3 ms·

I do not believe the android Messages application is open source. I believe AOSP contains something very barebones. It has been a lot of years, am I incorrect?

realusername 2y ago
The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis
- spxneo 2y ago
  that is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.
- saagarjha 2y ago
  I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is
  - user_7832 2y ago
    I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.
    - saagarjha 2y ago
      No it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.
  - realusername 2y ago
    It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app. That's why most of the exploits are targeting imessage
    - saagarjha 2y ago
      No. Most exploits target iMessage because everyone has it installed.
      - realusername 2y ago
        There's plenty of normal apps built-in, iOS isn't very modular. But none of those are not as deeply integrated as imessage.
        saagarjha 2y ago
        Ok, but you still haven’t explained how this means it is any less secure. Can you point to exploits that take advantage of the system integration it has?
        realusername 2y ago
        It's less secure because it's not using the same sandbox used by billions of apps. > Can you point to exploits that take advantage of the system integration it has? Sure, the last pegasus attack on the image codec would not have worked on Android.
        saagarjha 2y ago
        You mean the WebP vulnerability in code that literally everyone shared? That one?
- joe_guy 2y ago
  > The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis I'm replying to someone who said the important factor is android is open sourced. I pointed out the relevant android program is not open sourced.
  - realusername 2y ago
    That's a half truth as well because the APIs that Message is using are open source and documented. You can recreate a third-party Message app and that's what is used in some of the android distributions.

realusername 2y ago

The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

spxneo 2y ago
that is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.
saagarjha 2y ago
I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is
- user_7832 2y ago
  I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.
  - saagarjha 2y ago
    No it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.
- realusername 2y ago
  It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app. That's why most of the exploits are targeting imessage
  - saagarjha 2y ago
    No. Most exploits target iMessage because everyone has it installed.
    - realusername 2y ago
      There's plenty of normal apps built-in, iOS isn't very modular. But none of those are not as deeply integrated as imessage.
      - saagarjha 2y ago
        Ok, but you still haven’t explained how this means it is any less secure. Can you point to exploits that take advantage of the system integration it has?
        realusername 2y ago
        It's less secure because it's not using the same sandbox used by billions of apps. > Can you point to exploits that take advantage of the system integration it has? Sure, the last pegasus attack on the image codec would not have worked on Android.
        saagarjha 2y ago
        You mean the WebP vulnerability in code that literally everyone shared? That one?
joe_guy 2y ago
> The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis I'm replying to someone who said the important factor is android is open sourced. I pointed out the relevant android program is not open sourced.
- realusername 2y ago
  That's a half truth as well because the APIs that Message is using are open source and documented. You can recreate a third-party Message app and that's what is used in some of the android distributions.