41 ms·
Sort of. So, first of all, it'd only ever be shown texts (not iMessage messages) from people who aren't in your contacts. But that probably includes things lik
by kemayo 4y ago
Sort of.
So, first of all, it'd only ever be shown texts (not iMessage messages) from people who aren't in your contacts. But that probably includes things like 2fa codes, so that's not necessarily comforting.
The app registers an ILMessageFilterExtension. This is run (if you enable it) when you receive a SMS and is given the sender and contents of the message and asked whether it should be blocked or categorized. However, it's sandboxed away from the main app you install and isn't allowed to store data for later access or send network requests. It is allowed to tell iOS that it needs to contact a server to work out whether the message should be blocked, and then an iOS system-service will contact a URL associated with the app with the data about the message... (I don't know whether Apple proxies these requests to avoid the server being able to correlate by your IP address.)
The theory is that since the system is handling contacting the server, it can avoid sending any extraneous data that would let the text be tied to you by anything more than its actual contents (so e.g. it might have a 2fa code, but it wouldn't know what your email address is). But it'd still be sent all the actual contents of your non-contacts texts.
https://developer.apple.com/documentation/sms_and_call_reporting/sms_and_mms_message_filtering https://developer.apple.com/documentation/sms_and_call_repor...
- latchkey 4y agoI am hoping that people don't use SMS for 2FA codes... We all know that isn't true, but that's a huge issue given the amount of simjacking that goes on.
- linux2647 4y agoSometimes we don’t have a choice, e.g. many American banks use SMS as the only 2FA
- latchkey 4y agoThe choice could be to use another bank.
- Firmwarrior 4y agoWhat bank? Every US bank requires phone-based 2fa so far as I know I bought a YubiKey a few years ago, and was extremely disappointed to find that there are only a tiny number of important services that actually support it without requiring insecure SMS as a backdoor
- latchkey 4y agoChase: email Ally: email Citibank: phone app
- Firmwarrior 4y agoThe problem here is we're talking about "simjacking" (where you exploit one of the many, many security loopholes in the cellular network to take over someone's phone line for a while and get SMS 2FA codes) I don't know about Ally or Citibank and will check those out, but it's been my experience that Chase requires a phone number and it makes sending 2FA codes to that number an option.
- latchkey 4y agoChase has two auth methods that you have to deal with: 1. the not recognized device. in this case, it is only text or call. 2. recognized device, 2fa login: in this case, you get text or email as options.
- joshmanders 4y agoSo your options to avoid 2FA via text is to use email, something highly more likely to be compromised than simjacking is? mmk.
- latchkey 4y agoYes, that is right. I don't see how my email, which is secured with 2FA, is more likely to be compromised than simjacking.
- urbandw311er 4y agoIn the UK it’s still extremely prevalent especially in financial apps
- josephcsible 4y ago> However, it's sandboxed away from the main app you install and isn't allowed to store data for later access or send network requests. If this is true, then why does Apple say that the developer of the app will have access to your messages? https://news.ycombinator.com/item?id=32791686 https://news.ycombinator.com/item?id=32791686
- rcarmo 4y agoBecause even if there is no back-end service, _the developer's code_, running on your device, will have access to your messages. It is a matter of semantics, granted, but that is what it means.
- kemayo 4y agoI had already replied over there: https://news.ycombinator.com/item?id=32791731 https://news.ycombinator.com/item?id=32791731 But to sum up: Apple doesn't distinguish in its warning between apps that are configured to maybe send texts to a server for classification (which is indeed "the developer has access") and those that aren't. It just gives a maximalist warning -- which, to be fair, covers well the case where an app initially can't send data to a server... and later updates so that it does.