4 ms·
If Apple does start enforcing signed attestations, they will say that it's to reduce abuse. I have no doubt (being in the anti-abuse world) that spammers and ph
by ttul 3y ago
If Apple does start enforcing signed attestations, they will say that it's to reduce abuse. I have no doubt (being in the anti-abuse world) that spammers and phishing gangs will immediately begin using Beeper to spam iMessage users because this allows them to avoid buying an iOS device. With end-to-end encryption, Apple may also decide to roll out privacy-protecting client-side spam and phishing detection, which would IMHO be a really great thing.
- solardev 3y agoMaybe Apple needs an even blue-r bubble to set apart the super attested users from the mere blue bubble peasants
- andygeorge 3y agothey could call it "apple blue" and charge a few bucks a month for it. People love that stuff
- reiichiroh 3y agoI’d pay for a blue Apple checkmark!
- cozzyd 3y agoThey can desaturate the iPhone / MacBook Air users to disambiguate from the MacBook pro / iPhone pro / max users. Also device age in years will add hints of green hue. That way people know they're talking to someone who can afford to spend thousands of dollars on hardware every year.
- andygeorge 3y agowait is this where "green with envy" will come from?????
- dylan604 3y agoI imagine the next color being purple since that's a sign of royalty. Hail to the king baby!
- sounds 3y agoThe phone number registration https://blog.beeper.com/i/139416474/sending-and-receiving-messages https://blog.beeper.com/i/139416474/sending-and-receiving-me... will make it possible to enforce legal action against malicious and spammy messages. Note that iPhones already receive SMS spam and fraud just like every other phone. However, you are correct that the blue bubble is no longer a guarantee that the bad actor is using an iPhone.
- lxgr 3y ago> The phone number registration https://blog.beeper.com/i/139416474/sending-and-receiving-me https://blog.beeper.com/i/139416474/sending-and-receiving-me... will make it possible to enforce legal action against malicious and spammy messages Like the legal action that is currently protecting us from robocalls? I don’t know if iMessage registration requires bidirectional SMS verification, though. If it does, that would be significantly harder to spoof than just caller IDs.
- azinman2 3y agoThey do receive spam and fraud, but the numbers are orders of magnitude less than every one’s else BECAUSE it’s tied to hardware. I don’t know the details of how’s these guys got around it, but this is bad for the rest of us when phishing skyrockets.
- smt88 3y agoI don't understand what you're talking about. I get far more SMS spam on iOS than I did on Android. Whether the number uses iMessage or not is totally irrelevant.
- hbn 3y agoHow can you get more SMS spam on one platform than another? With SMS they're just blindly sending to your phone number, your SIM could be in any device. They don't know what platform you're receiving it on.
- 3y ago
- JoshTriplett 3y ago> With end-to-end encryption, Apple may also decide to roll out privacy-protecting client-side spam and phishing detection, which would IMHO be a really great thing. Spam protection should be on the recipient, rather than the sender.
- jeroenhd 3y agoI disagree. Email has SPF and DKIM an what have you exactly because client side filtering doesn't work right. Mail gets dropped beforr the clients even get a chance to run filters. That's not to say that requiring remote attestation or blocking third party clients entirely is proportional, but Apple should (and does) play a role in spam prevention.
- JoshTriplett 3y agoSPF and DKIM are ways of signing a message, but it's still typically up to the recipient or the recipient's mail server to decide what to do with that signature. And they're only checkable on the recipient's mail server because email isn't properly end-to-end encrypted, and exposes metadata.
- jeroenhd 3y agoSPF and DKIM can be checked client side no problem, assuming your mail server doesn't mangle the received-from headers. We just generally only use them as server-side filtering.
- mkingston 3y agoThat's a brief statement which makes me think I'm missing something obvious, but it doesn't seem obvious to me. Would you please expand on that?
- JoshTriplett 3y agoI think it's a bad idea to lock out unattested clients, and as long as third-party clients are accepted, spam will always be sendable. If you're not doing end-to-end encryption, you can catch it at send time by having the server reject the client for sending spam. If you're doing end-to-end encryption, the only options are the sender or the recipient, and attempting to block it at the sender would require prohibiting interoperability.