10 ms·

Nothing's iMessage app was a security catastrophe, taken down in 24 hours

232 points by seasicksteve 3y ago

modeless 3y ago
Beeper seems a lot better then. Based on Matrix, so at least you know there is a foundation of security there.
- leoedin 3y ago
  I don't think Beeper can promise end to end encryption for 3rd party services either. Fundamentally if you're interfacing with a service like iMessage or Whatsapp - even if they offer end to end encryption - the message has to be decrypted and then sent to the 3rd party app. Unless that gateway is running on your phone, the messages have to be decrypted in the cloud somewhere. At that point, you are placing all your trust in the 3rd party app's cloud services. Obviously they can still make better decisions than these guys - don't write confidential data to your logs! Don't unencrypted HTTP APIs! But unless the gateways to the 3rd party services run locally, you will never have end to end security. Edit: Beeper has published their bridges as open source, so you could self-host it. That would at least give you full control of the stack. https://github.com/beeper/self-host https://github.com/beeper/self-host
  - xinayder 3y ago
    Pretty much useless to self-host your own beeper server since you cannot use their client with your own homeserver. EDIT: forgot to add that there are several beeper specific MSC's that other clients don't render, thus if you want the full experience you either use their service or just stick with a normal matrix instance.
    - erinnh 3y ago
      I don’t know what extra features Beeper has, but I’ve been hosting my own Signal/Telegram bridges for 2 years now. And it’s been working fine with Element as client.
      - dnlzro 3y ago
        As far as I can tell, the Beeper official client is a fork of Element, and there aren’t any huge missing features (other than easily setting up bridges).
  - noahtallen 3y ago
    True, but at the same time, it’s a very small attack vector. I’d say the vast majority of users could really care less that an iMessage is decrypted for a brief period in-memory on some Mac VM in a data center. You place your trust in 3rd party cloud servers for so many things. Email, as an example, is far more confidential / important, but most people never have it encrypted. It’s still a fair criticism, but I still see Beeper + iMessage as more privacy-friendly than like FB Messenger (which has way more users).
    - mschuster91 3y ago
      > I’d say the vast majority of users could really care less that an iMessage is decrypted for a brief period in-memory on some Mac VM in a data center. And yet, that's precisely where I would go if I were law enforcement or a secret service. Tell them they're being used by terrorists/drug kingpins/CSAM peddlers, slap a gag order on 'em, and scoop up everything. And unlike Apple, Whatsapp or Telegram whoever hosts such a service can't even refuse such an order on grounds of technical impossibility because the messages are in plaintext in memory.
      - modeless 3y ago
        Law enforcement doesn't need to do that. They can go direct to Apple because Apple's iCloud backup breaks iMessage end-to-end encryption for almost all people anyway (few enable the advanced protection program that fixes this blatant hole and both sides need it enabled to preserve the encryption). This isn't a conspiracy theory, it's documented behavior from Apple. People don't know or care. Use Signal if you want end-to-end encryption and don't feel bad about using Beeper for people stuck on iMessage.
FirmwareBurner 3y ago
>"Sunbird actually logged and stored messages in plain text on both the error reporting software Sentry and in a Firebase store. Authentication tokens were sent over unencrypted HTTP so this token could be intercepted and used to read your messages" Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every single early access reviewer raised these exact security concerns in public? It's the one thing you had to make sure was air-tight, especially considering the raised eyebrows and extra scrutiny you'll get from security researchers when they see something as juicy as "iMessage on Android". Any security issue on launch day/week will get you nailed to the cross and bury your credibility for good. How do these managers get jobs in these big name companies? You could have at least hired a third party for a pen-test/security audit before the big launch. It's the best way to uncover shoddy dev and security practices that creep in when you're crunching to get something out the door by launch day.
- cnity 3y ago
  [flagged]
- mock-possum 3y ago
  It really does beggar belief. I’d love to do interviews with the team, I’ll bet somebody knows why this happened, even if they’re not eager to talk about it.
  - Zetobal 3y ago
    I call it one pm (who will tell you that he can totally code) at the offshore party.
- jwestbury 3y ago
  > Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every single early access reviewer raised these exact security concerns in public? Why are we blaming PMs, here? Plenty of engineers out there make really stupid decisions every day. (To be clear: I'm an engineer, not a PM.)
pmx 3y ago
> Authentication tokens were sent over unencrypted HTTP Wow! How do such fundamental errors make it into these apps? Did _nobody_ who was working on it have an previous experience? Or is this another case of upper management ignoring the experts and pushing terrible ideas regardless?
- wahnfrieden 3y ago
  Under strict hierarchies of business, workers must do what they’re told and lack organization with their peers to gain leverage over bad direction from ownership/exec
  - jedrek 3y ago
    This is by design.
    - wahnfrieden 3y ago
      Of course hopefully workers start to wake up to the leverage they can have over just about anything after seeing the “openai is nothing without its workers” organizing going on Because these hierarchies ultimately aren’t in their interest or the interest of customers, and are only as inflexible as workers allow them to be
      - actionfromafar 3y ago
        So interesting that the same event has several spins right now: - OpenAI is nothing without Sam Altman - OpenAI is nothing without its workers (following Sam Altman) - OpenAI is nothing without its workers (Sam Altman is just a figurehead) A glitch in the Matrix?
        wahnfrieden 3y ago
        Without commenting on the purpose and goal of the organizing, it is a display of worker leverage gained through organizing
whatsthatabout 3y ago
I think it's funny that carl himself said in the announcement video that everything is end-to-end encrypted. Not just in transit, e2e! What a sh*tshow...
dilDDoS 3y ago
Like the article said, this is particularly bad considering how much they hyped up this feature. I first heard about it through MKBHD’s YouTube channel, in a video with almost 3M views. And they couldn’t even bother to validate that basic security measures had been implemented? Or maybe they just flat out didn’t care and thought nobody would notice, which might be even worse. I viewed Nothing as just an overhyped “Android phone but with lights on the back” but this has shown they’re a bit worse than that.
- WaffleIronMaker 3y ago
  Just regarding the MKBDH video, he does explicitly call out the security issues inherent with the design at around 5:53, and credits it as a reason not to try this feature. So, yeah, it's wild that they considered this ready to ship. [1] https://youtu.be/ji5HwS3bhlU?t=352 https://youtu.be/ji5HwS3bhlU?t=352
oefrha 3y ago
I find it utterly bizarre that an engineer/team competent enough to reverse engineer iMessage can release such a shitshow. Almost parody level. Is this some sort of weird “they trust me, dumb fucks” social experiment?
- erinnh 3y ago
  There are open source bridges for iMessage. So I’m not convinced they did. Example: https://github.com/mautrix/imessage https://github.com/mautrix/imessage
- askonomm 3y ago
  But they didn't reverse engineer anything, afaik. Their Android app is just talking to a Mac Mini somewhere in a closet, logged in with the users Apple account (or so was stated in one of the interviews).
  - nicolaslem 3y ago
    Does anyone know how many users a single Mac Mini handles? While I admire the hacker mindset, this solution seems incredibly wasteful so I am curious of its carbon footprint.
    - ChrisLTD 3y ago
      Why does it seem so wasteful?
      - nicolaslem 3y ago
        Because I assume that Apple put a fairly low limit on the number of accounts that can be tied to a single computer.
  - oefrha 3y ago
    Okay, automating Apple account logins on a fleet of macOS VMs is still rarely treaded territory, so it takes some real technical chops, even if it’s mostly stitching together other people’s work. TLS termination on the hand takes <1hr following a guide, if you haven’t done it hundreds of times before…
thejohnconway 3y ago
Reading Sunbird's site makes it all feel like a scam. Their FAQs and Privacy and Security page are just chock full of what appear to be egregious lies. Both repeatedly state that messages are never stored, and end-to-end encrypted. It is not possible they didn't know this was a lie, because it is fundamentally built in a way that can't have E2E encryption (leaving aside the other horrendous security aspects). https://www.sunbirdapp.com/sunbird-stance-on-privacy-and-security https://www.sunbirdapp.com/sunbird-stance-on-privacy-and-sec... This quote is nice: > Some of the messaging community believes that software that is open source is more secure. It is our view that it is not. The more visibility there is into the infrastructure and code, the easier it is to penetrate it. In my opinion, Sunbird Messaging are fraudsters, and Nothing was their mark.
- alternatetwo 3y ago
  > Open source vulnerabilities typically stem from poorly written code that leave gaps, which attackers can use to carryout malicious activities. And closed source code never had any "gaps" whatsoever, eh.
- borg16 3y ago
  > In my opinion, Sunbird Messaging are fraudsters, and Nothing was their mark. 100% agree with this. `nothing` since its inception has been nothing but a marketing gimmick.
  - I_Am_Nous 3y ago
    "Get hyped for the phone that will change the world!" >Unveils phone with blinking LED for notifications and Nothing else interesting Cool...not sure how this changes the world or is considered an innovation of any kind. Have their phones done anything worth talking about since launch?
nocsi 3y ago
Apple should probably implement a brown bubble designation for anyone using iMessage and not able to pass device authentication. Kinda surprised the app got taken down so quickly. This is the type of app LE loves. Being able to surveil into conversations by piggybacking off the weak link
- upget_tiding 3y ago
  AIUI, iMessage was running on legimitate devices. They were using Mac's in a datacenter as a bridge.
  - hermannj314 3y ago
    I realize this isn't in the realm of trademark law, but the green bubble is a mark that indicates you are talking to someone with an apple device, and not to someone through a shady poorly implemented hack. I am for reverse-engineering, but at some point civilized society invented the trademark, and today it seems necessary to create similar bodies of law that protect companies from charlatan Middleware that abuse markings of trust for personal profit.
    - taway1237 3y ago
      Yes, let's give corporations more power. Image bubble colour indicate the protocol you're using, and nothing more. It don't - and can't - guarantee security (many people learned this lesson with https). But sure, let's let corporations super-copyright the colour green.
    - ascagnel_ 3y ago
      > the green bubble is a mark that indicates you are talking to someone with an apple device The bubble color was and is a signifier of transport layer only; I've personally had situations (generally with spotty or very poor coverage) where individual messages go over SMS even for conversations on all Apple hardware where the rest of the conversation is going over iMessage.
calderwoodra 3y ago
The other story people are missing here is that even if this wasn't a security issue, iMessage is adopting RCS next year, so the whole blue/green bubble thing will become much less relevant.
- btown 3y ago
  Even if RCS makes messaging with non-Apple devices more reliable, I‘d assume Apple would continue to use blue for Apple devices only, solely from a branding perspective. Despite all the things regulators are pushing them on, it seems reasonable that a brand can provide aesthetic-only markers for mutual users of the brand.
  - hprotagonist 3y ago
    not to mention that RCS isn’t encrypted.
    - meepmorp 3y ago
      google has added e2ee in their implementation but it's not part of the standard, i think they use the signal protocol rcs is too controlled by carriers for my liking. it's very much an sms replacement, rather than a protocol that treats the cell network as merely a data layer
      - hbn 3y ago
        Apple is implementing RCS as the actual standard, not Google's implementation. Which is the right move, if RCS is going to happen, Google should not be controlling it. Apple said they're planning to work at getting encryption build into the actual standard.
- borissk 3y ago
  The whole blue/green bubble thing is how Apple got something like 80% market share in probably the most valuable demographic in the world - US teenagers. They are no going to let it become less relevant without a desperate fight.
leoh 3y ago
Apple is almost certainly aware of this at the C-Suite level; I wouldn’t even be surprised if Tim Cook were briefed. Had Apple pulled Sunbird’s access to iMessage before information about their shoddy security coming out via third-party, they would have run the risk of playing into Google’s narrative about Apple being petty about their closed standard. Here’s what I think (and hope) will happen: * Apple will revoke Sunbird’s access and/or will sue them; they can almost certainly detect them via fingerprinting and other techniques * Apple will take steps to further protect the iMessage standard The interesting thing here is that Sunbird’s marketing and PR execution, at a casual glance, appear to be as impressive as their engineering implementation dismal, thereby suggesting the usefulness of cautious maneuvering by Apple. Google Cloud would ideally have a role in protecting users here, too; ie blocking Sunbird from its platform on account of exposing users to such formidable risk while so blatantly misrepresenting their security posture. Apple could implore Google to consider, which could look good for GCP; while extending a mutual commitment to implementing RCS together in the interest of users at a moment when skepticism of large tech is at an all-time high.
- UltimateEdge 3y ago
  > Apple is almost certainly aware of this at the C-Suite level What makes you think this?
  - 63 3y ago
    iMessage is one of the primary moats keeping a lot of people on iPhone. I'm not necessarily as sure as the parent comment that the c-suite was briefed or anything, but I do think that iMessage exclusivity is pretty important to Apple
    - hbn 3y ago
      The risk here has never gotten near a point of being about Sunbird slowing down iPhone sales by allowing iMessage on Android. Beeper already has been doing a workaround for sending iMessages from other platforms for a while. The issue is Sunbird's shoddy implementation in particular compromising the security of a bunch of their users' accounts, with a real Android OEM vouching for their service and shipping it on their new phone, giving Sunbird a big publicity boost in the process.
sensanaty 3y ago
I still can't fathom why people would care in the slightest what their message bubble color was (I mean as a European I don't get iMessage at all, I use Signal and WhatsApp for the less tech-literate family of mine), it sounds like the most insanely petty thing to grab onto to care about.
- hraedon 3y ago
  The colors functionally denote the features available in the chat. In group chats, having a single non-iMessage user devolves the features available to the group chat to the SMS level. You also lose E2E and high res pictures and video. The different colors of bubbles are a consequence of iMessage's origin as a protocol that supplanted SMS/MMS messaging while allowing the older protocols as seamless fallbacks; WhatsApp, Signal et al never had a requirement like that, and consequently never had to deal with different feature sets among their users (at least, not to the same extent).
  - aendruk 3y ago
    > Signal never had a requirement like that See TextSecure
- apexalpha 3y ago
  iMessage only works on iOS. If even one non-iOS user joins a chat then all features except for basic texting (SMS and MMS) are dropped. I don't think I need to tell you how much of todays' social interaction happens in group chats. Not having WhatsApp in the Netherlands when you're younger than 30 would effectively make you a hermit. It's probably similar with iMessage in the US. This creates an enormous peer pressure effect, especially for young people, to buy an iOS device.
cantSpellSober 3y ago
Original discovery from texts.com (linked in article) https://texts.blog/2023/11/18/sunbird-security/ https://texts.blog/2023/11/18/sunbird-security/
vinberdon 3y ago
Who could have possibly seen this coming?!?
AmandaGretel 3y ago
[dead]

232 points by seasicksteve 3y ago

modeless 3y ago

Beeper seems a lot better then. Based on Matrix, so at least you know there is a foundation of security there.

leoedin 3y ago
I don't think Beeper can promise end to end encryption for 3rd party services either. Fundamentally if you're interfacing with a service like iMessage or Whatsapp - even if they offer end to end encryption - the message has to be decrypted and then sent to the 3rd party app. Unless that gateway is running on your phone, the messages have to be decrypted in the cloud somewhere. At that point, you are placing all your trust in the 3rd party app's cloud services. Obviously they can still make better decisions than these guys - don't write confidential data to your logs! Don't unencrypted HTTP APIs! But unless the gateways to the 3rd party services run locally, you will never have end to end security. Edit: Beeper has published their bridges as open source, so you could self-host it. That would at least give you full control of the stack. https://github.com/beeper/self-host https://github.com/beeper/self-host
- xinayder 3y ago
  Pretty much useless to self-host your own beeper server since you cannot use their client with your own homeserver. EDIT: forgot to add that there are several beeper specific MSC's that other clients don't render, thus if you want the full experience you either use their service or just stick with a normal matrix instance.
  - erinnh 3y ago
    I don’t know what extra features Beeper has, but I’ve been hosting my own Signal/Telegram bridges for 2 years now. And it’s been working fine with Element as client.
    - dnlzro 3y ago
      As far as I can tell, the Beeper official client is a fork of Element, and there aren’t any huge missing features (other than easily setting up bridges).
- noahtallen 3y ago
  True, but at the same time, it’s a very small attack vector. I’d say the vast majority of users could really care less that an iMessage is decrypted for a brief period in-memory on some Mac VM in a data center. You place your trust in 3rd party cloud servers for so many things. Email, as an example, is far more confidential / important, but most people never have it encrypted. It’s still a fair criticism, but I still see Beeper + iMessage as more privacy-friendly than like FB Messenger (which has way more users).
  - mschuster91 3y ago
    > I’d say the vast majority of users could really care less that an iMessage is decrypted for a brief period in-memory on some Mac VM in a data center. And yet, that's precisely where I would go if I were law enforcement or a secret service. Tell them they're being used by terrorists/drug kingpins/CSAM peddlers, slap a gag order on 'em, and scoop up everything. And unlike Apple, Whatsapp or Telegram whoever hosts such a service can't even refuse such an order on grounds of technical impossibility because the messages are in plaintext in memory.
    - modeless 3y ago
      Law enforcement doesn't need to do that. They can go direct to Apple because Apple's iCloud backup breaks iMessage end-to-end encryption for almost all people anyway (few enable the advanced protection program that fixes this blatant hole and both sides need it enabled to preserve the encryption). This isn't a conspiracy theory, it's documented behavior from Apple. People don't know or care. Use Signal if you want end-to-end encryption and don't feel bad about using Beeper for people stuck on iMessage.

FirmwareBurner 3y ago

>"Sunbird actually logged and stored messages in plain text on both the error reporting software Sentry and in a Firebase store. Authentication tokens were sent over unencrypted HTTP so this token could be intercepted and used to read your messages" Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every single early access reviewer raised these exact security concerns in public? It's the one thing you had to make sure was air-tight, especially considering the raised eyebrows and extra scrutiny you'll get from security researchers when they see something as juicy as "iMessage on Android". Any security issue on launch day/week will get you nailed to the cross and bury your credibility for good. How do these managers get jobs in these big name companies? You could have at least hired a third party for a pen-test/security audit before the big launch. It's the best way to uncover shoddy dev and security practices that creep in when you're crunching to get something out the door by launch day.

cnity 3y ago
[flagged]
mock-possum 3y ago
It really does beggar belief. I’d love to do interviews with the team, I’ll bet somebody knows why this happened, even if they’re not eager to talk about it.
- Zetobal 3y ago
  I call it one pm (who will tell you that he can totally code) at the offshore party.
jwestbury 3y ago
> Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every single early access reviewer raised these exact security concerns in public? Why are we blaming PMs, here? Plenty of engineers out there make really stupid decisions every day. (To be clear: I'm an engineer, not a PM.)

pmx 3y ago

> Authentication tokens were sent over unencrypted HTTP Wow! How do such fundamental errors make it into these apps? Did _nobody_ who was working on it have an previous experience? Or is this another case of upper management ignoring the experts and pushing terrible ideas regardless?

wahnfrieden 3y ago
Under strict hierarchies of business, workers must do what they’re told and lack organization with their peers to gain leverage over bad direction from ownership/exec
- jedrek 3y ago
  This is by design.
  - wahnfrieden 3y ago
    Of course hopefully workers start to wake up to the leverage they can have over just about anything after seeing the “openai is nothing without its workers” organizing going on Because these hierarchies ultimately aren’t in their interest or the interest of customers, and are only as inflexible as workers allow them to be
    - actionfromafar 3y ago
      So interesting that the same event has several spins right now: - OpenAI is nothing without Sam Altman - OpenAI is nothing without its workers (following Sam Altman) - OpenAI is nothing without its workers (Sam Altman is just a figurehead) A glitch in the Matrix?
      - wahnfrieden 3y ago
        Without commenting on the purpose and goal of the organizing, it is a display of worker leverage gained through organizing

whatsthatabout 3y ago

I think it's funny that carl himself said in the announcement video that everything is end-to-end encrypted. Not just in transit, e2e! What a sh*tshow...

dilDDoS 3y ago

Like the article said, this is particularly bad considering how much they hyped up this feature. I first heard about it through MKBHD’s YouTube channel, in a video with almost 3M views. And they couldn’t even bother to validate that basic security measures had been implemented? Or maybe they just flat out didn’t care and thought nobody would notice, which might be even worse. I viewed Nothing as just an overhyped “Android phone but with lights on the back” but this has shown they’re a bit worse than that.

WaffleIronMaker 3y ago
Just regarding the MKBDH video, he does explicitly call out the security issues inherent with the design at around 5:53, and credits it as a reason not to try this feature. So, yeah, it's wild that they considered this ready to ship. [1] https://youtu.be/ji5HwS3bhlU?t=352 https://youtu.be/ji5HwS3bhlU?t=352

oefrha 3y ago

I find it utterly bizarre that an engineer/team competent enough to reverse engineer iMessage can release such a shitshow. Almost parody level. Is this some sort of weird “they trust me, dumb fucks” social experiment?

erinnh 3y ago
There are open source bridges for iMessage. So I’m not convinced they did. Example: https://github.com/mautrix/imessage https://github.com/mautrix/imessage
askonomm 3y ago
But they didn't reverse engineer anything, afaik. Their Android app is just talking to a Mac Mini somewhere in a closet, logged in with the users Apple account (or so was stated in one of the interviews).
- nicolaslem 3y ago
  Does anyone know how many users a single Mac Mini handles? While I admire the hacker mindset, this solution seems incredibly wasteful so I am curious of its carbon footprint.
  - ChrisLTD 3y ago
    Why does it seem so wasteful?
    - nicolaslem 3y ago
      Because I assume that Apple put a fairly low limit on the number of accounts that can be tied to a single computer.
- oefrha 3y ago
  Okay, automating Apple account logins on a fleet of macOS VMs is still rarely treaded territory, so it takes some real technical chops, even if it’s mostly stitching together other people’s work. TLS termination on the hand takes <1hr following a guide, if you haven’t done it hundreds of times before…

thejohnconway 3y ago

Reading Sunbird's site makes it all feel like a scam. Their FAQs and Privacy and Security page are just chock full of what appear to be egregious lies. Both repeatedly state that messages are never stored, and end-to-end encrypted. It is not possible they didn't know this was a lie, because it is fundamentally built in a way that can't have E2E encryption (leaving aside the other horrendous security aspects). https://www.sunbirdapp.com/sunbird-stance-on-privacy-and-security https://www.sunbirdapp.com/sunbird-stance-on-privacy-and-sec... This quote is nice: > Some of the messaging community believes that software that is open source is more secure. It is our view that it is not. The more visibility there is into the infrastructure and code, the easier it is to penetrate it. In my opinion, Sunbird Messaging are fraudsters, and Nothing was their mark.

alternatetwo 3y ago
> Open source vulnerabilities typically stem from poorly written code that leave gaps, which attackers can use to carryout malicious activities. And closed source code never had any "gaps" whatsoever, eh.
borg16 3y ago
> In my opinion, Sunbird Messaging are fraudsters, and Nothing was their mark. 100% agree with this. `nothing` since its inception has been nothing but a marketing gimmick.
- I_Am_Nous 3y ago
  "Get hyped for the phone that will change the world!" >Unveils phone with blinking LED for notifications and Nothing else interesting Cool...not sure how this changes the world or is considered an innovation of any kind. Have their phones done anything worth talking about since launch?

nocsi 3y ago

Apple should probably implement a brown bubble designation for anyone using iMessage and not able to pass device authentication. Kinda surprised the app got taken down so quickly. This is the type of app LE loves. Being able to surveil into conversations by piggybacking off the weak link

upget_tiding 3y ago
AIUI, iMessage was running on legimitate devices. They were using Mac's in a datacenter as a bridge.
- hermannj314 3y ago
  I realize this isn't in the realm of trademark law, but the green bubble is a mark that indicates you are talking to someone with an apple device, and not to someone through a shady poorly implemented hack. I am for reverse-engineering, but at some point civilized society invented the trademark, and today it seems necessary to create similar bodies of law that protect companies from charlatan Middleware that abuse markings of trust for personal profit.
  - taway1237 3y ago
    Yes, let's give corporations more power. Image bubble colour indicate the protocol you're using, and nothing more. It don't - and can't - guarantee security (many people learned this lesson with https). But sure, let's let corporations super-copyright the colour green.
  - ascagnel_ 3y ago
    > the green bubble is a mark that indicates you are talking to someone with an apple device The bubble color was and is a signifier of transport layer only; I've personally had situations (generally with spotty or very poor coverage) where individual messages go over SMS even for conversations on all Apple hardware where the rest of the conversation is going over iMessage.

calderwoodra 3y ago

The other story people are missing here is that even if this wasn't a security issue, iMessage is adopting RCS next year, so the whole blue/green bubble thing will become much less relevant.

btown 3y ago
Even if RCS makes messaging with non-Apple devices more reliable, I‘d assume Apple would continue to use blue for Apple devices only, solely from a branding perspective. Despite all the things regulators are pushing them on, it seems reasonable that a brand can provide aesthetic-only markers for mutual users of the brand.
- hprotagonist 3y ago
  not to mention that RCS isn’t encrypted.
  - meepmorp 3y ago
    google has added e2ee in their implementation but it's not part of the standard, i think they use the signal protocol rcs is too controlled by carriers for my liking. it's very much an sms replacement, rather than a protocol that treats the cell network as merely a data layer
    - hbn 3y ago
      Apple is implementing RCS as the actual standard, not Google's implementation. Which is the right move, if RCS is going to happen, Google should not be controlling it. Apple said they're planning to work at getting encryption build into the actual standard.
borissk 3y ago
The whole blue/green bubble thing is how Apple got something like 80% market share in probably the most valuable demographic in the world - US teenagers. They are no going to let it become less relevant without a desperate fight.

leoh 3y ago

Apple is almost certainly aware of this at the C-Suite level; I wouldn’t even be surprised if Tim Cook were briefed. Had Apple pulled Sunbird’s access to iMessage before information about their shoddy security coming out via third-party, they would have run the risk of playing into Google’s narrative about Apple being petty about their closed standard. Here’s what I think (and hope) will happen: * Apple will revoke Sunbird’s access and/or will sue them; they can almost certainly detect them via fingerprinting and other techniques * Apple will take steps to further protect the iMessage standard The interesting thing here is that Sunbird’s marketing and PR execution, at a casual glance, appear to be as impressive as their engineering implementation dismal, thereby suggesting the usefulness of cautious maneuvering by Apple. Google Cloud would ideally have a role in protecting users here, too; ie blocking Sunbird from its platform on account of exposing users to such formidable risk while so blatantly misrepresenting their security posture. Apple could implore Google to consider, which could look good for GCP; while extending a mutual commitment to implementing RCS together in the interest of users at a moment when skepticism of large tech is at an all-time high.

UltimateEdge 3y ago
> Apple is almost certainly aware of this at the C-Suite level What makes you think this?
- 63 3y ago
  iMessage is one of the primary moats keeping a lot of people on iPhone. I'm not necessarily as sure as the parent comment that the c-suite was briefed or anything, but I do think that iMessage exclusivity is pretty important to Apple
  - hbn 3y ago
    The risk here has never gotten near a point of being about Sunbird slowing down iPhone sales by allowing iMessage on Android. Beeper already has been doing a workaround for sending iMessages from other platforms for a while. The issue is Sunbird's shoddy implementation in particular compromising the security of a bunch of their users' accounts, with a real Android OEM vouching for their service and shipping it on their new phone, giving Sunbird a big publicity boost in the process.

sensanaty 3y ago

I still can't fathom why people would care in the slightest what their message bubble color was (I mean as a European I don't get iMessage at all, I use Signal and WhatsApp for the less tech-literate family of mine), it sounds like the most insanely petty thing to grab onto to care about.

hraedon 3y ago
The colors functionally denote the features available in the chat. In group chats, having a single non-iMessage user devolves the features available to the group chat to the SMS level. You also lose E2E and high res pictures and video. The different colors of bubbles are a consequence of iMessage's origin as a protocol that supplanted SMS/MMS messaging while allowing the older protocols as seamless fallbacks; WhatsApp, Signal et al never had a requirement like that, and consequently never had to deal with different feature sets among their users (at least, not to the same extent).
- aendruk 3y ago
  > Signal never had a requirement like that See TextSecure
apexalpha 3y ago
iMessage only works on iOS. If even one non-iOS user joins a chat then all features except for basic texting (SMS and MMS) are dropped. I don't think I need to tell you how much of todays' social interaction happens in group chats. Not having WhatsApp in the Netherlands when you're younger than 30 would effectively make you a hermit. It's probably similar with iMessage in the US. This creates an enormous peer pressure effect, especially for young people, to buy an iOS device.

cantSpellSober 3y ago

Original discovery from texts.com (linked in article) https://texts.blog/2023/11/18/sunbird-security/ https://texts.blog/2023/11/18/sunbird-security/

vinberdon 3y ago

Who could have possibly seen this coming?!?

AmandaGretel 3y ago

[dead]