5 ms·

Putting aside that I count at least two glaring examples from this list[^1] in your reply, I suspect Apple would argue that it is in fact _solely_ preoccupied w

Putting aside that I count at least two glaring examples from this list[^1] in your reply, I suspect Apple would argue that it is in fact _solely_ preoccupied with its users' security: that's why iMessage is end to end encrypted and Apple does not offer 2FA / OTPs via SMS. Apple does not generally try to mitigate security issues which are beyond its control (e.g. non-Apple devices, protocols). [^1]: https://en.wikipedia.org/wiki/List_of_fallacies https://en.wikipedia.org/wiki/List_of_fallacies

jeroenhd 3y ago
> and Apple does not offer 2FA / OTPs via SMS Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. I'm not all that confident about Apple's approach to account security. Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble.
- philistine 3y ago
  Those security questions are now very much optional. I made sure to lock down my Apple account. If I lose either my password or access to all my devices, the only thing that can unlock my account is a long printed code or permission from a trusted family member. My account no longer has security questions. Apple is doing it optionally because they're trying to balance two opposing forces here: helping its users access a locked account, and giving users tightly locked accounts.
- georgespencer 3y ago
  My points are narrowly related to the parent's assertion that Apple preventing Beeper Mini interoperability / allowing SMS is evidence of their convictions relating to privacy being hokum, but since you're not one of those 3 month old accounts I see making specious arguments… > Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Apple's default for a number of years has been to use trusted devices IIRC. Their kb article on resetting a forgotten Apple ID password even suggests that it's better to wait until you're back with a trusted device than to immediately try to reset without one, suggesting that the process is somewhat intensive and perhaps subject to human review? I just kicked it off online and the first question _is_ to confirm an obfuscated cell phone number, but I can't imagine that after that it's mother's maiden name dreck? > Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Which would thus expose them to security weaknesses of a device and OS they do not control, and potentially expose iPhone and iOS customers to increased risk should an Android iMessage user's phone have malware, or screen scraping, or keylogging, etc. > Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble. Nail on the head, but I do think that folks overstate the simplicity with which Apple could provide a comparably secure iMessage experience on Android.
- reaperducer 3y ago
  Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Check again. I recently reset a forgotten iTunes password. This required: - An email verification - An SMS verification - A verification code sent to another device on the account - A ten-day wait - Another second device verification That's 5FA authentication just to reset a password. The days of answering personal trivia questions to reset passwords are long gone.
- saintfire 3y ago
  > Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. I'm surprised I haven't seen this mentioned more. They could even make a green (or whatever colour they wish) iMessage bubble to denote that it is not from an Apple device. Seems like it solves all the problems people present with E2EE/iMessage with Android interop. On the issue of spam, which I feel is just grasping at straws, You could allow blocking unknown non-Apple iMessages by default. Unless I am mistaken, this really only leaves the walled-garden as the thing that stops Apple from implementing something like this. In fact, you could even only allow Android iMessage conversations that include at least one genuine Apple device. This combats the argument that they shouldn't have to give resources away to Android users for free. This would be added-value to their own customers by providing more streamlined messaging with their Android contacts. Such as situations where group chats are forced to swap to MMS for a single Android user, sending pictures/video to a friend, etc.
goosedragons 3y ago
They do offer 2FA via SMS. This is AFAIK the ONLY option for Android/non-Mac users. Why are those users less deserving of decent security? Apple still sells and offers services outside their platforms, so they're still customers potentially with hundreds or thousands of dollars worth of purchases and CCs attached. FFS Nintendo has better 2FA options than Apple for non-Apple platforms.
- georgespencer 3y ago
  > Why are those users less deserving of decent security? Because they don't own an Apple device or have iMessage, which is the entire point of this discussion?
  - goosedragons 3y ago
    So Apple only cares about security for Apple platform users and not all users of Apple services? Such commitment to security...
kevincox 3y ago
This is like making a car where the airbags only deploy if you hit another car of the same brand. Sure, if this car is super safe it may be better if both you and the other driver both had it. But it is clearly better to have airbags, even if the other car is less safe than it could be if it was from the first-party brand. It is one thing to not try to mitigate security issues outside their control and another thing to remove possible security because you don't control it entirely.

jeroenhd 3y ago

> and Apple does not offer 2FA / OTPs via SMS Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. I'm not all that confident about Apple's approach to account security. Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble.

philistine 3y ago
Those security questions are now very much optional. I made sure to lock down my Apple account. If I lose either my password or access to all my devices, the only thing that can unlock my account is a long printed code or permission from a trusted family member. My account no longer has security questions. Apple is doing it optionally because they're trying to balance two opposing forces here: helping its users access a locked account, and giving users tightly locked accounts.
georgespencer 3y ago
My points are narrowly related to the parent's assertion that Apple preventing Beeper Mini interoperability / allowing SMS is evidence of their convictions relating to privacy being hokum, but since you're not one of those 3 month old accounts I see making specious arguments… > Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Apple's default for a number of years has been to use trusted devices IIRC. Their kb article on resetting a forgotten Apple ID password even suggests that it's better to wait until you're back with a trusted device than to immediately try to reset without one, suggesting that the process is somewhat intensive and perhaps subject to human review? I just kicked it off online and the first question _is_ to confirm an obfuscated cell phone number, but I can't imagine that after that it's mother's maiden name dreck? > Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. Which would thus expose them to security weaknesses of a device and OS they do not control, and potentially expose iPhone and iOS customers to increased risk should an Android iMessage user's phone have malware, or screen scraping, or keylogging, etc. > Apple chooses not to, and it's their choice, of course. It doesn't care about the privacy of it's non-users, and it doesn't care about the privacy of its users when they communicate with non-users. From what I can tell, it only cares if you stay within the Apple bubble. Nail on the head, but I do think that folks overstate the simplicity with which Apple could provide a comparably secure iMessage experience on Android.
reaperducer 3y ago
Last time I checked, Apple still used security questions any hacker can get answers to on Facebook. Check again. I recently reset a forgotten iTunes password. This required: - An email verification - An SMS verification - A verification code sent to another device on the account - A ten-day wait - Another second device verification That's 5FA authentication just to reset a password. The days of answering personal trivia questions to reset passwords are long gone.
saintfire 3y ago
> Apple has the ability to control security issues on Android: they can release an Android app, like every other E2EE messenger out there. I'm surprised I haven't seen this mentioned more. They could even make a green (or whatever colour they wish) iMessage bubble to denote that it is not from an Apple device. Seems like it solves all the problems people present with E2EE/iMessage with Android interop. On the issue of spam, which I feel is just grasping at straws, You could allow blocking unknown non-Apple iMessages by default. Unless I am mistaken, this really only leaves the walled-garden as the thing that stops Apple from implementing something like this. In fact, you could even only allow Android iMessage conversations that include at least one genuine Apple device. This combats the argument that they shouldn't have to give resources away to Android users for free. This would be added-value to their own customers by providing more streamlined messaging with their Android contacts. Such as situations where group chats are forced to swap to MMS for a single Android user, sending pictures/video to a friend, etc.

goosedragons 3y ago

They do offer 2FA via SMS. This is AFAIK the ONLY option for Android/non-Mac users. Why are those users less deserving of decent security? Apple still sells and offers services outside their platforms, so they're still customers potentially with hundreds or thousands of dollars worth of purchases and CCs attached. FFS Nintendo has better 2FA options than Apple for non-Apple platforms.

georgespencer 3y ago
> Why are those users less deserving of decent security? Because they don't own an Apple device or have iMessage, which is the entire point of this discussion?
- goosedragons 3y ago
  So Apple only cares about security for Apple platform users and not all users of Apple services? Such commitment to security...

kevincox 3y ago

This is like making a car where the airbags only deploy if you hit another car of the same brand. Sure, if this car is super safe it may be better if both you and the other driver both had it. But it is clearly better to have airbags, even if the other car is less safe than it could be if it was from the first-party brand. It is one thing to not try to mitigate security issues outside their control and another thing to remove possible security because you don't control it entirely.