4 ms·

No. Reacting to any unwanted contact just moves you further into their funnel. Ideally don’t even open the text.

by chatmasta 2y ago

epcoa 2y ago
How does one “open a text”?
- chatmasta 2y ago
  Depends on the platform, but generally speaking it requires taking whatever action changes its status from "unread" to "read." But even then, there has been at least one case of iOS malware that infected the system upon delivery of a text (since BlastDoor parsed the payload upon receipt, IIRC). That's one reason why Lockdown Mode rejects any text from unknown numbers.
- mikesabat 2y ago
  Text messages don't have an "open" action. Replying STOP will unsubscribe the recipient from future SMS from this number. I have never seen an organization use an unsubscribe as a positive action in their funnel. There are less expensive and less risky ways to confirm that a phone number is valid for sure.
  - 1_1xdev1 2y ago
    Not really true, if you have an iPhone, at least. URL previews are loaded on message open. A network request to the url they sent you. They know when you opened it Unless the behavior has changed (maybe it has)?
    - eddyg 2y ago
      Previews are generated by the sender. The only network requests for the receiver are to Apple. Quoting from a January 2021 Project Zero blog post⁽¹⁾ on BlastDoor: As an example, consider what happens when a user sends a link to a website over iMessage. In that case, the sending device will first render a preview of the webpage and collect some metadata about it (such as the title and page description), then pack those fields into an NSKeyedArchiver archive. This archive is then encrypted with a temporary key and uploaded to the iCloud servers. Finally, the link as well as the decryption key are sent to the receiver as part of the iMessage. In order to create a useful user notification about the incoming iMessage, this data has to be processed by the receiver on a 0-click code path. As that again involves a fair amount of complexity, it is also done inside BlastDoor: after receiving the BlastDoor reply from above and realizing that the message contains an attachment, imagent first instructs IMTransferAgent to download and decrypt the iCloud attachment. ⁽¹⁾ https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
      - 71bw 2y ago
        Keyword: over iMessage. What about normal SMS messages?
        kube-system 2y ago
        Just tried it. It doesn't render a preview.
  - Thorrez 2y ago
    I reply STOP (or whatever the capitalization is that the text asks for) to every political spam text I get that says "STOP to unsubscribe" or some such. I've been doing this for years. I got 7 political spam texts today. I don't think the STOP is working.
- deleted 2y ago
  [deleted]
- 1_1xdev1 2y ago
  How does one “open an email” Same thing Your messaging client may helpfully request the url they sent you to show a url preview. In an email, your client renders the html including img tags (yes, this can be disabled, and may not even be default for most people anymore; it’s still a thing)
AStonesThrow 2y ago
It used to be, on some mail readers, that "opening" an email message could unleash Pandora's Box, in terms of interpreting HTML, downloading images, attachments or whatever. I sincerely doubt that is even the case for the major providers such as Outlook or Gmail. And yeah, per comments downthread, my Android Messages app has "read/unread" and that's really the only thing that "opening a text" changes. There's no additional execution or activation like opening or executing a file.
- happymellon 2y ago
  Does RCS remove the read receipt? Back in the day, some systems used to acknowledge the request for a read receipt by default giving them the ability to determine if a number was actively watched. Hopefully everything has it disabled by default these days.
  - jeroenhd 2y ago
    It's a setting on Android. I don't know about iOS. Same for SMS read receipts.
    - happymellon 2y ago
      Yeah I checked after writing that. They are now all disabled by default, for both Android and iOS.
- autoexec 2y ago
  > It used to be, on some mail readers, that "opening" an email message could unleash Pandora's Box, in terms of interpreting HTML, downloading images, attachments or whatever. That's still true for both email and text messages. Just opening text messages can infect your phone too. In one case, iphone users didn't even have to open the message (https://www.bleepingcomputer.com/news/security/apple-zero-click-imessage-exploit-used-to-infect-iphones-with-spyware/ https://www.bleepingcomputer.com/news/security/apple-zero-cl...). There have been similar problems with outlook allowing unread email to infect a device (https://www.csoonline.com/article/3486789/microsoft-outlook-security-hole-lets-attackers-in-without-opening-a-tainted-message.html https://www.csoonline.com/article/3486789/microsoft-outlook-...) It doesn't matter what the platform is, spam is toxic and should be handled carefully and as little as possible.
autoexec 2y ago
I agree. It's also worth noting that people have had their devices compromised just by opening a text message (for that matter iphones have been hacked just by receiving an invisible text) so it's probably best to delete any spam text unread.

No. Reacting to any unwanted contact just moves you further into their funnel. Ideally don’t even open the text.

epcoa 2y ago

How does one “open a text”?

chatmasta 2y ago
Depends on the platform, but generally speaking it requires taking whatever action changes its status from "unread" to "read." But even then, there has been at least one case of iOS malware that infected the system upon delivery of a text (since BlastDoor parsed the payload upon receipt, IIRC). That's one reason why Lockdown Mode rejects any text from unknown numbers.
mikesabat 2y ago
Text messages don't have an "open" action. Replying STOP will unsubscribe the recipient from future SMS from this number. I have never seen an organization use an unsubscribe as a positive action in their funnel. There are less expensive and less risky ways to confirm that a phone number is valid for sure.
- 1_1xdev1 2y ago
  Not really true, if you have an iPhone, at least. URL previews are loaded on message open. A network request to the url they sent you. They know when you opened it Unless the behavior has changed (maybe it has)?
  - eddyg 2y ago
    Previews are generated by the sender. The only network requests for the receiver are to Apple. Quoting from a January 2021 Project Zero blog post⁽¹⁾ on BlastDoor: As an example, consider what happens when a user sends a link to a website over iMessage. In that case, the sending device will first render a preview of the webpage and collect some metadata about it (such as the title and page description), then pack those fields into an NSKeyedArchiver archive. This archive is then encrypted with a temporary key and uploaded to the iCloud servers. Finally, the link as well as the decryption key are sent to the receiver as part of the iMessage. In order to create a useful user notification about the incoming iMessage, this data has to be processed by the receiver on a 0-click code path. As that again involves a fair amount of complexity, it is also done inside BlastDoor: after receiving the BlastDoor reply from above and realizing that the message contains an attachment, imagent first instructs IMTransferAgent to download and decrypt the iCloud attachment. ⁽¹⁾ https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
    - 71bw 2y ago
      Keyword: over iMessage. What about normal SMS messages?
      - kube-system 2y ago
        Just tried it. It doesn't render a preview.
- Thorrez 2y ago
  I reply STOP (or whatever the capitalization is that the text asks for) to every political spam text I get that says "STOP to unsubscribe" or some such. I've been doing this for years. I got 7 political spam texts today. I don't think the STOP is working.
deleted 2y ago
[deleted]
1_1xdev1 2y ago
How does one “open an email” Same thing Your messaging client may helpfully request the url they sent you to show a url preview. In an email, your client renders the html including img tags (yes, this can be disabled, and may not even be default for most people anymore; it’s still a thing)

AStonesThrow 2y ago

It used to be, on some mail readers, that "opening" an email message could unleash Pandora's Box, in terms of interpreting HTML, downloading images, attachments or whatever. I sincerely doubt that is even the case for the major providers such as Outlook or Gmail. And yeah, per comments downthread, my Android Messages app has "read/unread" and that's really the only thing that "opening a text" changes. There's no additional execution or activation like opening or executing a file.

happymellon 2y ago
Does RCS remove the read receipt? Back in the day, some systems used to acknowledge the request for a read receipt by default giving them the ability to determine if a number was actively watched. Hopefully everything has it disabled by default these days.
- jeroenhd 2y ago
  It's a setting on Android. I don't know about iOS. Same for SMS read receipts.
  - happymellon 2y ago
    Yeah I checked after writing that. They are now all disabled by default, for both Android and iOS.
autoexec 2y ago
> It used to be, on some mail readers, that "opening" an email message could unleash Pandora's Box, in terms of interpreting HTML, downloading images, attachments or whatever. That's still true for both email and text messages. Just opening text messages can infect your phone too. In one case, iphone users didn't even have to open the message (https://www.bleepingcomputer.com/news/security/apple-zero-click-imessage-exploit-used-to-infect-iphones-with-spyware/ https://www.bleepingcomputer.com/news/security/apple-zero-cl...). There have been similar problems with outlook allowing unread email to infect a device (https://www.csoonline.com/article/3486789/microsoft-outlook-security-hole-lets-attackers-in-without-opening-a-tainted-message.html https://www.csoonline.com/article/3486789/microsoft-outlook-...) It doesn't matter what the platform is, spam is toxic and should be handled carefully and as little as possible.

autoexec 2y ago

I agree. It's also worth noting that people have had their devices compromised just by opening a text message (for that matter iphones have been hacked just by receiving an invisible text) so it's probably best to delete any spam text unread.