7 ms·
The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis
by realusername 3y ago
The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis
- spxneo 3y agothat is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.
- saagarjha 3y agoI don’t understand why people keep bringing this up when it has no functional relevance to how secure it is
- user_7832 3y agoI believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.
- saagarjha 3y agoNo it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.
- realusername 3y agoIt's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app. That's why most of the exploits are targeting imessage
- saagarjha 3y agoNo. Most exploits target iMessage because everyone has it installed.
- realusername 3y agoThere's plenty of normal apps built-in, iOS isn't very modular. But none of those are not as deeply integrated as imessage.
- saagarjha 3y agoOk, but you still haven’t explained how this means it is any less secure. Can you point to exploits that take advantage of the system integration it has?
- realusername 3y agoIt's less secure because it's not using the same sandbox used by billions of apps. > Can you point to exploits that take advantage of the system integration it has? Sure, the last pegasus attack on the image codec would not have worked on Android.
- saagarjha 3y agoYou mean the WebP vulnerability in code that literally everyone shared? That one?
- joe_guy 3y ago> The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis I'm replying to someone who said the important factor is android is open sourced. I pointed out the relevant android program is not open sourced.
- realusername 3y agoThat's a half truth as well because the APIs that Message is using are open source and documented. You can recreate a third-party Message app and that's what is used in some of the android distributions.