6 ms·

So you scripted sending the message to 84 different numbers, was that from your own personal iMessage account? I would be terrified of doing something like tha

So you scripted sending the message to 84 different numbers, was that from your own personal iMessage account? I would be terrified of doing something like that, I imagine the account could get flagged for spam, and hearing the various tech horror stories, I wouldn’t be surprised if it could end up suspending your iCloud account with everything on it, blacklisting hardware devices linked to it, and who knows what else.

72736379 2y ago
I'm not the author but my guess is that the API returns whether the number is registered with iMessage or not- like if you type in a number in a new text message it shows whether the message you're sending will be an iMessage or a text message. Don't think the author was spamming random numbers.
- radeeyate 2y ago
  The author said that they scripted sending the messages to those numbers on their Mac rather than using something like Twilio.
  - deleted 2y ago
    [deleted]
  - schrodinger 2y ago
    That’s after screening to see if the number was linked to iMessage —- ie a valid iPhone attached to the number. That’s what that lookup service did. Then they scripted messaging the numbers that worked.
    - hk__2 2y ago
      Yes, and after screening they had 84 recipients to contact.
RockRobotRock 2y ago
Yeah, I definitely should’ve thought it through more. I was just a little too caffeinated and excited.
thorum 2y ago
Is 84 so high? I imagine there are people sending party invites and “lost my phone, new number” messages to more than that.
- ilt 2y ago
  I think more than sending 84 messages, getting reported on handful of them can be more concerning. While you’ll rarely get reported for a party invite.
  - radicality 2y ago
    Yeah, exactly. I’m not sure what happens after I click “Delete and Report Junk” on every spammy-looking sms and iMessage I get, but I imagine the iMessage reports go into some ML blackbox and hopefully contribute to banning the spammer. I understand the op was trying to do a good deed, but if I saw an unexpected message like that I would definitely hit “Delete and Report Junk” instead of just “Delete”.
    - seb1204 2y ago
      Why would you consider the text spammy? No links or requests were included. So just delete seems fine to me.
      - radicality 2y ago
        Maybe I’m just jaded/untrusting, but the message reminded me of the initial opening text from various wrongnumber/pig-butchering scams. https://maxread.substack.com/p/whats-the-deal-with-all-those-weird https://maxread.substack.com/p/whats-the-deal-with-all-those... Discussion of above - https://news.ycombinator.com/item?id=31949731 https://news.ycombinator.com/item?id=31949731
- throwaway984393 2y ago
  [dead]
toast0 2y ago
It's been a long while, but I scripted iMessage a bit, and Apple has a pretty casual slide into unworking. They don't just block your account in one fell swoop, first indicators and messaging will stop working for a few hours. And you can hit that at least a few times without a ban. After a few times of that it was clear it wouldn't be worth running what I had, so I stopped before any sort of permanent banning.
lxgr 2y ago
This once happened to somebody I know! Their Apple ID somehow got banned from specifically, and only, iMessage and FaceTime; all other services like iCloud and the app store were working as usual. No idea why it happened, but Apple support was able to reset it on a phone call. My theory is that they'd kept a non-active SIM in their phone for a long time, and the phone had tried to repeatedly verify/link that phone number to their Apple ID (via challenge SMS, I believe), thereby exceeding some rate limit. Gotta love that such rate limits exist and do occasionally hit legitimate users, but at the same time, there are paid lookup-as-a-service APIs out there as mentioned in TFA...
- golergka 2y ago
  > specifically, and only, iMessage and FaceTime; all other services like iCloud and the app store were working as usual Google should take note.
  - tredre3 2y ago
    > Apple support was able to reset it on a phone call. That too.
    - whstl 2y ago
      Apple's phone support is insane, at least where I used it. High audio quality, no rush and no signs of them being an underpaid call center operator, always going the extra mile to help me.
      - b112 2y ago
        Well you're paying for it, the app store fees alone make it worth while for Apple. I do wonder, with the changes slowly trickling down the pipe, will Apple's fees over then next few years slowly diminish? And if so, what of their support quality (which is financed via funds from app store fees)?
        whstl 2y ago
MatthiasPortzel 2y ago
iMessage has an AppleScript API that makes it easy. I ran a game in school with something like 50 teams and I had a script to generate different objectives for each team and send them out by text automatically.
sneak 2y ago
So much for end to end encryption that is unreadable by Apple.
- throwaway290 2y ago
  In other apps like whatsapp reporting a message usually sends contents/history to mods explicitly. No need to break e2ee for that
- radicality 2y ago
  I do believe apple’s e2e encryption promises on iMessage content, and don’t think it should interfere with their ability to control for spam / bad actors. But I also expect them to know the sender/receiver, and I imagine if I click “Delete and Report Junk” button, that I would probably submit the unencrypted contents of that whole conversation to Apple. And they should have also have metrics of total sends vs reported sends.
  - sneak 2y ago
    The vast majority of iMessages (99%+), including normal/unreported ones, are readable by Apple because either the iMessages themselves or the iMessage cross-device sync keys are escrowed to Apple in the non-e2ee iCloud Backup. In the latter case the messages are readable in realtime. This is documented (not the 99% figure, but the situation) by Apple in knowledge base articles on the apple.com website. The e2ee in iMessage is effectively irrelevant, as for most people, most of the time, it functions just like Telegram (which is not e2ee).
    - radicality 2y ago
      Fair enough, though this is probably useful people for most non tech people, who might forget their passwords / lose keys, and don’t want to lose all access and data. Personally, a few months ago I enabled Advanced Data Protection (ADP) which afaik does make iCloud backups (including messages), Photos, iCloud Drive and few other things inaccessible to Apple. - https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 - https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web https://support.apple.com/guide/security/advanced-data-prote... Whether you trust that Apple actually did throw away their keys after enabling the feature is a different story, but it’s good enough for me. When enabling ADP there’s multiple warnings about how you’ll end up completely locked out if you lose all your devices / lose recovery keys / lose all hardware authenticators. Iirc I was also forced to register at least 2 yubikeys. For anyone tech savvy you should enable ADP.

72736379 2y ago

I'm not the author but my guess is that the API returns whether the number is registered with iMessage or not- like if you type in a number in a new text message it shows whether the message you're sending will be an iMessage or a text message. Don't think the author was spamming random numbers.

radeeyate 2y ago
The author said that they scripted sending the messages to those numbers on their Mac rather than using something like Twilio.
- deleted 2y ago
  [deleted]
- schrodinger 2y ago
  That’s after screening to see if the number was linked to iMessage —- ie a valid iPhone attached to the number. That’s what that lookup service did. Then they scripted messaging the numbers that worked.
  - hk__2 2y ago
    Yes, and after screening they had 84 recipients to contact.

RockRobotRock 2y ago

Yeah, I definitely should’ve thought it through more. I was just a little too caffeinated and excited.

thorum 2y ago

Is 84 so high? I imagine there are people sending party invites and “lost my phone, new number” messages to more than that.

ilt 2y ago
I think more than sending 84 messages, getting reported on handful of them can be more concerning. While you’ll rarely get reported for a party invite.
- radicality 2y ago
  Yeah, exactly. I’m not sure what happens after I click “Delete and Report Junk” on every spammy-looking sms and iMessage I get, but I imagine the iMessage reports go into some ML blackbox and hopefully contribute to banning the spammer. I understand the op was trying to do a good deed, but if I saw an unexpected message like that I would definitely hit “Delete and Report Junk” instead of just “Delete”.
  - seb1204 2y ago
    Why would you consider the text spammy? No links or requests were included. So just delete seems fine to me.
    - radicality 2y ago
      Maybe I’m just jaded/untrusting, but the message reminded me of the initial opening text from various wrongnumber/pig-butchering scams. https://maxread.substack.com/p/whats-the-deal-with-all-those-weird https://maxread.substack.com/p/whats-the-deal-with-all-those... Discussion of above - https://news.ycombinator.com/item?id=31949731 https://news.ycombinator.com/item?id=31949731
throwaway984393 2y ago
[dead]

toast0 2y ago

It's been a long while, but I scripted iMessage a bit, and Apple has a pretty casual slide into unworking. They don't just block your account in one fell swoop, first indicators and messaging will stop working for a few hours. And you can hit that at least a few times without a ban. After a few times of that it was clear it wouldn't be worth running what I had, so I stopped before any sort of permanent banning.

lxgr 2y ago

This once happened to somebody I know! Their Apple ID somehow got banned from specifically, and only, iMessage and FaceTime; all other services like iCloud and the app store were working as usual. No idea why it happened, but Apple support was able to reset it on a phone call. My theory is that they'd kept a non-active SIM in their phone for a long time, and the phone had tried to repeatedly verify/link that phone number to their Apple ID (via challenge SMS, I believe), thereby exceeding some rate limit. Gotta love that such rate limits exist and do occasionally hit legitimate users, but at the same time, there are paid lookup-as-a-service APIs out there as mentioned in TFA...

golergka 2y ago
> specifically, and only, iMessage and FaceTime; all other services like iCloud and the app store were working as usual Google should take note.
- tredre3 2y ago
  > Apple support was able to reset it on a phone call. That too.
  - whstl 2y ago
    Apple's phone support is insane, at least where I used it. High audio quality, no rush and no signs of them being an underpaid call center operator, always going the extra mile to help me.
    - b112 2y ago
      Well you're paying for it, the app store fees alone make it worth while for Apple. I do wonder, with the changes slowly trickling down the pipe, will Apple's fees over then next few years slowly diminish? And if so, what of their support quality (which is financed via funds from app store fees)?
      - whstl 2y ago

MatthiasPortzel 2y ago

iMessage has an AppleScript API that makes it easy. I ran a game in school with something like 50 teams and I had a script to generate different objectives for each team and send them out by text automatically.

sneak 2y ago

So much for end to end encryption that is unreadable by Apple.

throwaway290 2y ago
In other apps like whatsapp reporting a message usually sends contents/history to mods explicitly. No need to break e2ee for that
radicality 2y ago
I do believe apple’s e2e encryption promises on iMessage content, and don’t think it should interfere with their ability to control for spam / bad actors. But I also expect them to know the sender/receiver, and I imagine if I click “Delete and Report Junk” button, that I would probably submit the unencrypted contents of that whole conversation to Apple. And they should have also have metrics of total sends vs reported sends.
- sneak 2y ago
  The vast majority of iMessages (99%+), including normal/unreported ones, are readable by Apple because either the iMessages themselves or the iMessage cross-device sync keys are escrowed to Apple in the non-e2ee iCloud Backup. In the latter case the messages are readable in realtime. This is documented (not the 99% figure, but the situation) by Apple in knowledge base articles on the apple.com website. The e2ee in iMessage is effectively irrelevant, as for most people, most of the time, it functions just like Telegram (which is not e2ee).
  - radicality 2y ago
    Fair enough, though this is probably useful people for most non tech people, who might forget their passwords / lose keys, and don’t want to lose all access and data. Personally, a few months ago I enabled Advanced Data Protection (ADP) which afaik does make iCloud backups (including messages), Photos, iCloud Drive and few other things inaccessible to Apple. - https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 - https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web https://support.apple.com/guide/security/advanced-data-prote... Whether you trust that Apple actually did throw away their keys after enabling the feature is a different story, but it’s good enough for me. When enabling ADP there’s multiple warnings about how you’ll end up completely locked out if you lose all your devices / lose recovery keys / lose all hardware authenticators. Iirc I was also forced to register at least 2 yubikeys. For anyone tech savvy you should enable ADP.