4 ms·

AT&T Breach Shows Why RCS Can't Be Trusted

26 points by ingve 2y ago

Someone 2y ago
FTA: “the argument against RCS is strong and simple: it doesn’t support end-to-end encryption” “SMS and traditional telephone voice calls lack any encryption at all, but they’re firmly established. Just like email. But anything new should only be supported if it’s fundamentally based on E2EE.” “Perhaps, someday, the RCS spec will support an open standard for E2EE. I’m not holding my breath for that. For one thing, industry consortiums tend not to produce good solutions to hard problems, and an open standard for E2EE messaging is a very hard problem.” So, they argue - new communication standards must be end-to-end encrypted - that open end-to-end encrypted standards cannot be developed If both are true any new communication standards must be proprietary. I don’t think that’s a conclusion shared by society.
- LorenDB 2y ago
  Open, decentralized, and federated E2EE is clearly possible. Matrix is a perfect example of this.
  - voxic11 2y ago
    Was it developed by an industry consortium though? It seems like it was created by a single company.
- voxic11 2y ago
  They argue that open end-to-end encrypted standards cannot be developed by industry consortiums which seems to be true.
  - jvolkman 2y ago
    That is the recently-ratified RFC9420, or Messaging Layer Security [1]. Matrix is supportive [2], Google is supportive [3], and Google Messages is actively gaining support [4]. 1: https://datatracker.ietf.org/doc/rfc9420/ https://datatracker.ietf.org/doc/rfc9420/ 2: https://matrix.org/blog/2023/07/a-giant-leap-with-mls https://matrix.org/blog/2023/07/a-giant-leap-with-mls 3: https://security.googleblog.com/2023/07/an-important-step-towards-secure-and.html https://security.googleblog.com/2023/07/an-important-step-to... 4: https://www.androidauthority.com/google-mls-e2ee-messages-3457483/ https://www.androidauthority.com/google-mls-e2ee-messages-34...
- dialup_sounds 2y ago
  He did not say that open E2EE could not be developed. Of course it could, someday, maybe. Meanwhile the proprietary networks that literally billions of people already use have had E2E for 10+ years.
bearjaws 2y ago
If anything RCS has shown people will use the encryption buzz word like it's some silver bullet of security. Unless you are the only holder of the key, encryption is typically useless in a hack. Go ask every healthcare breach and they will tell you the data was encrypted... If RCS was encrypted there is a 99% chance att would have the keys easily accessible.
aesh2Xa1 2y ago
Hm, the breach contained metadata, but not message contents. RCS does not attempt to defend against metadata surveillance. Is the author's point, simplified, "any centralized collection of communications data, unencrypted, is vulnerable?" They mention E2EE, but even some of those still present centralized, unencrypted metadata.
- FireBeyond 2y ago
  Maybe. But really, to me, the author's real point is "Why are you people forcing Apple to support RCS? Leave them alone" and he'll draw longer and longer bows to justify it. Gruber has had several moments where he's stridently defended Apple and denied issues only for it later to be revealed that there absolutely was an issue. The last straw for me was the LassPass App Store issue a few months ago (where a scam app was approved and took the top spot in the store, over the official app). Gruber, on this: > > Instead, the scam LassPass app tries to steer you to creating a “pro” account subscription for $2/month, $10/year, or a $50 lifetime purchase. Those are actually low prices for a scam app — a lot of scammy apps try to charge like $10/week. Emphasis mine, but are you kidding me? He actually tries to downplay the issue by saying "Well, at least you wouldn't be scammed out of that much money". And then doubles down, by claiming, with absolutely no knowledge whatsoever: > It doesn't look like the app was intended to steal credentials. Why do you think that is plausible reasoning? To me, the credentials are what you're intending to steal with the scam app. You might make some money from the IAPs, but that's a cherry on the top (and likely the actual reason why the amounts were low, so it didn't raise more red flags). I've seen yoga practitioners who can't contort themselves as much as Gruber can when trying to defend/promote Apple and their interests.
  - isleyaardvark 2y ago
    > He actually tries to downplay the issue by saying "Well, at least you wouldn't be scammed out of that much money". That’s a ridiculously uncharitable take on a simple statement of fact that you yourself even seem to accept later in your comment.
    - 2y ago
retrocryptid 2y ago
i'm a fan of E2EE, but the AT&T hack did not involve intercepting RCS messages. It's sort of like saying "Chewbacca is a Wookie, therefore you shouldn't use RCS."
- HeatrayEnjoyer 2y ago
  I don't see the section that says it involved accessing RCS messages.
  - FireBeyond 2y ago
    See my other comment. Gruber doesn't say it involved accessing RCS, but he does write nearly 2,000 words strongly implying and reinforcing that "Apple knows best" and that if they say they shouldn't have to support RCS, you should trust them.
kevincox 2y ago
I really don't understand why people want to tie their messaging to their mobile service provider. This seems best as two jobs for two companies. Then I can switch either at will. 1. Mobile internet access. 2. Messaging.
- dpkirchner 2y ago
  I think it comes down to the fact that every mobile phone supports at least SMS if not RCS out of the box -- no new apps, no signing up for new services, etc.
  - JohnFen 2y ago
    This. The thing I (in the US) really like about SMS is that everybody can do it. With apps, I'd have to have a number of different ones and remember who is using which one. It seems like a huge pain in the butt to me.
- lern_too_spel 2y ago
  For the same reason they tie their phone calling to their mobile service provider. I don't like tying communications to phone numbers either because that means you need phone service to communicate, but that ship has sailed, and there are many people who barely use email at all.
eqvinox 2y ago
Use Signal, problem solved? headscratch
r0ks0n 2y ago
https://news.ycombinator.com/from?site=daringfireball.net https://news.ycombinator.com/from?site=daringfireball.net ctrl+f apple

26 points by ingve 2y ago

FTA: “the argument against RCS is strong and simple: it doesn’t support end-to-end encryption” “SMS and traditional telephone voice calls lack any encryption at all, but they’re firmly established. Just like email. But anything new should only be supported if it’s fundamentally based on E2EE.” “Perhaps, someday, the RCS spec will support an open standard for E2EE. I’m not holding my breath for that. For one thing, industry consortiums tend not to produce good solutions to hard problems, and an open standard for E2EE messaging is a very hard problem.” So, they argue - new communication standards must be end-to-end encrypted - that open end-to-end encrypted standards cannot be developed If both are true any new communication standards must be proprietary. I don’t think that’s a conclusion shared by society.

LorenDB 2y ago
Open, decentralized, and federated E2EE is clearly possible. Matrix is a perfect example of this.
- voxic11 2y ago
  Was it developed by an industry consortium though? It seems like it was created by a single company.
voxic11 2y ago
They argue that open end-to-end encrypted standards cannot be developed by industry consortiums which seems to be true.
- jvolkman 2y ago
  That is the recently-ratified RFC9420, or Messaging Layer Security [1]. Matrix is supportive [2], Google is supportive [3], and Google Messages is actively gaining support [4]. 1: https://datatracker.ietf.org/doc/rfc9420/ https://datatracker.ietf.org/doc/rfc9420/ 2: https://matrix.org/blog/2023/07/a-giant-leap-with-mls https://matrix.org/blog/2023/07/a-giant-leap-with-mls 3: https://security.googleblog.com/2023/07/an-important-step-towards-secure-and.html https://security.googleblog.com/2023/07/an-important-step-to... 4: https://www.androidauthority.com/google-mls-e2ee-messages-3457483/ https://www.androidauthority.com/google-mls-e2ee-messages-34...
dialup_sounds 2y ago
He did not say that open E2EE could not be developed. Of course it could, someday, maybe. Meanwhile the proprietary networks that literally billions of people already use have had E2E for 10+ years.

bearjaws 2y ago

If anything RCS has shown people will use the encryption buzz word like it's some silver bullet of security. Unless you are the only holder of the key, encryption is typically useless in a hack. Go ask every healthcare breach and they will tell you the data was encrypted... If RCS was encrypted there is a 99% chance att would have the keys easily accessible.

aesh2Xa1 2y ago

Hm, the breach contained metadata, but not message contents. RCS does not attempt to defend against metadata surveillance. Is the author's point, simplified, "any centralized collection of communications data, unencrypted, is vulnerable?" They mention E2EE, but even some of those still present centralized, unencrypted metadata.

FireBeyond 2y ago
Maybe. But really, to me, the author's real point is "Why are you people forcing Apple to support RCS? Leave them alone" and he'll draw longer and longer bows to justify it. Gruber has had several moments where he's stridently defended Apple and denied issues only for it later to be revealed that there absolutely was an issue. The last straw for me was the LassPass App Store issue a few months ago (where a scam app was approved and took the top spot in the store, over the official app). Gruber, on this: > > Instead, the scam LassPass app tries to steer you to creating a “pro” account subscription for $2/month, $10/year, or a $50 lifetime purchase. Those are actually low prices for a scam app — a lot of scammy apps try to charge like $10/week. Emphasis mine, but are you kidding me? He actually tries to downplay the issue by saying "Well, at least you wouldn't be scammed out of that much money". And then doubles down, by claiming, with absolutely no knowledge whatsoever: > It doesn't look like the app was intended to steal credentials. Why do you think that is plausible reasoning? To me, the credentials are what you're intending to steal with the scam app. You might make some money from the IAPs, but that's a cherry on the top (and likely the actual reason why the amounts were low, so it didn't raise more red flags). I've seen yoga practitioners who can't contort themselves as much as Gruber can when trying to defend/promote Apple and their interests.
- isleyaardvark 2y ago
  > He actually tries to downplay the issue by saying "Well, at least you wouldn't be scammed out of that much money". That’s a ridiculously uncharitable take on a simple statement of fact that you yourself even seem to accept later in your comment.
  - 2y ago

retrocryptid 2y ago

i'm a fan of E2EE, but the AT&T hack did not involve intercepting RCS messages. It's sort of like saying "Chewbacca is a Wookie, therefore you shouldn't use RCS."

HeatrayEnjoyer 2y ago
I don't see the section that says it involved accessing RCS messages.
- FireBeyond 2y ago
  See my other comment. Gruber doesn't say it involved accessing RCS, but he does write nearly 2,000 words strongly implying and reinforcing that "Apple knows best" and that if they say they shouldn't have to support RCS, you should trust them.

kevincox 2y ago

I really don't understand why people want to tie their messaging to their mobile service provider. This seems best as two jobs for two companies. Then I can switch either at will. 1. Mobile internet access. 2. Messaging.

dpkirchner 2y ago
I think it comes down to the fact that every mobile phone supports at least SMS if not RCS out of the box -- no new apps, no signing up for new services, etc.
- JohnFen 2y ago
  This. The thing I (in the US) really like about SMS is that everybody can do it. With apps, I'd have to have a number of different ones and remember who is using which one. It seems like a huge pain in the butt to me.
lern_too_spel 2y ago
For the same reason they tie their phone calling to their mobile service provider. I don't like tying communications to phone numbers either because that means you need phone service to communicate, but that ship has sailed, and there are many people who barely use email at all.

eqvinox 2y ago

Use Signal, problem solved? headscratch

r0ks0n 2y ago

https://news.ycombinator.com/from?site=daringfireball.net https://news.ycombinator.com/from?site=daringfireball.net ctrl+f apple