4 ms·
Do you really consider Apple's control over a proprietary protocol which they invented and maintain to be comparable to a scenario in which Apple "sends a man"
by georgespencer 3y ago
Do you really consider Apple's control over a proprietary protocol which they invented and maintain to be comparable to a scenario in which Apple "sends a man" to take "your fire extinguisher […] from your house"?
I've re-written this comment five or six times in an attempt to find the most charitable interpretation, but I just cannot comprehend how it made it through your filter and out onto the internet.
- iAMkenough 3y agoThere's an open standard they're refusing to adopt that would be more secure than forcing users back to SMS.
- Hamuko 3y agoAre you referring to the one that they're adopting?
- georgespencer 3y agoApple is adopting RCS, but as far as I can tell your reply has nothing whatsoever to do with my comment.
- kamilner 3y agoIf you mean RCS, end-to-end encryption is not part of the standard, it is a non-standard extension supported only by the google messages app https://support.google.com/messages/answer/10262381?hl=en https://support.google.com/messages/answer/10262381?hl=en
- Rebelgecko 3y agoDoes RCS need E2E to be better than SMS when it comes to privacy/security?
- llm_nerd 3y agoYes, it does. RCS without E2E is following the SMS model and putting your telco in charge. It uses transport encryption but that is basically meaningless when every relay sees the entire contents of the message.
- Rebelgecko 3y agoDoes that mean Stingrays and just regular old SDRs can still pick up RCS messages?
- llm_nerd 3y agoRCS uses transport encryption and I honestly have no idea if it uses cert pinning or server certs or the like. The bigger concern to me is that it puts your telco in charge, just like the old days of SMS. Without E2E they get to see all of the contents of messages and to share it with whoever they deem they want to share it with, which history has shown is too many people. Telcos were very willing partners in the development of RCS for a reason. And there's a reason the base spec doesn't include E2E. Telcos want a return to the good old days. SMS is insecure and no one should use it. RCS isn't that much better and history is a lesson that it returns to a partner that isn't trustworthy.
- NavinF 3y agoYeah anything that's not E2E encrypted is pretty useless for privacy/security these days. Might as well just use DMs on reddit, twitter, etc if you don't care about E2E
- dwaite 3y agoIMHO profiled RCS is notably worse than SMS for privacy, because the vast majority of RCS servers are hosted by Google. SMS can be read but it is still at least somewhat decentralized. It isn't being funneled to a single party whose business model is profiling users.
- zem 3y agoi am just flabbergasted that we are living in a timeline where the phrase "proprietary protocol" is a real thing
- NavinF 3y agoAren't most protocols proprietary? Every app builds their own on top of standard protocols like HTTP, TLS, and IP. Not all services are hostile to third party clients though
- zem 3y agowell, there's proprietary in the sense of "not a standard" and proprietary in the sense of "no one else can make software that uses this protocol". the latter is very weird if you think about it.
- NavinF 3y agoEh not really that weird. Consider how Microsoft repeatedly reverse engineered AOL for compatibility reasons and AOL actively blocked their efforts with every update: https://youtu.be/w-7PjunSxLU https://youtu.be/w-7PjunSxLU Stuff like this happens all the time and the internet has always been like this. I'm sure older users will remember even older examples
- maxlin 3y agoIt's not a super serious comment, it's more about how ridiculous the tone of "We are doing this for YOUR protection" would be. On a more serious note though, in the end Apple absolutely has the power of increasing everyone's capability and security by doing something like setting up a playbook of how iMessage could just use Signal protocol and how other actors could join in, or really anything else but doing this.
- georgespencer 3y ago> It's not a super serious comment, it's more about how ridiculous the tone of "We are doing this for YOUR protection" would be. Right now I can presume a basic level of device security across all iMessage threads I have. Beeper deranges that: E2EE is still there, but Beeper exposes my correspondence to device security weaknesses from other OEMs, malware, keyloggers, screen scrapers, etc. as a result of lax app marketplace security & privacy. It seems to me to be entirely disingenuous to suggest that Beeper increases security: in fact, the opposite is true. > in the end Apple absolutely has the power of increasing everyone's capability and security by doing something like setting up a playbook of how iMessage could just use Signal protocol and how other actors could join in, or really anything else but doing this. I don't see why any company should be denigrated for not helping the users of another competing platform, particularly when doing so likely comes at the cost of increasing the risk to its own users.
- scatters 3y agoDoes Apple block imessage on rooted phones? If not, what level of device security do you really have?
- georgespencer 3y agoIn addition to explicitly prohibiting it as a violation of the iPhone EULA, Apple goes to extraordinary lengths to close the exploits which allow jailbreaking. Apple doesn't just block iMessage on rooted phones, it tries to prevent jailbreaking outright.