Hacker News Reader

Comment by timmytokyo | Hacker News Reader

I would hope Apple could do something quick and easy in response to this. From the original thread:

  BlastDoor is a great step, to be sure, but it's pretty lame to just slap sandboxing on iMessage and hope for the best. How about: "don't automatically run extremely complex and buggy parsing on data that strangers push to your phone?!"

View on HN

That would mean, at the very least, that every image and video sent via SMS would require user interaction to even see a preview. Including active conversations with your contacts, given that SMS spoofing is a thing.

And even then, it would all be for naught as soon as the user opens a message, which is a pretty normal thing to do.

(I do think they should be more cautious though. For example, under no circumstances should Apple Mail ever auto-extract an attached zip file from a stranger.)

We're talking iMessage here, so Apple has more reliable evidence of identity than what's provided by easily spoofed SMS.

Really goes to show Apple's approach to security, "feebly containerize something after it's already been severely exploited."

ImageIO is a fairly widely framework, so the number of vectors is very wide.

Run commercials that end with a black background with a single word Security.

It doesn't actually show a whole lot, because that's not really a very good characterization of how BlastDoor works.

Reply on news.ycombinator.com