The successor of SMS has already been hacked | Hacker News Reader

The successor of SMS has already been hacked

vice.com

166 pointskerm1t94 comments

When did carriers ever get anything tech based right? In fact to expect them is wrong as their business model is very different to a tech company. They are beneficiaries of law-bound limited duopolies or oligopolies. In most countries the only audience they care for are the regulators, and not consumers or their security and safety. Regulatory capture is a wonderful thing for these companies and not for consumers.

... he said, while his comment posted correctly, in the moment he wanted, because the tech behind the posting ability was Right.

Not that I agree 100% with the parent poster, but your argument is flawed. ISPs are only part of the enormous tech stack that is required for the internet to work.

The fact that things do work doesn't mean that ISPs are doing everything correctly, not that there isn't reason for complaint or improvement. Just look at the state of the related infrastructure, both technological and political, in the US and elsewhere.

Statistically most likely from a ≈25-100mb US connection while developed countries the world over have had gigabit for a decade...

Our internet is quite a bit behind because telcos in this country don't have to meaningfully compete. Plenty of legislation has cemented their market dominance through artificial (and unnecessary) barriers to entry with practically no accountability for shoddy service and infrastructure. Remember when Verizon received billions in subsidies to bring fiber to NY in the late 00s and ran off with the money with no penalty?

https://www.wired.com/story/new-york-city-verizon-internet/

I’m paying the equivalent of $40 p/m for 600mbit download and 100mbit upload in Europe. I don’t think it’s even the best deal I could be getting.

I'm so jealous. I pay $55/mo for 12 down and 1 up. It's the best deal I can get.

In Switzerland you can get 10Gbps down/1 Gbps up for $50 and you get an Apple TV, a TV subscription and a landline phone number.

The US is 10th in the fixed broadband ranking on speedtest.net[1], ahead of counties like Denmark, Germany, Netherlands, UK, etc.

[1] https://www.speedtest.net/global-index#fixed

Gigabit is not important, remember when you could finally buy a 10MW electrical feed for your home and how much it improved your quality of life... Right that didn't happen because it is not important at all. Running 100W to homes means people can have electric light, 1kW means they can have motorised appliances, and 10kW makes cooking and heating practical... But 10MW? You had no need for it, so it didn't happen.

Likewise more bandwidth enabled applications only up to a point, 40Mbps DSL is perfectly good for watching TV and so on. I had Gigabit on someone else's dime back at the turn of the century and when I bought service for my current home I not only didn't enquire what it would cost to run Gigabit here, I didn't even choose the expensive 80Mbps option, I already know 40Mbps is fine. What mattered most even going from dial-up to 1Mbps DSL wasn't bandwidth, it was Always On. The Network's omnipresence is what matters.

Fibre matters to some extent for infrastructure, same way it matters what a bridge is built from. Fibre coms doesn't attract thieves, not subject to RF interference, lots of benefits for infrastructure projects, but Gigabit Internet for the home? Not important.

Receiving two 4K streams is ~50mbps. This is a pretty common modern use case for home internet.

At 1000mbps downloading any file takes roughly the same time, regardless of size. Offsite storage becomes practical for multimedia files.

Not every home benefits from 1000mbps, but it’s very possible to be a home that does. I don’t have a lot of data stored on disks in my home, because I know I can always download it quickly, even if the filesize is 100gb.

Also most people in the west don't worry about overloading their home's electrical supply by connecting too many devices. That is equivalent to a gigabit connection.

A 100Mbit connection would be equivent to maybe a 4kW home supply in a temperate climate - probably enough for the average user but only just you'd still have to watch your usage.

Additionally the real benefit to FTTH is not bandwidth but ping which is noticeable. And no sane operator is installing FTTH with sub-gigabit capacity because it's a complete waste of time and money.

I strongly disagree, gigabit is especially useful for concurrent users and getting the occasional big download out of the way fast so you can move on to other tasks.

Examples:

* Multiple users watching youtube/netflix at 4K * Downloading an update to a game so you can play with your friends in a reasonable amount of time * Uploading youtube videos * Pulling in packages from a package manager, or updating your OS

It is absolutely important for the home, just not to _you_.

Its on par with banking. On my trip to Europe in 2009 major cards were contacless cards (VISA). Just when I got my USA Visa chip card year ago I visit Europe again and most merchants were concerned why I still have a chip (“it wont work your card probably already expired. Oh wow chip card still working, amazing”). By 2010 you were able to wire money between banks at zero or close to zero fee inly using app on your phone and someone email. Just recently I was able to withdraw money from European AMT by using my email address (I had phone, no cards). I put my email in, verify when I got it and then in my email i I selected card and amount and replied. 15 seconds later ATM spit out $50. Altho I paid 3.2% transaction fee which I gladly did considering I didnt have my wallet w me and really needed cash.

Contactless is capped if you're not using Apple / Google Pay. You need the chip for anything over the cap.

Withdrew $1,500 from Bank of Millenium ATM using contactless card and BLIK in Europe. If by Cap we define I could not withdrew it all then that's correct.

I mean this cap: https://merchantmachine.co.uk/contactless-limits/

I am currently not using it, but it appears my local cable company offers a purported "940+ Mbps" for $110/month.

But I couldn't care less - what I want is something as cheap as possible, irrespective of speed.

They seem to have an option right now for 30 Mbps for $15, but I'm assuming there's some catch. I did think the low cost option was only available for people on public assistance or something.

I used to have a cable connection, and it seemed slightly faster than cellular, but it didn't really make a difference to me, and since I can't do without the cellular, it made more sense to get unlimited data for that, than paying more for limited data and cable service.

More bandwidth only encourages websites to add more advertising, anyway.

> because the tech behind the posting ability was Right.

Yep - TCP can paper over a lot of incompetence.

Not just TCP, but the ability to throw (tax) money at problems.

This hits home for me right now. I'm currently in the midst of fighting Frontier (bonded DSL 12/1) and frequent disconnects every 2-3 min. They're the only terrestrial ISP available at my home and the DSLAM has been oversold for two years per a tech lead. They have 0 incentive to upgrade the infrastructure here. The area I live in isn't even very rural, and it's one of the fastest growing towns in the Seattle area. New neighborhoods in the town are getting fiber but they're not upgrading any outdated infrastructure. Why would they?

In the same situation with CenturyLink. Sounds like I'm more rural but the DSLAM has been here for over ten years and AFAICT has never been upgraded.

I contracted for a telecom industry company (not a carrier, but a kind of service provider to carriers), and can confirm that pretty much the only reason they survived was regulatory capture. The company's core competency was responding to government RFPs and doing the necessary lobbying to get the contracts. It was quite eye-opening. They ended up with a big investment from a private equity firm which had a taste for cash cows.

On the plus side, everyone "worked" from home on Fridays.

> When did carriers ever get anything tech based right?

If Ericsson is considered a carrier, then I'd say Erlang is a good counter-example to this. Though it might be the classic "exception that proved the rule".

Disclosure: I work for SRLabs, the company who did this research.

You can find more infos on our blog release: https://srlabs.de/bites/rcs-hacking/

Great work!

So this is mostly on Google's implementation? Or is RCS insecure in general?

TFA:

>SRLabs didn't find an issue in the RCS standard itself, but rather how it is being implemented by different telecos

Yeah, but on the very next sentence:

> Because some of the standard is undefined...

I don't think you need to add a disclaimer if you use qualifiers such as "our".

Without it, someone will ask for confirmation that "our" really means "our", and someone else will complain about the lack of a disclaimer.

And of course, RCS is not even end-to-end-encrypted so there is no reason whatsoever to use it over SMS or any other messaging platform.

I hope we'll see a good and federated instant-messaging platform that respects privacy and is easy to adopt.

Well, it's still an easier way to share higher resolution images and videos with other non-technical users.

Most non technical people I know can send emails.

Such as.... email?

E-mail doesn't have end-to-end encryption either. PGP doesn't count.

TLS isn't end-to-end encryption?

No. End to end means that plaintext exists only at the two ends (initial sender, final receiver) of a communication.

Not in email. End-to-end here means that noone except sender and reciever can read the content. With tls and email you send it to a server which can read it, not to the enduser.

Why doesn't pgp/gpg not count? Because it's too difficult to set up? Do you really trust an encryption with automatically generated, non-exchangeable keys?

That said hardly anybody I know still uses e-mail for private communication.

Why doesn't PGP count?

Because it's PGP not email providing the encryption. Say we said PGP does count as e2ee for email, why doesn't it count for RCS? What about every protocol, I can just PGP sign messages on them so aren't they all e2ee?

Ideally when talking about e2ee it's not an optional opt in either but that's a whole different debate.

a total pain in the ass to really secure.

https://www.schneier.com/blog/archives/2018/06/e-mail_vulner...

I'm a fan of the matrix protocol. But even if matrix doesn't take off, I'm sure - in fact very hopeful - that there will be something federated that replaces sms and instant messaging platforms.

The incentives just aren't there for what you are asking for.

I'm wondering why you think that would happen. Like, really, why do you expect that?

The goverment in Germany is fighting tooth and nail to keep Telegram and Signal from having actual end-to-end-encryption, trying to ensure that the government has some kind of side channel that makes it possible for them to decrypt everything in case of federal investigations.

So I'd love that but what is your reason to believe in actual federal instant messaging of any kind?

It's technically possible, which makes a good implementation difficult to stop. Look at cryptocurrencies for an example of the struggle governments have to control such things.

RCS was a steaming pile of shit from the moment it was first announced. No instant messenger platform should be developed in this age without E2EE.

https://www.privacytools.io/software/real-time-communication...

I do think that Matrix really has the chance to stand out from the competitors here.

Particularly in regard to: https://www.privacytools.io/software/real-time-communication...

Telecoms companies operate with license in the countries they operate.

The concept of "lawful intercept" is baked into any product they build, operate or sell.

That's just how it works.

Worked in b2b voip, same there.

Telcos should focus on being dump pipes and leave the application layer to others.

Going into messages or even content is nothing but a rent seeking attempt to exploit a missing net neutrality mandate.

I don't really care who sets it up, but since everyone that is currently on facebook chat (be it Messenger or WhatsApp) is also a customer of some mobile carrier, having the carriers create an alternative is not a completely ridiculous idea when we want to make the chat infrastructure distributed/federated. I'd be happy to MMS my uncle if it didn't cost like two euros per 640x480 picture; RCS seems to be the way I'll be able to do that without going through Facebook.

I mean, imagine a world where your ISP gives you an email address too- doesn't really make sense.

That was completely normal.

And still happens to this day.

I think that was the point: since it's normal that an ISP gives you an email address with webmail and some mega/gigabytes space, why not a messaging service supported by mobile carriers?

> I'd be happy to MMS my uncle if it didn't cost like two euros per 640x480 picture

Wow, where are you living? I haven't paid to send an MMS in nearly ten years...

I've seen cheap contracts where SMS is unlimited, but never anything with unlimited MMS (Netherlands).

I actually just checked what I currently pay for an MMS and youfone.nl doesn't even mention it in the price list. Since I have to ask, I guess I can't afford it :-)

Oh :O, up here in the north (Sweden) you have to look pretty hard to find a plan without unlimited everything but data.

my understanding is that mms is part of data, that's how it works here in the US. RCS will also use data whenever it gets implemented.

It's the same in the UK. My phone bill is normally £12 a month - recently it was maybe £1 more. I checked what had happened - I'd accidentally sent a single mms to someone by including a link to google maps in a text message which got expanded into an image.

There's a reason WhatsApp is basically the only messaging people do here - carrier based messaging is an exploitative money trap.

Devil’s advocate: it’ll never change because where’s the money in being the provider of dumb pipes?

More to the point, if you’re a publicly traded company with stock price and future earnings based off on this kind of rent seeking being priced into your valuation, and let’s also say you desperately wanted to do some the honorable thing and ramp operations down to dumb pipe level, how could the markets and shareholders ever let you do that?

The Ma Bells of this world are in over their heads and it’s hard to see things change without state intervention (a politically sensitive topic over in the UK, but that could get pretty off topic.)

>because where’s the money in being the provider of dumb pipes?

In longevity. We will always need dumb pipe companies. If you can keep a decent reputation then perhaps it'll be easier to continue offering that service. You're less likely to get regulated and people will still use your services if a competitor appears. Steam is a good example on that front. If a company wants to make the maximum amount of profit then longevity is a must.

My idea was more about how a change in expectations of the business models of the current providers would possibly have such a negative impact on future growth and revenue predictions, their stock price couldn’t handle a revelatory switch to just being dumb pipes.

If society wants dumb pipe providers, we’ll have to radically alter the business ecology of the telecoms sector.

Oh, to have a modestly profitable and much less ambitious dumb-pipe provider eat all their lunches!

That’s where regulation comes in.

Companies, in particular companies that run infrastructure through public spaces, don’t exist in a vacuum.

neither do regulatory agencies, unfortunately. Which is why they are so good at making things worse rather than better.

Sure it can change. Apple is a model with iMessage. Google could build a messaging protocol that fell back to SMS/MMS if necessary.

If you want to know why Android still doesn’t have a standard messaging app or a standard video chat app, blame the incompetence of Google who has a half dozen failed messaging initiatives under its belt. Once it was dominant on Android, google could also release an app for iOS.

That's what Hangouts was circa 2013.

It did Hangouts messages, video / data voice calls, or traditional voice calls or SMS messages depending on the capabilities of the other client.

But the culture of new products launched rather than iterating on existing products like Gchat and allo and other products needing to be launched and hangouts being pillaged on its feature set so the other ones would look like they had a reason to exist meant that instead of working towards a Google version of iMessage that they could release an iOS client for and that's dominate all messaging, Google fragmented their efforts in a spectacular manner.

That theoretical Google messaging protocol wouldn't make a big difference because Google wouldn't be able to push it to every Android manufacturer, because of anti-trust laws. As long as manufacturers do not package it with every phone, and carriers don't want them to package it, it'll never happen.

But they all install the Google Play Store. How hard would it be for Google to have a big banner when you open the Play Store “Get the Google Messaging App for a better experience.”

It's so unfortunate that Google couldn't stay focused and make Hangouts competitive with iMessage. I would guess that the issue stems from Hangouts' legacy code base that harkens back to Google Talk. However, it appears their 3rd(?) attempt to replace it with RCS/Messages is failing once again.

Google engineers if you're listening - FIX AND IMPROVE HANGOUTS AND STOP WASTING YOUR EFFORTS ON NEW MESSAGING PROJECTS

You can’t get promoted at Google by maintaining an existing product. Only building a new one. (I’ve heard that over and over from friends that work/worked at google).

Yes, this is antidotal...

I have seen plenty of people that work on existing products like Chrome, Gmail, etc. get promoted. I also have witnessed people successfully going from L4->L5 as SWEs without launches. I had to see to believe it, and I have seen it. That said, Google is a GIANT company, and other people might have different experiences.

Disclosure: I work at Google.

It's probably just not as fast as being able to hop diagonally instead of vertically

I think it was back in 2013 mobile communication had peaked. In one app (hangouts) I could: sms/mms/IM/phone-call/video-call using my phone, laptop, or some library kiosk browser in private mode. All of this and the notifications went to all of my devices whether or not my physical phone was powered on or connected. On my actual phone Hangouts would also show all of my local messages and I could merge conversations. Voicemails autotranscribed and you could even have them sent as emails to you. SPAM call filtering was built in. IMs could send images/videos. About the only thing it didn't do was send files (had to put it on Google Drive and share the link manually).

Now 6 years later there is nobody else (free or paid) that offers what Google offered for free in 2013. Google itself has disabled functionality in Hangouts and put out a deprecation notice. The replacement options have been spread across multiple individual app attempts, some of which have already closed down, none of which actually got to the point of replicating the functionality.

Hopefully some service will come along that mimics what I was able to do in 2013, I just hope Google Voice doesn't get gimped before then.

> Google engineers if you're listening - FIX AND IMPROVE HANGOUTS AND STOP WASTING YOUR EFFORTS ON NEW MESSAGING PROJECTS

No don't fix hangouts, help out with matrix.org. They are really offering what nobody else is these days and making huge progress in the short period of time they've been around.

Why this when applications like Telegram, Signal, etc. already exist? That ship has sailed…

There's arguably a market for commoditised secure messaging/queueing, baked into the standard radio silicon, that's a few steps ahead of sms.. Finance, email, voicemail, etc. P2P.

I read your comment as "There's arguably a market for compromised messaging/queueing…" And there is by repressive governments every!

Typical headline of a VICE article. “HACKED”... “implemented with errors by some telcos”.

Successor according to who?

According to most telcos. It appears to be the next “default” messaging service for (non-Apple) mobile users.

So SMS will be actually removed as a service?

On some phones it will not be the default messaging service.

From the SR Labs post on the topic:

> In the second half of 2019, Google and a group of mobile operators started implementing a new communication technology, Rich Communication Services...In June 2019, Google officially announced their plans to push RCS on all Android phones starting with trials being run in UK and France. Fast-forward to November 2019, RCS is being rolled out to all Android users in the US, and operators in other countries are running trials.

https://srlabs.de/bites/rcs-hacking/

Hard to call it a successor of SMS when have the world uses iOS which does not and currently has no plans to support it. So more just another service rather than a replacement for SMS which is a way for all phones to communicate with each other.

The world is bigger than the US.

More then just people in the US use iPhones?

Outside the US the iPhone is not a common choice. It does exist, but most people don't have one. This makes Apple's social lock-in markedly less effective.

I don't think most people have iPhones in the US.

While in RoW iPhones are definitely luxury items, by this very property about half (or more) of people whose decisions matter would have one, and you often wouldn’t want to use technology that doesn’t work on your bosses’ phone.

Is this a troll? You think half of the world's decision makers are in the US?

I think he meant that in 3-rd world countries iPhones are luxury items bought by rich people in position of power.

You might well be right on both items, but see the comment below by spatular for my intention.

(aside: is there a name for the extension of Hanlon's razor where one shouldn't attribute to stupidity a simple miscommunication?)

The us has half iPhones of China alone [0]. And America only contains 16% of the worlds iphones. So yes, America is not a big player when it comes to iPhone usage.

[0] https://www.statista.com/statistics/755625/iphones-in-use-in...

I thought MMS. Did someone miss something?

Reply on news.ycombinator.com