3 ms·

(1) is exactly what that quote is pointing out. If Apple actually cared about its users' security, they would see this as a gap, and would have addressed it alr

(1) is exactly what that quote is pointing out. If Apple actually cared about its users' security, they would see this as a gap, and would have addressed it already. The fact that they haven't means that, despite all their posturing about being a security-first platform, they care more about lock-in and marketing than they do about user security.

robertoandred 3y ago
An intentional gap? Or a bug that they've now fixed?
- Dylan16807 3y ago
  Fixing this bug leaves the gap intact.
Grustaf 3y ago
It's a pretty indirect gap, since it has nothing to do with Apple's infrastructure, it's about users choosing to interact with users of non-Apple platforms using insecure means. There are dozens of secure cross-platform messenger apps that they could be using, and SMS is a legacy technology.
georgespencer 3y ago
Putting aside that I count at least two glaring examples from this list[^1] in your reply, I suspect Apple would argue that it is in fact _solely_ preoccupied with its users' security: that's why iMessage is end to end encrypted and Apple does not offer 2FA / OTPs via SMS. Apple does not generally try to mitigate security issues which are beyond its control (e.g. non-Apple devices, protocols). [^1]: https://en.wikipedia.org/wiki/List_of_fallacies https://en.wikipedia.org/wiki/List_of_fallacies
- jeroenhd 3y ago
  > and Apple does not offer 2FA / OTPs via SMS Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. I'm not all that confident about Apple's approach to account security. Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble.
  - philistine 3y ago
    Those security questions are now very much optional. I made sure to lock down my Apple account. If I lose either my password or access to all my devices, the only thing that can unlock my account is a long printed code or permission from a trusted family member. My account no longer has security questions. Apple is doing it optionally because they're trying to balance two opposing forces here: helping its users access a locked account, and giving users tightly locked accounts.
  - georgespencer 3y ago
    My points are narrowly related to the parent's assertion that Apple preventing Beeper Mini interoperability / allowing SMS is evidence of their convictions relating to privacy being hokum, but since you're not one of those 3 month old accounts I see making specious arguments… > Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Apple's default for a number of years has been to use trusted devices IIRC. Their kb article on resetting a forgotten Apple ID password even suggests that it's better to wait until you're back with a trusted device than to immediately try to reset without one, suggesting that the process is somewhat intensive and perhaps subject to human review? I just kicked it off online and the first question _is_ to confirm an obfuscated cell phone number, but I can't imagine that after that it's mother's maiden name dreck? > Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Which would thus expose them to security weaknesses of a device and OS they do not control, and potentially expose iPhone and iOS customers to increased risk should an Android iMessage user's phone have malware, or screen scraping, or keylogging, etc. > Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble. Nail on the head, but I do think that folks overstate the simplicity with which Apple could provide a comparably secure iMessage experience on Android.
  - reaperducer 3y ago
    Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Check again. I recently reset a forgotten iTunes password. This required: - An email verification - An SMS verification - A verification code sent to another device on the account - A ten-day wait - Another second device verification That's 5FA authentication just to reset a password. The days of answering personal trivia questions to reset passwords are long gone.
- goosedragons 3y ago
  They do offer 2FA via SMS. This is AFAIK the ONLY option for Android/non-Mac users. Why are those users less deserving of decent security? Apple still sells and offers services outside their platforms, so they're still customers potentially with hundreds or thousands of dollars worth of purchases and CCs attached. FFS Nintendo has better 2FA options than Apple for non-Apple platforms.
  - georgespencer 3y ago
    > Why are those users less deserving of decent security? Because they don't own an Apple device or have iMessage, which is the entire point of this discussion?
    - goosedragons 3y ago
      So Apple only cares about security for Apple platform users and not all users of Apple services? Such commitment to security...
- kevincox 3y ago
  This is like making a car where the airbags only deploy if you hit another car of the same brand. Sure, if this car is super safe it may be better if both you and the other driver both had it. But it is clearly better to have airbags, even if the other car is less safe than it could be if it was from the first-party brand. It is one thing to not try to mitigate security issues outside their control and another thing to remove possible security because you don't control it entirely.
7e 3y ago
A third party client in iMessage allows for spam attacks, and (worse) malicious payload attacks. It’s very much in the interests of security that Apple fence them out.
- danShumway 3y ago
  I don't think it's at all clear that the approach you describe is working: https://www.wired.com/story/imessage-interactionless-hacks-google-project-zero/ https://www.wired.com/story/imessage-interactionless-hacks-g... (2019), https://www.forbes.com/sites/daveywinder/2023/06/02/warning-issued-for-iphone-users-as-ongoing-imessage-0-click-attack-revealed/ https://www.forbes.com/sites/daveywinder/2023/06/02/warning-... (2023) Of course, this is a hard problem. I'm not saying Apple is bad at security, many good messaging platforms run into these kinds of problems. But the way you fix these problems (and the way Apple in fact did fix the bugs above) was through patching their own software, not by trying to control what attackers can send. If security researches can send a malicious payload attack that compromises iMessage, the solution is not to make sure they can't send that payload (which would be impossible to guarantee anyway), the solution is to patch iMessage to no longer be vulnerable to that payload attack. One hopes that the only thing preventing your iMessage client from being compromised is not whether or not the attacker has a spare $1,000 lying around.
  - api 3y ago
    The longer term solution is to stop using memory unsafe languages.
    - danShumway 3y ago
      Regardless, when a buffer overflow happens, it's not reasonable to say, "well, we'll just make sure nobody sends us badly formatted or maliciously formatted data. As long as only iPhone users can send us data then we can trust it." The actual solution is to make the client/server not be vulnerable to malicious payloads that would cause a buffer overflow. Whether you do that by patching bugs individually or switching to a memory safe language, or whatever strategy is used -- "don't send our messaging platform bad data" isn't a security fix.

robertoandred 3y ago

An intentional gap? Or a bug that they've now fixed?

Dylan16807 3y ago
Fixing this bug leaves the gap intact.

Grustaf 3y ago

It's a pretty indirect gap, since it has nothing to do with Apple's infrastructure, it's about users choosing to interact with users of non-Apple platforms using insecure means. There are dozens of secure cross-platform messenger apps that they could be using, and SMS is a legacy technology.

georgespencer 3y ago

Putting aside that I count at least two glaring examples from this list[^1] in your reply, I suspect Apple would argue that it is in fact _solely_ preoccupied with its users' security: that's why iMessage is end to end encrypted and Apple does not offer 2FA / OTPs via SMS. Apple does not generally try to mitigate security issues which are beyond its control (e.g. non-Apple devices, protocols). [^1]: https://en.wikipedia.org/wiki/List_of_fallacies https://en.wikipedia.org/wiki/List_of_fallacies

jeroenhd 3y ago
> and Apple does not offer 2FA / OTPs via SMS Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. I'm not all that confident about Apple's approach to account security. Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble.
- philistine 3y ago
  Those security questions are now very much optional. I made sure to lock down my Apple account. If I lose either my password or access to all my devices, the only thing that can unlock my account is a long printed code or permission from a trusted family member. My account no longer has security questions. Apple is doing it optionally because they're trying to balance two opposing forces here: helping its users access a locked account, and giving users tightly locked accounts.
- georgespencer 3y ago
  My points are narrowly related to the parent's assertion that Apple preventing Beeper Mini interoperability / allowing SMS is evidence of their convictions relating to privacy being hokum, but since you're not one of those 3 month old accounts I see making specious arguments… > Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Apple's default for a number of years has been to use trusted devices IIRC. Their kb article on resetting a forgotten Apple ID password even suggests that it's better to wait until you're back with a trusted device than to immediately try to reset without one, suggesting that the process is somewhat intensive and perhaps subject to human review? I just kicked it off online and the first question _is_ to confirm an obfuscated cell phone number, but I can't imagine that after that it's mother's maiden name dreck? > Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Which would thus expose them to security weaknesses of a device and OS they do not control, and potentially expose iPhone and iOS customers to increased risk should an Android iMessage user's phone have malware, or screen scraping, or keylogging, etc. > Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble. Nail on the head, but I do think that folks overstate the simplicity with which Apple could provide a comparably secure iMessage experience on Android.
- reaperducer 3y ago
  Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Check again. I recently reset a forgotten iTunes password. This required: - An email verification - An SMS verification - A verification code sent to another device on the account - A ten-day wait - Another second device verification That's 5FA authentication just to reset a password. The days of answering personal trivia questions to reset passwords are long gone.
goosedragons 3y ago
They do offer 2FA via SMS. This is AFAIK the ONLY option for Android/non-Mac users. Why are those users less deserving of decent security? Apple still sells and offers services outside their platforms, so they're still customers potentially with hundreds or thousands of dollars worth of purchases and CCs attached. FFS Nintendo has better 2FA options than Apple for non-Apple platforms.
- georgespencer 3y ago
  > Why are those users less deserving of decent security? Because they don't own an Apple device or have iMessage, which is the entire point of this discussion?
  - goosedragons 3y ago
    So Apple only cares about security for Apple platform users and not all users of Apple services? Such commitment to security...
kevincox 3y ago
This is like making a car where the airbags only deploy if you hit another car of the same brand. Sure, if this car is super safe it may be better if both you and the other driver both had it. But it is clearly better to have airbags, even if the other car is less safe than it could be if it was from the first-party brand. It is one thing to not try to mitigate security issues outside their control and another thing to remove possible security because you don't control it entirely.

7e 3y ago

A third party client in iMessage allows for spam attacks, and (worse) malicious payload attacks. It’s very much in the interests of security that Apple fence them out.

danShumway 3y ago
I don't think it's at all clear that the approach you describe is working: https://www.wired.com/story/imessage-interactionless-hacks-google-project-zero/ https://www.wired.com/story/imessage-interactionless-hacks-g... (2019), https://www.forbes.com/sites/daveywinder/2023/06/02/warning-issued-for-iphone-users-as-ongoing-imessage-0-click-attack-revealed/ https://www.forbes.com/sites/daveywinder/2023/06/02/warning-... (2023) Of course, this is a hard problem. I'm not saying Apple is bad at security, many good messaging platforms run into these kinds of problems. But the way you fix these problems (and the way Apple in fact did fix the bugs above) was through patching their own software, not by trying to control what attackers can send. If security researches can send a malicious payload attack that compromises iMessage, the solution is not to make sure they can't send that payload (which would be impossible to guarantee anyway), the solution is to patch iMessage to no longer be vulnerable to that payload attack. One hopes that the only thing preventing your iMessage client from being compromised is not whether or not the attacker has a spare $1,000 lying around.
- api 3y ago
  The longer term solution is to stop using memory unsafe languages.
  - danShumway 3y ago
    Regardless, when a buffer overflow happens, it's not reasonable to say, "well, we'll just make sure nobody sends us badly formatted or maliciously formatted data. As long as only iPhone users can send us data then we can trust it." The actual solution is to make the client/server not be vulnerable to malicious payloads that would cause a buffer overflow. Whether you do that by patching bugs individually or switching to a memory safe language, or whatever strategy is used -- "don't send our messaging platform bad data" isn't a security fix.