18 ms·

I guess I’ll take the contra here on messages integration — moving a message over BLE to untrusted hardware and worse accepting them back into iMessage is a mas

I guess I’ll take the contra here on messages integration — moving a message over BLE to untrusted hardware and worse accepting them back into iMessage is a massive, massive change in the security boundary and therefore security architecture and therefore security promises that apple makes on iMessage. I do not believe average smartwatch users understand what they’d be doing if they got this. I do not believe vendors integrating with such a thing can do it safely, or even that all vendors integrating are good actors. One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed, and makes automation difficult. It used to be impossible nearly, and in that era we had almost no iMessage spam. Now it’s difficult, and we have moderate iMessage spam. But adding hooks to make this automation easy, and worse, leave the trust environment as a feature is just wrong.

Hammershaft 2y ago
I don't see how spam would be a problem. Couldn't messages created externally to imessage be tagged as such and then just rate limited?
Jyaif 2y ago
That's not the "contra", you've just fallen for Apple's PR.
mistercheph 2y ago
So sick of this strawman dialectic from the apple-brained, where the alternative to the walled garden is the worst possible implementation of an open standard.
- culi 2y ago
  Firefox is also frequently criticized for not implementing certain APIs because of security concerns. There was a post on this site just the other day about their lack of support for WebUSB for exactly this reason It's not unique to Apple. And we should take security seriously. To people who are technically literate and think they can navigate security risks it's not a big deal but people's entire lives are frequently turned upside down by scams and security loopholes
  - celsoazevedo 2y ago
    The main difference is that with Firefox no one can use the API. Apple seems to be happy to implement APIs... but only their own products can use them.
    - frollogaston 2y ago
      Like with headphones. Only AirPods and Beats (owned by Apple) headphones can use their proprietary extensions on top of Bluetooth for improved pairing or better headset-mode quality. Then they removed the jack to wipe out the rest.
      - culi 2y ago
        So then why did almost all other major smartphone brands follow Apple's lead in removing the headphone jack?
        frollogaston 2y ago
        To sell their equivalents of AirPods. Apple brings in $18B yearly revenue from that and locks in users more, big win for them.
- minkzilla 2y ago
  It doesn't have to be the worst possible implementation to be less desirable than the walled garden for me. I get so much spam in whatsapp, groupMe, telegram, and from sms. Some of it is even from legitimate contacts but then they signed up for something or did something and it sends one of those stupid "join me on {thing}" messages. The only place I don't get spam is imessage
  - mistercheph 2y ago
    I get spam on iMessage, and you can continue to live in the walled garden, nobody wants to force you to buy a third party watch, they just want third party devices to have the same API access as the first party device.
    - minkzilla 2y ago
      The walled garden is not a walled garden if everyone else has doors in.
- sockaddr 2y ago
  It's not a straw man argument, it is the argument. An average user can't dive into the bluetooth driver code and figure out where in the 4000 page spec something deviates and is now a security issue. So we have to assume the worst.
  - mistercheph 2y ago
    Having an open standard doesn't mean every implementer will do so in good faith and using best practices, the consumer still ultimately has to make a choice about which product they use, and can continue to use apple's solution if they trust in apple to securely implement the spec. The insane strawman you're proposing is that the choice is between a single blessed solution from Apple that's infallible, and a wild west where the only way for a consumer to be safe is to personally audit their device against a 4000 page specification document. Absurd! We use devices and software every day that implement open standards and while issues do arise in particular implementations, they do with no more frequency than issues are discovered in proprietary solutions and standards. Go look at the CVE's for iMessage, plurality of RCE's on apple devices in the last decade is Apple's iMessage implementation, and it's their own protocol! And almost all of the rest are apple's implementation of the open web standards!
    - vessenes 2y ago
      There are maybe three tech companies in the US that have large security groups dealing with persistent threat actors. Apple is one of them. Google is another. Even with that (large) Apple security group, iMessage is difficult to lock down properly, as you note. However, I think that the cost of 0 day subscriptions for iOS vs Android tell a pretty good story: iOS zero day subscriptions sold to intelligence agencies/governments cost roughly $1mm / seat (phone compromised). Android -- $10k. There are many many decisions along the way that end up with that raw 100x additional cost for iOS security breaches -- value Apple delivers to its customers when they purchase iOS products. You cannot pick and choose from the outside and know which of your preferred opening-up implementations would impact that cost. My argument is that opening this up is one of likely hundreds of possible decisions that would contribute to lowering that cost of exploit.
tadfisher 2y ago
Opening up a BLE API for iMessages is not going to impact iMessage spam whatsoever. It will impact Apple Watch sales though.
- agloe_dreams 2y ago
  Hey, there we are. That's exactly it. You've always been able to use Applescript to send iMessages on a Mac.
Nextgrid 2y ago
> moving a message over BLE to untrusted hardware and worse accepting them back into iMessage is a massive, massive change in the security boundary Anyone can already screenshot iMessages and move them out of the "security boundary"... which btw doesn't exist much, as if you have any Mac connected to your iCloud account then those messages are being synced to an SQLite DB any process running under your user can access.
- culi 2y ago
  In what world is screenshotting an iMessage enough to move them out of the security boundary
  - cmurf 2y ago
    World in which I've paired my two devices? Doesn't the boundary get broken asking messages be read to me into a BT audio device?
- droopyEyelids 2y ago
  Did you mean to reply to a different comment?
- seanhunter 2y ago
  I don’t think you understand what the security boundary of iMessage is. People’s phones got compromised by NSO sending images to them via whatsapp that used an exploit in one of the image libraries to run a malware payload. The security boundary isn’t about whether you can see your own messages, it’s whether bad people can root your phone by getting untrusted code to run. That’s a very different proposition if iMessage is a single codebase that they fully own end to end versus it has a plugin ecosystem. Having such a plugin system widens the security boundary by adding a much larger codebase that would require trust.
  - Nextgrid 2y ago
    It doesn't need to be a plugin ecosystem - no third party code needs to run within the iMessage processes/sandboxes/containers. In fact, no third-party code needs to run at all on the phone - all that's needed is to expose an API over BLE that allows previously authorized external devices to query/send messages.
sunshowers 2y ago
The problem is that this argument happens to conveniently align with Apple's financial interests.
- ch4s3 2y ago
  If your value prop to customers is seamless and secure default behavior, then of course blocking insecure peripherals aligns with your financial interests. This doesn't seem nefarious at all to me.
  - wobfan 2y ago
    This is (I guess) not what OP meant. Apple obviously also gains financially from blokcing everything outside of there ecosystem, mainly because the majority of Apple users will only buy Apple hardware. Obviously, yeah, keeping the hardware a bit more safe also helps, but the main financial gain is definitely not coming from this.
    - ch4s3 2y ago
      Note that I said seamless AND secure. Having preferential treatment for a limited set of well known hardware makes the experience seamless. I like the secure and easy hand-off between apple devices. I wouldn't want to give up the security to make it work.
      - lern_too_spel 2y ago
        > I wouldn't want to give up the security to make it work Android shows that you don't have to.
  - sunshowers 2y ago
    Why doesn't Apple openly market that it's doing stuff in its financial interest? Is it too embarrassed to point that out?
    - ch4s3 2y ago
the_mitsuhiko 2y ago
> moving a message over BLE to untrusted hardware and worse accepting them back into iMessage is a massive, massive change in the security boundary Is it? My iPhone replicates messages to my mac from where a process can extract that data, it can capture the screen etc. I can use a mac today to set up a relay that would then send those messages to a smart watch if one would do that.
- browningstreet 2y ago
  Same with Phone Link on Windows.
- judofyr 2y ago
  Yes? Imagine a bug where iMessages are leaked over Bluetooth when a user has installed an application that integrates with some watch brand. Bring this to an airport and you can steal hundreds/thousands of messages from a wide range of people. That’s widely different attack vector than targeting macOS. That said, I don’t see why Apple can’t provide toolkit/certification that will make it safe to communicate over Bluetooth. They already have it in-place for Apple Watch.
  - lern_too_spel 2y ago
    Bluetooth is encrypted.
    - Avamander 2y ago
      Should be, but BT stacks are super crap and it's hard to truly guarantee that. Pretty sure they do not currently require the highest (actually proper) security level from everyone.
      - mystified5016 2y ago
        [flagged]
        2y ago
maximusdrex 2y ago
I truly don’t understand how these types of comments keep appearing under any discussion of apple’s blatantly anti-competitive behavior with messages. This doesn’t even make sense on technical grounds; it would be trivial to require such message passing to be encrypted/signed securely if that’s your real concern. After all, the Apple Watch does exist and does have these capabilities, so it’s clearly possible to do it and maintain the “security boundaries” you’re so concerned with. Then every single one of these comments inevitably turn towards spam messages which no longer even makes sense since iMessage has been filled with spam lately. I really don’t see how allowing smartwatch manufacturers to also interface with iMessage (in the same way Apple Watches do) will inevitably increase spam on the platform which can’t be detected/mitigated in other ways. I’d love to see some technically rigorous explanation for why apple can’t support any third-party anything instead of hand wringing about “security” with no real explanation but I have a feeling I’ll be waiting a long time.
- FirmwareBurner 2y ago
  [flagged]
- snailmailman 2y ago
  It’s not just the transmission over Bluetooth. It’s the entirety of what happens with the message. Apple fully controls and trusts the code that’s running on the apple watch. But they have no control over what third parties do with all the data they can collect in notifications. Bluetooth devices on iOS that display notifications already are getting more information than normal by simply even reading all notifications. Normal apps on iOS can’t do that, they have no reason to. This api was added because smart watches kinda need that functionality to be useful. I think it’s still locked behind a “this device will see all your stuff” permissions box. I do think they should add in more iMessage/sms/replying capabilities to smart watches though. I think they are extremely hesitant to make it even easier to automate iMessages. iMessage spam is definitely increasing, but it’s NOT as prevalent as normal sms spam for instance. The barriers are much higher, and Apple can basically blacklist devices/appleIDs that send out too much spam, partly because they’ve kept iMessage so locked down.
dns_snek 2y ago
> One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed, and makes automation difficult Really? I'm not in the Apple ecosystem to confirm but it looks trivial to me, and you can always fall back to keyboard/mouse input type of automation. https://airmessage.org/ https://airmessage.org/ https://bluebubbles.app/ https://bluebubbles.app/ https://medium.com/@jameskabbes/sending-imessages-with-python-on-a-mac-b77b7dd6e371 https://medium.com/@jameskabbes/sending-imessages-with-pytho...
- jmb99 2y ago
  Some anecdata. I get a few dozen spam SMSs in any given month, as well as some spam phone calls (varies a lot by month - sometimes only 1-2, sometimes 20+). I have received a total of 2 spam iMessages (I remember them because they’re notable to exist), and 0 spam FaceTime audio calls, and I’ve had this phone number associated with iMessage since it was first released. Regardless of the reason, there is substantially (many orders of magnitude) less spam on Apple’s networks, at least for me, when compared to SMS/RCS/telephony.
  - dns_snek 2y ago
    I'm not debating the amount of spam but rather GP's claim that iMessage is hard to automate. I showed that iMessage is trivial to automate and since you both claim that the amount of spam on the platform is very low, we can conclude that ease of automation isn't an important factor when it comes to iMessage spam. Unless someone decides to move the goalposts we should therefore be in full agreement that Pebble being allowed to integrate with iMessage wouldn't have any appreciable effect on the amount of spam in the network.
    - vessenes 2y ago
      It is definitely harder to automate than SMS. Very large companies exist only to provide API-backed support for automated SMS. In contrast you need to hook into Apple APIs / scripting / sqlite databases on trusted apple hardware in order to automate iMessage. You imagine "Pebble" as one company and say "how hard can it be to turn this on?" As I said in the original comment, it's not that it's hard, it's that it can only be turned on for everyone and that will create a security issue that WILL have a substantial impact on the ecosystem. I didn't say, but believe it to be true that the alternative -- a vendor security assessment program covering software, hardware, architecture and cloud security is not worth Apple's time or money to do. I don't think they have any business reason to do so.
dwighttk 2y ago
Apple is fine with any customer retention benefits from security and I don’t agree (with the article author) that they are merely pretending their strategy is primarily focused on security
chamanbuga 2y ago
This is cap. I worked on heads up glasses, and one of our issues was the lack of integration with Apple's iMessage ecosystem. Device makers are willing to go through several security measures, like deploying the MFi chips and certification. However, at best this gives you access to the notification system, not iMessage itself. You are able to respond to messages via the notification framework, but not integrate directly with iMessage even after taking all security and certification efforts. This isn't a security play. This is a walled garden play.
- mceachen 2y ago
  s/cap/crap/?
  - eddythompson80 2y ago
    Or they mean cap as 'lie' in genz speak. 'No cap' = 'No lie'. in a sentence "I saw an alligator today. No cap"
    - mceachen 2y ago
      Thanks for translating. I’ve never heard cap used in the affirmative.
      - daedrdev 2y ago
        It’s often used to call people out. That’s cap = that’s bullshit
    - rapind 2y ago
      No cap, I did see an alligator two days ago on the golf course. There were a lot of abandoned balls around her (water trap).
    - rambambram 2y ago
      Gen Z speak? I thought it was 'hood speak' or something. Like: I'm going to cap your sorry ass. I'm not a native English speaker, so what do I know.
stemlord 2y ago
And I'll be the contra to your take: the iMessage ecosystem is so closed that everyone without iphones can barely even interact via sms with iphone users. This is overall such a huge problem that it makes the closed ecosystem security solution not a practical solution
- op00to 2y ago
  I’ve never had an issue texting via SMS since iMessage was available. Now, I can do RCA as well. What issues should I have encountered?
- vessenes 2y ago
  Nope, SMS works. Just fine. Apple rightly warns you that you are in a lower security environment by adding a bit of visual friction. This is true EVEN IF you are using RCS, because European laws require termination and inspection when RCS messages “interoperate” and are sent to other providers.
  - DirkH 2y ago
    This is something I agree with. The world would be more secure if we made SMS obsolete and Apple making a push away from it is arguably net positive.
nashashmi 2y ago
my Chinese smartwatch can get imessages. It can't send messages, but it can use the AI voice (SIRI) to send messages. It can't delete messages either. PebbleOS is asking for the ability to respond to messages with reply or user interactions. This is not a security breach. And it won't leak from encryption anymore than it is leaking now.
stefan_ 2y ago
I think you just don't understand the point. I don't care for choosing between 15 different brands making differently colored RAM either when it's all the same standardized thing, but you bet we're in a lot of trouble when it's only one brand at all. Competition isn't always "technically pure" and "elegant" or meaningful.
amiga386 2y ago
Step 1: Have the iPhone pop up saying "do you want <Pebble watch> to be able to send messages?" and let the user decide which devices can send their phone messages. Step 2: Have the iPhone pop up saying "do you want <Apple watch> to be able to send messages?" and don't just assume "yes" Both steps would improve security, even if they harm Apple's profits.
- spiderice 2y ago
  How would step 1 improve security over not allowing third party devices to send messages at all?
  - mystified5016 2y ago
    Why let users send messages in the first place? Tell me how you can get any more secure than that.
    - SR2Z 2y ago
      If Apple had their way, they would LOVE to sell you a $2000 aluminum brick with no screen, speakers, microphone, etc., that still required a proprietary cable to charge.
      - bunabhucan 2y ago
        Now come on, that's not fair. The apple pro display stand is an inert piece of metal with a hinge and some springs and it only costs $999.
        amiga386 2y ago
        https://www.apple.com/shop/product/MX572ZM/A/apple-mac-pro-wheels-kit https://www.apple.com/shop/product/MX572ZM/A/apple-mac-pro-w... A set of four castors. Like the bottom of a shopping trolley. Yours for $699 Tell your friends! "Each castor costs one hundred and seventy five dollars. It costs four hundred thousand dollars to run this computer... for twelve seconds. Ah ha ha ha ha ha ha!" (https://youtu.be/jHgZh4GV9G0?t=19 https://youtu.be/jHgZh4GV9G0?t=19)
modeless 2y ago
Apple makes a mockery of their own "security promises" for iMessage by not end-to-end encrypting iMessages in iCloud by default. Ridiculous to use that as a justification to prevent users from choosing to send their messages to watches that happen to be made by someone other than Apple.
- dwaite 2y ago
  I don't understand, there is no option for iMessages to not be end to end encrypted. Are you speaking to the security of the recipient's backups?
  - modeless 2y ago
    If the sender or recipient has iCloud backup enabled then by default (i.e. without ADP) Apple can read the entire iMessage conversation. And they routinely do, at the request of law enforcement. Since Apple does not allow default-secure alternative cloud backup solutions to exist, it is almost certain that a large majority of iMessage conversations are compromised in this way (with no notification to sender or recipient). Apple deliberately makes this non-obvious, but it is disclosed here: https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 > Messages in iCloud is end-to-end encrypted when iCloud Backup is disabled. When iCloud Backup is enabled, your backup includes a copy of the Messages in iCloud encryption key to help you recover your data. If you turn off iCloud Backup, a new key is generated on your device to protect future Messages in iCloud. This key is end-to-end encrypted between your devices and isnʼt stored by Apple And is the backup end-to-end encrypted? No, not by default, as disclosed on the same page. It is encrypted "In transit & on server" with keys stored by Apple, which means Apple can decrypt it. And they do, as mentioned earlier, for purposes other than "to help you recover your data". The non-default Advanced Data Protection feature is required to get end-to-end encryption of the backup. Note that Google's equivalent Android backup feature has been end-to-end encrypted by default for many, many years. Plus, alternative backup solutions are allowed to exist on Android.
conradev 2y ago
Bluetooth devices can already read Messages from your iPhone with no degradation to E2EE: https://developer.apple.com/library/archive/documentation/CoreBluetooth/Reference/AppleNotificationCenterServiceSpecification/Specification/Specification.html https://developer.apple.com/library/archive/documentation/Co... This is just about sending.
glitchc 2y ago
What is the problem here that a standardized cryptographic algorithm would not solve? I can understand if media poses concerns, but inbound and output text consisting entirely of UTF-8 characters?
queuebert 2y ago
And yet haven't iMessage 0days been used to track and kill people? Even without opening the message?
frollogaston 2y ago
The only hard part of automating either iMessage or SMS spam is getting a clean account to spam with. The input source is easy.
Rebelgecko 2y ago
Does Apple not support that sort of integration already? What happens when your phone is connected to a car and you get a message?
blackeyeblitzar 2y ago
> One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed, and makes automation difficult. Is this really true? I receive a lot of iMessage (not SMS) spam on iOS devices too. In fact for me I see more spam purely on iMessage than SMS. It wasn’t like that in the past, but my point is even closed systems can be abused.
Osiris 2y ago
I get plenty of spam texts on iMessage. Can you elaborate on what you mean by "cesspit"?
mid-kid 2y ago
Yet another example of security without consideration for user experience and freedom. Information security is a careful balance between not using technology at all and getting things done using technology. Sometimes you have to wonder if heavy-handed solutions like this actually helps maintain this balance for users, or just serves to ensure a company's bottom line. This is the line of reasoning that has resulted in me being unable to sign up with a shocking amount of house rental companies, thanks to Play Integrity on the android side of the coin. Does it improve security for me? I would argue it doesn't, as it would force me to use unpatched versions of Android. If it's not serving the user, who is it for?
tomrod 2y ago
If AppleWatch didn't exist, this critique and reasoning would have legs.
epolanski 2y ago
What's the SMS cesspit?
tylerchilds 2y ago
solution: red bubbles apple already does blue for in network and green for out of network red can just be “this message was yolo’d, be aware”
cmiles74 2y ago
Only letting Apple Watch have this functionality is what is wrong. It's clearly anti-competitive, in my opinion their hand-waving about security is just that. They could implement something that works for other smartwatch vendors, they haven't because they don't want to.
Reason077 2y ago
> "One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed" I don't think that's the main reason. iMessage is available on macOS, so by definition isn't that tightly locked down. Anyone can automate/script the desktop app to try and fire off as many messages as you like. But of course that won't really work because Apple has security algorithms in the network that detect unusual behaviour. Did that user/device suddenly start to fire off 1000 messages to users they've never contacted before? Activity flagged, user blocked. There are also functions in the iMessage app itself to block and report unwanted/inappropriate/spam messages. So even low-volume spammers will not get away with it for long. Besides, in the UK, SMS spam is almost non-existent in my experience. Unlike in some other countries I've visited where it's a huge problem. That's not because the ecosystem is any different - it's because there's strict rules that are actively enforced (see TPS: www.tpsonline.org.uk).
- s3p 2y ago
  Do you have a citation for apple rate-limiting iMessage?
- alsiola 2y ago
  > Besides, in the UK, SMS spam is almost non-existent in my experience. This is not my experience. Perhaps 3-5 years ago was the peak of SMS spam, but I still regularly (1/week minimum) get one of the various "package delivery" | "tax refund" | "diesel emissions" scam/spam texts.
johnnyanmac 2y ago
>I do not believe vendors integrating with such a thing can do it safely, or even that all vendors integrating are good actors. Well, Apple will sure make sure the hard task is impossible. That's where the fault lies. It can be a bit tiring hearing security used as a smokescreen to maintain a monopolistic structure over uhh... green bubbles?
windexh8er 2y ago
If you don't think that a walled garden locked into an ecosystem of hardware isn't already a cess pool - then I don't know what is. Hardware should be able to be interoperable. Apple chooses not to, it's in their best interest because they claim "security" and "privacy" for it's users. Security theater for the masses.
- boringg 2y ago
  Your not wrong but it is significantly better then microsoft which was its main competitor.
Arkhadia 2y ago
Oh the irony of how your comment could change a few words and sound like a trump/musk post
RockRobotRock 2y ago
>One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed Would like to add my personal experience: I get way more spam iMessages coming from random Apple IDs than I do spam SMSes.
pyrale 2y ago
The idea that device pairing can and must only be secured at hardware level is a fallacy whose goal is to ensure that only apple products work well with apple products. For the spam example, nothing prevents apple from offering a ble api with auth that ensures that only devices manually paired by the user access it. As for automating spam... when we’re discussing ble, we’re talking about a device a few meters away from your phone. What are spammers going to do, send a jogger right behind you that spams you after somehow hacking apple’s auth system?!
simonebrunozzi 2y ago
iMessage is a failure on policy. Antitrust and similar govt entities should have forced Apple to open it a long time ago.
HexPhantom 2y ago
I get the security concerns, and you're right - opening up iMessage integration to third-party devices would require a serious rethink of Apple's security model. But at what point does -security- become a convenient excuse for anti-competitive behavior?
amelius 2y ago
Nonsense, you can set up your phone such that it shares messages with other devices. If users don't know what that means for security, then tell them. But don't act like it's in their interest to never use devices from other brands.
rkagerer 2y ago
untrusted hardware That's the root of the problem right there. As a hardware vendor, how do you achieve a "trusted" status in their ecosystem? If only Apple devices can do the Appley things, then it really isn't an ecosystem (at least not what I have in mind when applying that term).
- ryandrake 2y ago
  I wouldn't trust most hardware vendors with my wifi password, let alone access to my phone's messages. Hardware vendors have shown time and time again that they don't care about privacy or security. All they care about is shipping their widget and getting you to buy it, and to do that, they will cut corners, ship defective firmware, use easily guessed default passwords, and turn a blind eye to abuse. As a hardware vendor, you'd achieve "trusted" status by having a decades-long track record of not doing these things.
rolisz 2y ago
Counterpoint: SMS is not a spam cesspit in Romania. My phone number is public (company information is public). And I get 1 completely unsolicited messages per month and 1 per week from companies that I bought something from. That's not even enough to get me to try to get rid of those messages.
- Aachen 2y ago
  To add: it's not about targeting rich markets, either. I have a number from the Netherlands and Germany and neither gets more than one spam SMS per, eh, year maybe on average? Some years none, some years three or so perhaps? When COVID was new, I also got a few spam calls (as did my family around the same time, so I guess it was briefly a thing), but that seems to have stopped again. I've had the Dutch number for 20 years and it's in public records, so it's not brand new and unknown either
- Timon3 2y ago
  Just don't make the mistake and give your phone number to any American companies. I did so when starting my current job since I didn't yet have a company phone number, and I suddenly started receiving multiple spam messages daily, which has been going on for years now.
ig1 2y ago
This is incorrect. It's trivial to reverse engineer and use the imessage API and there's third party services which will give you access to it.
thedangler 2y ago
couldn't they make it so it requires permission access with face recognition, thumb print, or pin to give it temp access that needs to be renewed.
freehorse 2y ago
I don't know much about ios. But in macos there are ways to access imessage chat logs or send imessages programmatically. You can create an applescript and do all sorts of stuff. So while I do get that giving this sort of access to an app on your iphone should at least be done through explicit intentful consent from the user, I do not see the impossibility in it. And the fact that there is all this crapp around should not make it impossible for us to have good things, either.
nicoburns 2y ago
Do you have a problem with SMS spam? I can't remember the last time I got a spam SMS message, and I had my phone number on public on my personal website for a number of years. Perhaps SMS spam is a US thing?
invig 2y ago
Summary: "Users get to decide if they trust Apple. Users shouldn't get to decide if they trust anyone else."
Royce-CMR 2y ago
I want to say thank you for writing this. 100% same opinion. I've stuck with Apple - despite their downsides - specifically for their zeal in areas like this. My phone works, I'm glad it blocks others from integrating because I need it to always just work. That's why I still have an iPhone over all the often paper superior alternatives.

Hammershaft 2y ago

I don't see how spam would be a problem. Couldn't messages created externally to imessage be tagged as such and then just rate limited?

Jyaif 2y ago

That's not the "contra", you've just fallen for Apple's PR.

mistercheph 2y ago

So sick of this strawman dialectic from the apple-brained, where the alternative to the walled garden is the worst possible implementation of an open standard.

culi 2y ago
Firefox is also frequently criticized for not implementing certain APIs because of security concerns. There was a post on this site just the other day about their lack of support for WebUSB for exactly this reason It's not unique to Apple. And we should take security seriously. To people who are technically literate and think they can navigate security risks it's not a big deal but people's entire lives are frequently turned upside down by scams and security loopholes
- celsoazevedo 2y ago
  The main difference is that with Firefox no one can use the API. Apple seems to be happy to implement APIs... but only their own products can use them.
  - frollogaston 2y ago
    Like with headphones. Only AirPods and Beats (owned by Apple) headphones can use their proprietary extensions on top of Bluetooth for improved pairing or better headset-mode quality. Then they removed the jack to wipe out the rest.
    - culi 2y ago
      So then why did almost all other major smartphone brands follow Apple's lead in removing the headphone jack?
      - frollogaston 2y ago
        To sell their equivalents of AirPods. Apple brings in $18B yearly revenue from that and locks in users more, big win for them.
minkzilla 2y ago
It doesn't have to be the worst possible implementation to be less desirable than the walled garden for me. I get so much spam in whatsapp, groupMe, telegram, and from sms. Some of it is even from legitimate contacts but then they signed up for something or did something and it sends one of those stupid "join me on {thing}" messages. The only place I don't get spam is imessage
- mistercheph 2y ago
  I get spam on iMessage, and you can continue to live in the walled garden, nobody wants to force you to buy a third party watch, they just want third party devices to have the same API access as the first party device.
  - minkzilla 2y ago
    The walled garden is not a walled garden if everyone else has doors in.
sockaddr 2y ago
It's not a straw man argument, it is the argument. An average user can't dive into the bluetooth driver code and figure out where in the 4000 page spec something deviates and is now a security issue. So we have to assume the worst.
- mistercheph 2y ago
  Having an open standard doesn't mean every implementer will do so in good faith and using best practices, the consumer still ultimately has to make a choice about which product they use, and can continue to use apple's solution if they trust in apple to securely implement the spec. The insane strawman you're proposing is that the choice is between a single blessed solution from Apple that's infallible, and a wild west where the only way for a consumer to be safe is to personally audit their device against a 4000 page specification document. Absurd! We use devices and software every day that implement open standards and while issues do arise in particular implementations, they do with no more frequency than issues are discovered in proprietary solutions and standards. Go look at the CVE's for iMessage, plurality of RCE's on apple devices in the last decade is Apple's iMessage implementation, and it's their own protocol! And almost all of the rest are apple's implementation of the open web standards!
  - vessenes 2y ago
    There are maybe three tech companies in the US that have large security groups dealing with persistent threat actors. Apple is one of them. Google is another. Even with that (large) Apple security group, iMessage is difficult to lock down properly, as you note. However, I think that the cost of 0 day subscriptions for iOS vs Android tell a pretty good story: iOS zero day subscriptions sold to intelligence agencies/governments cost roughly $1mm / seat (phone compromised). Android -- $10k. There are many many decisions along the way that end up with that raw 100x additional cost for iOS security breaches -- value Apple delivers to its customers when they purchase iOS products. You cannot pick and choose from the outside and know which of your preferred opening-up implementations would impact that cost. My argument is that opening this up is one of likely hundreds of possible decisions that would contribute to lowering that cost of exploit.

tadfisher 2y ago

Opening up a BLE API for iMessages is not going to impact iMessage spam whatsoever. It will impact Apple Watch sales though.

agloe_dreams 2y ago
Hey, there we are. That's exactly it. You've always been able to use Applescript to send iMessages on a Mac.

Nextgrid 2y ago

> moving a message over BLE to untrusted hardware and worse accepting them back into iMessage is a massive, massive change in the security boundary Anyone can already screenshot iMessages and move them out of the "security boundary"... which btw doesn't exist much, as if you have any Mac connected to your iCloud account then those messages are being synced to an SQLite DB any process running under your user can access.

culi 2y ago
In what world is screenshotting an iMessage enough to move them out of the security boundary
- cmurf 2y ago
  World in which I've paired my two devices? Doesn't the boundary get broken asking messages be read to me into a BT audio device?
droopyEyelids 2y ago
Did you mean to reply to a different comment?
seanhunter 2y ago
I don’t think you understand what the security boundary of iMessage is. People’s phones got compromised by NSO sending images to them via whatsapp that used an exploit in one of the image libraries to run a malware payload. The security boundary isn’t about whether you can see your own messages, it’s whether bad people can root your phone by getting untrusted code to run. That’s a very different proposition if iMessage is a single codebase that they fully own end to end versus it has a plugin ecosystem. Having such a plugin system widens the security boundary by adding a much larger codebase that would require trust.
- Nextgrid 2y ago
  It doesn't need to be a plugin ecosystem - no third party code needs to run within the iMessage processes/sandboxes/containers. In fact, no third-party code needs to run at all on the phone - all that's needed is to expose an API over BLE that allows previously authorized external devices to query/send messages.

sunshowers 2y ago

The problem is that this argument happens to conveniently align with Apple's financial interests.

ch4s3 2y ago
If your value prop to customers is seamless and secure default behavior, then of course blocking insecure peripherals aligns with your financial interests. This doesn't seem nefarious at all to me.
- wobfan 2y ago
  This is (I guess) not what OP meant. Apple obviously also gains financially from blokcing everything outside of there ecosystem, mainly because the majority of Apple users will only buy Apple hardware. Obviously, yeah, keeping the hardware a bit more safe also helps, but the main financial gain is definitely not coming from this.
  - ch4s3 2y ago
    Note that I said seamless AND secure. Having preferential treatment for a limited set of well known hardware makes the experience seamless. I like the secure and easy hand-off between apple devices. I wouldn't want to give up the security to make it work.
    - lern_too_spel 2y ago
      > I wouldn't want to give up the security to make it work Android shows that you don't have to.
- sunshowers 2y ago
  Why doesn't Apple openly market that it's doing stuff in its financial interest? Is it too embarrassed to point that out?
  - ch4s3 2y ago

the_mitsuhiko 2y ago

> moving a message over BLE to untrusted hardware and worse accepting them back into iMessage is a massive, massive change in the security boundary Is it? My iPhone replicates messages to my mac from where a process can extract that data, it can capture the screen etc. I can use a mac today to set up a relay that would then send those messages to a smart watch if one would do that.

browningstreet 2y ago
Same with Phone Link on Windows.
judofyr 2y ago
Yes? Imagine a bug where iMessages are leaked over Bluetooth when a user has installed an application that integrates with some watch brand. Bring this to an airport and you can steal hundreds/thousands of messages from a wide range of people. That’s widely different attack vector than targeting macOS. That said, I don’t see why Apple can’t provide toolkit/certification that will make it safe to communicate over Bluetooth. They already have it in-place for Apple Watch.
- lern_too_spel 2y ago
  Bluetooth is encrypted.
  - Avamander 2y ago
    Should be, but BT stacks are super crap and it's hard to truly guarantee that. Pretty sure they do not currently require the highest (actually proper) security level from everyone.
    - mystified5016 2y ago
      [flagged]
      - 2y ago

maximusdrex 2y ago

I truly don’t understand how these types of comments keep appearing under any discussion of apple’s blatantly anti-competitive behavior with messages. This doesn’t even make sense on technical grounds; it would be trivial to require such message passing to be encrypted/signed securely if that’s your real concern. After all, the Apple Watch does exist and does have these capabilities, so it’s clearly possible to do it and maintain the “security boundaries” you’re so concerned with. Then every single one of these comments inevitably turn towards spam messages which no longer even makes sense since iMessage has been filled with spam lately. I really don’t see how allowing smartwatch manufacturers to also interface with iMessage (in the same way Apple Watches do) will inevitably increase spam on the platform which can’t be detected/mitigated in other ways. I’d love to see some technically rigorous explanation for why apple can’t support any third-party anything instead of hand wringing about “security” with no real explanation but I have a feeling I’ll be waiting a long time.

FirmwareBurner 2y ago
[flagged]
snailmailman 2y ago
It’s not just the transmission over Bluetooth. It’s the entirety of what happens with the message. Apple fully controls and trusts the code that’s running on the apple watch. But they have no control over what third parties do with all the data they can collect in notifications. Bluetooth devices on iOS that display notifications already are getting more information than normal by simply even reading all notifications. Normal apps on iOS can’t do that, they have no reason to. This api was added because smart watches kinda need that functionality to be useful. I think it’s still locked behind a “this device will see all your stuff” permissions box. I do think they should add in more iMessage/sms/replying capabilities to smart watches though. I think they are extremely hesitant to make it even easier to automate iMessages. iMessage spam is definitely increasing, but it’s NOT as prevalent as normal sms spam for instance. The barriers are much higher, and Apple can basically blacklist devices/appleIDs that send out too much spam, partly because they’ve kept iMessage so locked down.

dns_snek 2y ago

> One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed, and makes automation difficult Really? I'm not in the Apple ecosystem to confirm but it looks trivial to me, and you can always fall back to keyboard/mouse input type of automation. https://airmessage.org/ https://airmessage.org/ https://bluebubbles.app/ https://bluebubbles.app/ https://medium.com/@jameskabbes/sending-imessages-with-python-on-a-mac-b77b7dd6e371 https://medium.com/@jameskabbes/sending-imessages-with-pytho...

jmb99 2y ago
Some anecdata. I get a few dozen spam SMSs in any given month, as well as some spam phone calls (varies a lot by month - sometimes only 1-2, sometimes 20+). I have received a total of 2 spam iMessages (I remember them because they’re notable to exist), and 0 spam FaceTime audio calls, and I’ve had this phone number associated with iMessage since it was first released. Regardless of the reason, there is substantially (many orders of magnitude) less spam on Apple’s networks, at least for me, when compared to SMS/RCS/telephony.
- dns_snek 2y ago
  I'm not debating the amount of spam but rather GP's claim that iMessage is hard to automate. I showed that iMessage is trivial to automate and since you both claim that the amount of spam on the platform is very low, we can conclude that ease of automation isn't an important factor when it comes to iMessage spam. Unless someone decides to move the goalposts we should therefore be in full agreement that Pebble being allowed to integrate with iMessage wouldn't have any appreciable effect on the amount of spam in the network.
  - vessenes 2y ago
    It is definitely harder to automate than SMS. Very large companies exist only to provide API-backed support for automated SMS. In contrast you need to hook into Apple APIs / scripting / sqlite databases on trusted apple hardware in order to automate iMessage. You imagine "Pebble" as one company and say "how hard can it be to turn this on?" As I said in the original comment, it's not that it's hard, it's that it can only be turned on for everyone and that will create a security issue that WILL have a substantial impact on the ecosystem. I didn't say, but believe it to be true that the alternative -- a vendor security assessment program covering software, hardware, architecture and cloud security is not worth Apple's time or money to do. I don't think they have any business reason to do so.

dwighttk 2y ago

Apple is fine with any customer retention benefits from security and I don’t agree (with the article author) that they are merely pretending their strategy is primarily focused on security

chamanbuga 2y ago

This is cap. I worked on heads up glasses, and one of our issues was the lack of integration with Apple's iMessage ecosystem. Device makers are willing to go through several security measures, like deploying the MFi chips and certification. However, at best this gives you access to the notification system, not iMessage itself. You are able to respond to messages via the notification framework, but not integrate directly with iMessage even after taking all security and certification efforts. This isn't a security play. This is a walled garden play.

mceachen 2y ago
s/cap/crap/?
- eddythompson80 2y ago
  Or they mean cap as 'lie' in genz speak. 'No cap' = 'No lie'. in a sentence "I saw an alligator today. No cap"
  - mceachen 2y ago
    Thanks for translating. I’ve never heard cap used in the affirmative.
    - daedrdev 2y ago
      It’s often used to call people out. That’s cap = that’s bullshit
  - rapind 2y ago
    No cap, I did see an alligator two days ago on the golf course. There were a lot of abandoned balls around her (water trap).
  - rambambram 2y ago
    Gen Z speak? I thought it was 'hood speak' or something. Like: I'm going to cap your sorry ass. I'm not a native English speaker, so what do I know.

stemlord 2y ago

And I'll be the contra to your take: the iMessage ecosystem is so closed that everyone without iphones can barely even interact via sms with iphone users. This is overall such a huge problem that it makes the closed ecosystem security solution not a practical solution

op00to 2y ago
I’ve never had an issue texting via SMS since iMessage was available. Now, I can do RCA as well. What issues should I have encountered?
vessenes 2y ago
Nope, SMS works. Just fine. Apple rightly warns you that you are in a lower security environment by adding a bit of visual friction. This is true EVEN IF you are using RCS, because European laws require termination and inspection when RCS messages “interoperate” and are sent to other providers.
- DirkH 2y ago
  This is something I agree with. The world would be more secure if we made SMS obsolete and Apple making a push away from it is arguably net positive.

nashashmi 2y ago

my Chinese smartwatch can get imessages. It can't send messages, but it can use the AI voice (SIRI) to send messages. It can't delete messages either. PebbleOS is asking for the ability to respond to messages with reply or user interactions. This is not a security breach. And it won't leak from encryption anymore than it is leaking now.

stefan_ 2y ago

I think you just don't understand the point. I don't care for choosing between 15 different brands making differently colored RAM either when it's all the same standardized thing, but you bet we're in a lot of trouble when it's only one brand at all. Competition isn't always "technically pure" and "elegant" or meaningful.

amiga386 2y ago

Step 1: Have the iPhone pop up saying "do you want <Pebble watch> to be able to send messages?" and let the user decide which devices can send their phone messages. Step 2: Have the iPhone pop up saying "do you want <Apple watch> to be able to send messages?" and don't just assume "yes" Both steps would improve security, even if they harm Apple's profits.

spiderice 2y ago
How would step 1 improve security over not allowing third party devices to send messages at all?
- mystified5016 2y ago
  Why let users send messages in the first place? Tell me how you can get any more secure than that.
  - SR2Z 2y ago
    If Apple had their way, they would LOVE to sell you a $2000 aluminum brick with no screen, speakers, microphone, etc., that still required a proprietary cable to charge.
    - bunabhucan 2y ago
      Now come on, that's not fair. The apple pro display stand is an inert piece of metal with a hinge and some springs and it only costs $999.
      - amiga386 2y ago
        https://www.apple.com/shop/product/MX572ZM/A/apple-mac-pro-wheels-kit https://www.apple.com/shop/product/MX572ZM/A/apple-mac-pro-w... A set of four castors. Like the bottom of a shopping trolley. Yours for $699 Tell your friends! "Each castor costs one hundred and seventy five dollars. It costs four hundred thousand dollars to run this computer... for twelve seconds. Ah ha ha ha ha ha ha!" (https://youtu.be/jHgZh4GV9G0?t=19 https://youtu.be/jHgZh4GV9G0?t=19)

modeless 2y ago

Apple makes a mockery of their own "security promises" for iMessage by not end-to-end encrypting iMessages in iCloud by default. Ridiculous to use that as a justification to prevent users from choosing to send their messages to watches that happen to be made by someone other than Apple.

dwaite 2y ago
I don't understand, there is no option for iMessages to not be end to end encrypted. Are you speaking to the security of the recipient's backups?
- modeless 2y ago
  If the sender or recipient has iCloud backup enabled then by default (i.e. without ADP) Apple can read the entire iMessage conversation. And they routinely do, at the request of law enforcement. Since Apple does not allow default-secure alternative cloud backup solutions to exist, it is almost certain that a large majority of iMessage conversations are compromised in this way (with no notification to sender or recipient). Apple deliberately makes this non-obvious, but it is disclosed here: https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 > Messages in iCloud is end-to-end encrypted when iCloud Backup is disabled. When iCloud Backup is enabled, your backup includes a copy of the Messages in iCloud encryption key to help you recover your data. If you turn off iCloud Backup, a new key is generated on your device to protect future Messages in iCloud. This key is end-to-end encrypted between your devices and isnʼt stored by Apple And is the backup end-to-end encrypted? No, not by default, as disclosed on the same page. It is encrypted "In transit & on server" with keys stored by Apple, which means Apple can decrypt it. And they do, as mentioned earlier, for purposes other than "to help you recover your data". The non-default Advanced Data Protection feature is required to get end-to-end encryption of the backup. Note that Google's equivalent Android backup feature has been end-to-end encrypted by default for many, many years. Plus, alternative backup solutions are allowed to exist on Android.

conradev 2y ago

Bluetooth devices can already read Messages from your iPhone with no degradation to E2EE: https://developer.apple.com/library/archive/documentation/CoreBluetooth/Reference/AppleNotificationCenterServiceSpecification/Specification/Specification.html https://developer.apple.com/library/archive/documentation/Co... This is just about sending.

glitchc 2y ago

What is the problem here that a standardized cryptographic algorithm would not solve? I can understand if media poses concerns, but inbound and output text consisting entirely of UTF-8 characters?

queuebert 2y ago

And yet haven't iMessage 0days been used to track and kill people? Even without opening the message?

frollogaston 2y ago

The only hard part of automating either iMessage or SMS spam is getting a clean account to spam with. The input source is easy.

Rebelgecko 2y ago

Does Apple not support that sort of integration already? What happens when your phone is connected to a car and you get a message?

blackeyeblitzar 2y ago

> One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed, and makes automation difficult. Is this really true? I receive a lot of iMessage (not SMS) spam on iOS devices too. In fact for me I see more spam purely on iMessage than SMS. It wasn’t like that in the past, but my point is even closed systems can be abused.

Osiris 2y ago

I get plenty of spam texts on iMessage. Can you elaborate on what you mean by "cesspit"?

mid-kid 2y ago

Yet another example of security without consideration for user experience and freedom. Information security is a careful balance between not using technology at all and getting things done using technology. Sometimes you have to wonder if heavy-handed solutions like this actually helps maintain this balance for users, or just serves to ensure a company's bottom line. This is the line of reasoning that has resulted in me being unable to sign up with a shocking amount of house rental companies, thanks to Play Integrity on the android side of the coin. Does it improve security for me? I would argue it doesn't, as it would force me to use unpatched versions of Android. If it's not serving the user, who is it for?

tomrod 2y ago

If AppleWatch didn't exist, this critique and reasoning would have legs.

epolanski 2y ago

What's the SMS cesspit?

tylerchilds 2y ago

solution: red bubbles apple already does blue for in network and green for out of network red can just be “this message was yolo’d, be aware”

cmiles74 2y ago

Only letting Apple Watch have this functionality is what is wrong. It's clearly anti-competitive, in my opinion their hand-waving about security is just that. They could implement something that works for other smartwatch vendors, they haven't because they don't want to.

Reason077 2y ago

> "One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed" I don't think that's the main reason. iMessage is available on macOS, so by definition isn't that tightly locked down. Anyone can automate/script the desktop app to try and fire off as many messages as you like. But of course that won't really work because Apple has security algorithms in the network that detect unusual behaviour. Did that user/device suddenly start to fire off 1000 messages to users they've never contacted before? Activity flagged, user blocked. There are also functions in the iMessage app itself to block and report unwanted/inappropriate/spam messages. So even low-volume spammers will not get away with it for long. Besides, in the UK, SMS spam is almost non-existent in my experience. Unlike in some other countries I've visited where it's a huge problem. That's not because the ecosystem is any different - it's because there's strict rules that are actively enforced (see TPS: www.tpsonline.org.uk).

s3p 2y ago
Do you have a citation for apple rate-limiting iMessage?
alsiola 2y ago
> Besides, in the UK, SMS spam is almost non-existent in my experience. This is not my experience. Perhaps 3-5 years ago was the peak of SMS spam, but I still regularly (1/week minimum) get one of the various "package delivery" | "tax refund" | "diesel emissions" scam/spam texts.

johnnyanmac 2y ago

>I do not believe vendors integrating with such a thing can do it safely, or even that all vendors integrating are good actors. Well, Apple will sure make sure the hard task is impossible. That's where the fault lies. It can be a bit tiring hearing security used as a smokescreen to maintain a monopolistic structure over uhh... green bubbles?

windexh8er 2y ago

If you don't think that a walled garden locked into an ecosystem of hardware isn't already a cess pool - then I don't know what is. Hardware should be able to be interoperable. Apple chooses not to, it's in their best interest because they claim "security" and "privacy" for it's users. Security theater for the masses.

boringg 2y ago
Your not wrong but it is significantly better then microsoft which was its main competitor.

Arkhadia 2y ago

Oh the irony of how your comment could change a few words and sound like a trump/musk post

RockRobotRock 2y ago

>One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed Would like to add my personal experience: I get way more spam iMessages coming from random Apple IDs than I do spam SMSes.

pyrale 2y ago

The idea that device pairing can and must only be secured at hardware level is a fallacy whose goal is to ensure that only apple products work well with apple products. For the spam example, nothing prevents apple from offering a ble api with auth that ensures that only devices manually paired by the user access it. As for automating spam... when we’re discussing ble, we’re talking about a device a few meters away from your phone. What are spammers going to do, send a jogger right behind you that spams you after somehow hacking apple’s auth system?!

simonebrunozzi 2y ago

iMessage is a failure on policy. Antitrust and similar govt entities should have forced Apple to open it a long time ago.

HexPhantom 2y ago

I get the security concerns, and you're right - opening up iMessage integration to third-party devices would require a serious rethink of Apple's security model. But at what point does -security- become a convenient excuse for anti-competitive behavior?

amelius 2y ago

Nonsense, you can set up your phone such that it shares messages with other devices. If users don't know what that means for security, then tell them. But don't act like it's in their interest to never use devices from other brands.

rkagerer 2y ago

untrusted hardware That's the root of the problem right there. As a hardware vendor, how do you achieve a "trusted" status in their ecosystem? If only Apple devices can do the Appley things, then it really isn't an ecosystem (at least not what I have in mind when applying that term).

ryandrake 2y ago
I wouldn't trust most hardware vendors with my wifi password, let alone access to my phone's messages. Hardware vendors have shown time and time again that they don't care about privacy or security. All they care about is shipping their widget and getting you to buy it, and to do that, they will cut corners, ship defective firmware, use easily guessed default passwords, and turn a blind eye to abuse. As a hardware vendor, you'd achieve "trusted" status by having a decades-long track record of not doing these things.

rolisz 2y ago

Counterpoint: SMS is not a spam cesspit in Romania. My phone number is public (company information is public). And I get 1 completely unsolicited messages per month and 1 per week from companies that I bought something from. That's not even enough to get me to try to get rid of those messages.

Aachen 2y ago
To add: it's not about targeting rich markets, either. I have a number from the Netherlands and Germany and neither gets more than one spam SMS per, eh, year maybe on average? Some years none, some years three or so perhaps? When COVID was new, I also got a few spam calls (as did my family around the same time, so I guess it was briefly a thing), but that seems to have stopped again. I've had the Dutch number for 20 years and it's in public records, so it's not brand new and unknown either
Timon3 2y ago
Just don't make the mistake and give your phone number to any American companies. I did so when starting my current job since I didn't yet have a company phone number, and I suddenly started receiving multiple spam messages daily, which has been going on for years now.

ig1 2y ago

This is incorrect. It's trivial to reverse engineer and use the imessage API and there's third party services which will give you access to it.

thedangler 2y ago

couldn't they make it so it requires permission access with face recognition, thumb print, or pin to give it temp access that needs to be renewed.

freehorse 2y ago

I don't know much about ios. But in macos there are ways to access imessage chat logs or send imessages programmatically. You can create an applescript and do all sorts of stuff. So while I do get that giving this sort of access to an app on your iphone should at least be done through explicit intentful consent from the user, I do not see the impossibility in it. And the fact that there is all this crapp around should not make it impossible for us to have good things, either.

nicoburns 2y ago

Do you have a problem with SMS spam? I can't remember the last time I got a spam SMS message, and I had my phone number on public on my personal website for a number of years. Perhaps SMS spam is a US thing?

invig 2y ago

Summary: "Users get to decide if they trust Apple. Users shouldn't get to decide if they trust anyone else."

Royce-CMR 2y ago

I want to say thank you for writing this. 100% same opinion. I've stuck with Apple - despite their downsides - specifically for their zeal in areas like this. My phone works, I'm glad it blocks others from integrating because I need it to always just work. That's why I still have an iPhone over all the often paper superior alternatives.