable option. And only then, it will have to be pushed out in a centralised manner (e.g. become a mandatory requirement for all 6G or 7G networks) so that no mobile telco would have a chance to opt out from the text messaging protocol upgrade. The adopotion of such a standard will take years, though, as users won't instantly upgrade their devices overnight, so the interoperability between GSM and new style text messages for some time will look exactly like it does today between SMS and iMessage. As for Google crying foul on not being to interoperate with iMessage, in reality they are shedding crocodile tears and are not telling you what they actually mean by that. Google wants to track every text message to a user across both major mobile platforms (Android and iOS) AND beyond, which is something they can't do today. SMS does not offer a unique transferrable digital ID (other than IMSI which gets incised out once a message hits the SMSC), therefore Google can't link the user to activities on their smartphone to wider activities across all of their devices and the web as mobile phone numbers are not typically used for web browsing and in general app use. Apple controls the passage of the Rubikon (iMessage) that, once crossed, would instantaly allow Google to find a creative way to track users, so Google wants that (in the same vein as Facebook does). Yet, Google is being coy about their true intentions. > I get that they make other random decisions for us. Sure, that's inevitable … and move closer and closer to a corporate nanny state. I vehemently and vociferously object to corporations encroaching on our larger freedoms, and, regretfully, strict regulation and even stricter enforcement of the regulation appears to be the only way to accomplish it. > Sure, but at present I can wipe my phone and install GrapheneOS or CalyxOS or whatever, and Google will not be able to make any decisions as to what I do on my phone […] But if I'm sold a piece of general-purpose hardware, I expect to be able to do whatever I want with it. To the best of my knowledge, nearly no-one (apart from Librem) sells general-purpose smartphones today. Each offering comes with a host of pros and cons, yet none of them are neither marketed nor sold as the general-purpose computing hardware. Also, the option of wiping an OS is not ubiquitous on Android platforms and some handsets have the hardware that stock and alternative Android distribution may or may not support. Therefore, there is no such a thing as a generic Android phone which is what the majority of Android users have. And no, since you are part of the HN congregation, you are not a representative selection of the Android user base. Apple, on the other hand, sells a package that happens to have a smartphone (or a smartwatch, or a tablet) and an OS (as a conduit into the package), and the nicely wrapped package has well stipulated constraints that one either takes or leaves. Purchasing an iPhone is not mandatory in any jurisdictions that I am aware of, either, therefore an the act of puchasing one is also a personal and conscientious choice. > Maybe if you use Chrome, but... I don't. So that doesn't happen to me. Ha, the classic «it does not happen on my laptop!» remark. Sarcasm aside, it is more insidious than that. I had to log into Google using my work Google account in Safari on my laptop, but because Safari syncs the browser cookies and local storage across devices via iCloud (it is another feature I have consciously consented to), the Google account cookies have made it into my phone via an iCloud sync. Next time when I opened Google Maps on my phone, it pulled the Google cookie + stuff out of the Safari local storage, and I was then instantly and silently logged into Google using my work Google account (I degoogled myself years ago in favour of paid 3rd party services and no longer personal Google accounts). Such a practice, apart from being blatantly deceitful, is borderline nefarious, so, with all due respect, I do not buy into Google's crocodile tears about iMessage.
tomxor 4y ago
> I choose to not have spam on my phone. Several months ago I was subjected to a floodgate of good ol' fashioned SMS spam that lasted several weeks. If Apple provides an anti-spam SMS filtering service it is completely orthogonal to how much they decide to handcuff their own users. SMS is not a platform specific protocol and cell phone numbers have their own independent authority (however dysfunctional it may be). So unless you decide to block yourself from the entire world outside of Apple devices, it has nothing to do with being locked down. Locking down a platform from it's own users does not intrinsically benefit security or spam prevention, saying so is a false dichotomy, no matter how much Apple spins it.
raxxorraxor 4y ago
I never had spam on my Android phone for that matter, but the reliance on manufacturers to supply security updates is a side effect that is primarily induced because the platforms are as locked down as they are.

kelnos 4y ago

> That is a personal choice, and I choose to not have spam on my phone. The problem here is that we are talking about a (possible, hypothetical) measure that blocks spam, but requires phones to be 100% locked down and unmodified from the factory. I categorically refuse to accept that sort of thing. If you will accept that, then you are a part of the problem. In reality, though, there are plenty of ways to combat spam that do not require us to have locked-down phones and move closer and closer to a corporate nanny state. Your shitty telco is actually fully capable of blocking spam like what you've received, but they have chosen not to. > Corporations, such as Google, make decisions for users without getting their consent nor without informing the users. Sure, but at present I can wipe my phone and install GrapheneOS or CalyxOS or whatever, and Google will not be able to make any decisions as to what I do on my phone. I get that they make other random decisions for us. Sure, that's inevitable. If I want to use Google Docs or whatever, they will make decisions about how my data is used, and what features are present in the product, etc. I accept that, and am ok with that. But if I'm sold a piece of general-purpose hardware, I expect to be able to do whatever I want with it. > If you sign into a Google account in a web browser on your phone, for instance, the sign-in will also silently and non-consentually sign you into your Google account across all Google apps installed on the device without informing you. Maybe if you use Chrome, but... I don't. So that doesn't happen to me.

inkyoto 4y ago
> The problem here is […] I categorically refuse to accept that sort of thing. It is a perceived problem specifically for you (and, based on the arguments presented so far, it appears to solely based on the personal dislike rather than on objective grounds). If you refuse to accept it, that is solely your personal choice, and I, for one, have no objections to you being able to exercise freedoms to make your own choice(s). > If you will accept that, then you are a part of the problem. You have neither moral nor any other right to inflict the sense of collective guilt upon anyone, including myself, who has an opinion distinct from that of yours. What is an adjudged problem for you, is a feature (and not a bug) for some, and is a conscious compromise for some others. I am in the latter category as I have consciously consented to the trade-off after weighing up pros and cons of alternatives existing at the time – it became my personal informed choice. > In reality, though, there are plenty of ways to combat spam that do not require us to have locked-down phones … Combating text message spam requires a non-trackable, universal digital identity which is a non-solved problem. SMS and RCS do not solve this problem as they both allow a digital identity to assume one persona exactly: the device owner's phone number. iMessage, o the other hand, offers a stop-gap solution and allows iMessage users to assume one of the many personas (either a default phone number or one of the email addresses registered with iMessage), and it allows the user to select the specific persona on their own volition. Countering spam is a bonus and optional feature that comes as a byproduct of the iMessage way of tackling the identity management, and is not a requirement. Allowing multiple personas in iMessage also allows the user to disassociate themselves from their phone number, change it however frequently they want yet allow their friends circle and relatives to stay in touch via another persona (email address(es) registered with iMessage) – a useful feature when the iMessage user moves to live overseas. A successful and a badly needed replacement for SMS (the protocol) will have to solve the identity management problem (as well as a morass of present SMS and RCS security vulnerabilities) first before it can become a viable option. And only then, it will have to be pushed out in a centralised manner (e.g. become a mandatory requirement for all 6G or 7G networks) so that no mobile telco would have a chance to opt out from the text messaging protocol upgrade. The adopotion of such a standard will take years, though, as users won't instantly upgrade their devices overnight, so the interoperability between GSM and new style text messages for some time will look exactly like it does today between SMS and iMessage. As for Google crying foul on not being to interoperate with iMessage, in reality they are shedding crocodile tears and are not telling you what they actually mean by that. Google wants to track every text message to a user across both major mobile platforms (Android and iOS) AND beyond, which is something they can't do today. SMS does not offer a unique transferrable digital ID (other than IMSI which gets incised out once a message hits the SMSC), therefore Google can't link the user to activities on their smartphone to wider activities across all of their devices and the web as mobile phone numbers are not typically used for web browsing and in general app use. Apple controls the passage of the Rubikon (iMessage) that, once crossed, would instantaly allow Google to find a creative way to track users, so Google wants that (in the same vein as Facebook does). Yet, Google is being coy about their true intentions. > I get that they make other random decisions for us. Sure, that's inevitable … and move closer and closer to a corporate nanny state. I vehemently and vociferously object to corporations encroaching on our larger freedoms, and, regretfully, strict regulation and even stricter enforcement of the regulation appears to be the only way to accomplish it. > Sure, but at present I can wipe my phone and install GrapheneOS or CalyxOS or whatever, and Google will not be able to make any decisions as to what I do on my phone […] But if I'm sold a piece of general-purpose hardware, I expect to be able to do whatever I want with it. To the best of my knowledge, nearly no-one (apart from Librem) sells general-purpose smartphones today. Each offering comes with a host of pros and cons, yet none of them are neither marketed nor sold as the general-purpose computing hardware. Also, the option of wiping an OS is not ubiquitous on Android platforms and some handsets have the hardware that stock and alternative Android distribution may or may not support. Therefore, there is no such a thing as a generic Android phone which is what the majority of Android users have. And no, since you are part of the HN congregation, you are not a representative selection of the Android user base. Apple, on the other hand, sells a package that happens to have a smartphone (or a smartwatch, or a tablet) and an OS (as a conduit into the package), and the nicely wrapped package has well stipulated constraints that one either takes or leaves. Purchasing an iPhone is not mandatory in any jurisdictions that I am aware of, either, therefore an the act of puchasing one is also a personal and conscientious choice. > Maybe if you use Chrome, but... I don't. So that doesn't happen to me. Ha, the classic «it does not happen on my laptop!» remark. Sarcasm aside, it is more insidious than that. I had to log into Google using my work Google account in Safari on my laptop, but because Safari syncs the browser cookies and local storage across devices via iCloud (it is another feature I have consciously consented to), the Google account cookies have made it into my phone via an iCloud sync. Next time when I opened Google Maps on my phone, it pulled the Google cookie + stuff out of the Safari local storage, and I was then instantly and silently logged into Google using my work Google account (I degoogled myself years ago in favour of paid 3rd party services and no longer personal Google accounts). Such a practice, apart from being blatantly deceitful, is borderline nefarious, so, with all due respect, I do not buy into Google's crocodile tears about iMessage.

tomxor 4y ago

> I choose to not have spam on my phone. Several months ago I was subjected to a floodgate of good ol' fashioned SMS spam that lasted several weeks. If Apple provides an anti-spam SMS filtering service it is completely orthogonal to how much they decide to handcuff their own users. SMS is not a platform specific protocol and cell phone numbers have their own independent authority (however dysfunctional it may be). So unless you decide to block yourself from the entire world outside of Apple devices, it has nothing to do with being locked down. Locking down a platform from it's own users does not intrinsically benefit security or spam prevention, saying so is a false dichotomy, no matter how much Apple spins it.

raxxorraxor 4y ago

I never had spam on my Android phone for that matter, but the reliance on manufacturers to supply security updates is a side effect that is primarily induced because the platforms are as locked down as they are.