And yet their messaging strategy is to push a carrier standard with what I consider an egregious oversight: end to end encryption. You know, that thing Apple and Signal have had since the beginning of time.
Even worse, Google decided to auto-enroll millions of devices into their RCS hub meaning it's receiving device text messages in cleartext. How do you like dem apples? And you thought the metadata collecting was bad.
This is so the carriers can measure and limit tethering separately.
The security issue here is that if you have a VPN client running on your phone, tethered traffic still goes in plaintext to the public internet via the hidden APN.
Not cool.
Interesting though, thanks.
That being said, the most straightforward non-root way around it is to install LineageOS on a supported device. There's an option in hotspot settings to share VPN connection. There may be other (non-Google) manufacturers that carry a similar feature.
If you want to talk real nasty shit: Lets say you do the above and unlock device bootloader to install LineageOS. However, you decide not to root because you'd like to maintain security on the device. Additionally, you're on the latest monthly patch level while your vendor's latest build is 8+ months back...
Guess what? Now you can't use Netflix or your banking app!
Why? Because Google play services uses your device's 'hardware-backed attestation' to know bootloader is unlocked and app developers can block install of their apps based on this certification status. See: https://www.lineageos.org/Google-Play-Certification/
I discovered the issue by connecting my phone to my home VPN and then trying to access services that are only accessible from my home.
I wish I had something to add; particularly like "here's a reasonable alternative", but there really isn't.
Yes, there are: https://en.wikipedia.org/wiki/Pinephone and https://en.wikipedia.org/wiki/Librem_5.
I own one of these (the pinephone) and it's really very much like a laptop running alpine. All of my desktop apps just work (although I have to use fluxbox because CWM isn't nice on a touchscreen.)
If I want to buy 20 million of something the wholesale will give me a better price than if I want 2000.
The marginal cost goes down with the number produced as well.
3D-gaming? Yes: https://www.youtube.com/watch?v=S_HXQJkWjUQ.
Using an external screen? Yes: https://www.youtube.com/watch?v=bH3RbrwhNd8.
I have a Pinebook Pro and love it, but the Pinephone's camera is woefully underspec'd. Put a better camera on it and let me pre-order ffs and I'll buy one in a heart beat.
That's great! Now if only I could get some kind of email notification about that. Oh. I can't.
I don't get why I can't pre-order now; if I'm willing to spend money on a promise, like with Kickstarter, then I should be able to do so here.
If you have some sources on this, it I'd upvote it as a submission.
One major thing to note: Don't expect support from LineageOS devs for MicroG stuff. They explicitly do not support it and are slightly rustled at people using unofficial builds with MicroG and then complaining in their support channels.
SMS or RCS notifications aren't treated as any special case that gets priority over any other messaging app. If you want to use signal as your primary messaging app, android is happy to support that.
If you are on Android and you use Signal, but text some random other android user's phone number that uses a pure sms messaging app, is any part of that conversation encrypted?
but there's nothing about SMS that makes it a default other than it's what most people use. You have to open an app to send a message, there's no default way of sending a message where you aren't choosing an app first, and if you want something private and secure, you can choose something other than SMS.
I was guessing this would be an SMS-based app.
Opting for security and privacy vs a default lack thereof.
WhatsApp has the exact same problem with unencrypted backups.
End-to-end encryption at large scale is not really something American mega-corporations can provide, unfortunately.
Thanks!
iCloud Backups are still stored in the clear, solely to enable snooping.
Meaning that Apple can decrypt it when they are requested by authorities.
It is not clear text. It is encrypted and Apple has the key.
The reason the distinction is important is that if it were clear text NSA/FBI etc could gain physical access to the servers and read the backups without Apple's knowledge or approval.
> The reason the distinction is important is that if it were clear text NSA/FBI etc could gain physical access to the servers and read the backups without Apple's knowledge or approval.
Where does Apple store the keys? On the very same machines?
It's like having a bulletproof lock, and storing the key under the potted plant.
Most people will want that and not care about the underlying subtleties, so it's not just for the government.
It seems they decided the main hurdle is just to get all the carriers on board, and a basic version of RCS up and running on all the Android phones, and encryption didn't make it into the MVP.
[1] https://www.theverge.com/2020/5/23/21268577/google-messages-...
https://www.theverge.com/2016/9/21/12994362/allo-privacy-mes...
I feel like a broken record but: Apple for the love of god stop pulling a RIM/Blackberry and make Messenger available on Windows and Android and charge a fee if you have to.
I don't know anyone who still uses SMS. What's your point?
This of course makes it usually more expensive for the Android user to respond. But due to the level of iMessage use they don't have an alternatives. And most plans are now quite generous with SMS bundles anyway.
Because I already have a perfectly serviceable message app that comes with the phone by default. Do the three in your list interoperate with each other, is that why you're suggesting them?
Edit: What I mean with this comment is that HN has lots of readers outside of the US. Here using only iMessage would be a bit weird, and for that reason everybody uses either Signal or WhatsApp.
2. SMS is miserably useless on some carriers (notably when I had T-Mobile and for my friends still on T-Mobile).
3. MMS is miserably useless, period.
4. International SMS/MMS can be expensive, is more unreliable than domestic, and often unavailable.
Given 2-4, I avoid SMS/MMS as much as possible. Given that E2E is available (WhatsApp, Signal, others), and those services are reliable, available, and useful, I may as well use an E2E system.
The privacy aspects are a great additional feature that they offer.