Hacker News Reader

Comment by SalimoS | Hacker News Reader

Wouldn’t be not parsing incoming media unless it’s for someone from contact is a first step that can reduce largely the thread ?

So it will stay the same for people in your contact list but a new touch to load for message from unknown person

View on HN

https://en.wikipedia.org/wiki/Dancing_pigs

A reasonable trade-off would be disabling parsing for people not in your contacts list.

For the general population this probably applies, but in the case of this exploit it looks like it's targeted at specific individuals. If you were someone being targeted by an oppressive government, for example, you might be a bit more cautious when clicking on suspicious-looking incoming media so I think the suggestion has value.

Fair point. The point still stands but in a weaker way though. Even people who say/claim they care make mistakes.

The idea is that contacts can still send you media without prior approval. Do their children never make mistakes? Do their spouses/gardeners/etc.?

That might sound good in theory by in practice it's unlikely to go well(by default).

Many services from banks to healthcare utilize SMS as a main way of communicating with end-users. many rely on dynamic numbers.

Moreover, spoofing SMS messages is not that hard.

Messaging apps whether it is SMS or alternatives like whatsapp, telegram etc. will always offer a powerful vector to infect devices.

I think banks don't use inline media in their messages too often.

It is part of my job. many banks do. often embarrassingly so.

you have made an argument against _never_ parsing media from untrusted _SMSs_

This is iMessage, and instead of _never_ parsing, requiring user action to parse. It will cut out the majority of the noclick exploits, and make iphones safer for most people.

This of course doesn't protect against spear phishing. But it should give apple time to fix their shit.

Reply on news.ycombinator.com