3 ms·

Why would they support SMS then?

by fph 20d ago

sellmesoap 20d ago
SMS is a defacto carrier tech that people expect to work, people also don't expect e2ee or any kind of privacy scheme on SMS but it might be a place to hand communication off to a different tech. Whereas RCS leaks meta data to the goog or worse (I don't know the ins and outs of RCS) but by default I would trust it less then signal, who may also collect meta data leaked through the goog, so I guess the real solution is to be boring and assume there is no security or privacy for anyone of reasonable means.
- prophesi 20d ago
  Signal > RCS > SMS. Just because RCS can't be done without metadata doesn't mean it's a fruitless endeavor. Why not have someone use RCS to then get on Signal? That is so much better than plaintext SMS to Signal. And for most people, RCS between Android <-> iOS is the biggest advancement in encrypted communication for the layman that I've seen since Let's Encrypt.
  - sellmesoap 20d ago
    That is a positive progression for sure. I guess it sounds like RCS is gatekept behind a play store API on the android side so there isn't an open source solution quite yet? Mostly I'm lamenting that even with signal there's meta-data you can infer behavior from. I know Session messenger has a bit of a network shuffle (is it garlic routing?) That blurs metadata collection a bit, but then they watered down several of Signals' security/privacy choices. I'm constantly curious and overwhelmed at the choice of text communication platforms, just so many!
  - grapheneos 20d ago
    We've announced our plan to add RCS with Messaging Layer Security (MLS) for E2EE compatible with Google Messages and iOS. SMS/MMS will only be a fallback once that's implemented. Google Messages is essentially the only remaining RCS client for Android and it's the only one with end-to-end encryption. It already works on GrapheneOS via a toggle for ICC authentication extending our sandboxed Google Play compatibility layer. We want to add support for it to our own Messaging app but that's not straightforward since it's not at all an open platform even to the extent of SMS/MMS.
    - prophesi 17d ago
      I appreciate the update. I wish RCS was more open. I'm still astonished that it wasn't until 2024 that iOS adopted the protocol. Relying on everyone in your group chat to be all Android or all iOS (iMessage) wasn't helping anyone.
bubblethink 20d ago
The world unfortunately uses SMS for 2FA.
grapheneos 20d ago
They're incorrect, see https://news.ycombinator.com/item?id=49669964 https://news.ycombinator.com/item?id=49669964.

Why would they support SMS then?

by fph 20d ago

Why would they support SMS then?

SMS is a defacto carrier tech that people expect to work, people also don't expect e2ee or any kind of privacy scheme on SMS but it might be a place to hand communication off to a different tech. Whereas RCS leaks meta data to the goog or worse (I don't know the ins and outs of RCS) but by default I would trust it less then signal, who may also collect meta data leaked through the goog, so I guess the real solution is to be boring and assume there is no security or privacy for anyone of reasonable means.

prophesi 20d ago
Signal > RCS > SMS. Just because RCS can't be done without metadata doesn't mean it's a fruitless endeavor. Why not have someone use RCS to then get on Signal? That is so much better than plaintext SMS to Signal. And for most people, RCS between Android <-> iOS is the biggest advancement in encrypted communication for the layman that I've seen since Let's Encrypt.
- sellmesoap 20d ago
  That is a positive progression for sure. I guess it sounds like RCS is gatekept behind a play store API on the android side so there isn't an open source solution quite yet? Mostly I'm lamenting that even with signal there's meta-data you can infer behavior from. I know Session messenger has a bit of a network shuffle (is it garlic routing?) That blurs metadata collection a bit, but then they watered down several of Signals' security/privacy choices. I'm constantly curious and overwhelmed at the choice of text communication platforms, just so many!
- grapheneos 20d ago
  We've announced our plan to add RCS with Messaging Layer Security (MLS) for E2EE compatible with Google Messages and iOS. SMS/MMS will only be a fallback once that's implemented. Google Messages is essentially the only remaining RCS client for Android and it's the only one with end-to-end encryption. It already works on GrapheneOS via a toggle for ICC authentication extending our sandboxed Google Play compatibility layer. We want to add support for it to our own Messaging app but that's not straightforward since it's not at all an open platform even to the extent of SMS/MMS.
  - prophesi 17d ago
    I appreciate the update. I wish RCS was more open. I'm still astonished that it wasn't until 2024 that iOS adopted the protocol. Relying on everyone in your group chat to be all Android or all iOS (iMessage) wasn't helping anyone.

bubblethink 20d ago

The world unfortunately uses SMS for 2FA.

grapheneos 20d ago

They're incorrect, see https://news.ycombinator.com/item?id=49669964 https://news.ycombinator.com/item?id=49669964.