Hacker News Reader

Please don't copy-paste comments on HN. It strictly lowers the signal-noise ratio, makes merging the threads a pain, and users hate it.

You copied this one 4 times—that's egregious! No more, please.

I was replying in different threads, and I am far from the only users who uses an on-topic comment in this way. I’ll avoid doing that in the future. Just wanted you to know I didn’t invent this practice, nor am I the only one doing it on HN. I take your point, though.

> enter an RCS enabled cellphone number, in order to disable Chat features… including end-to-end encryption

This is _really_ misleadingly worded. The website asks for a confirmation code, which you presumably need access to the device in order to obtain, right?

Sim swaps are a thing.

> If you no longer have access to your phone, you should have to contact Apple support or go to an Apple store.

Requiring users to visit an Apple store to leave Apple's messaging ecosystem doesn't seem like an ideal solution, to put it lightly.

I think the status quo is actually not terrible, and with a simple modification (making any externally-triggered deactivation very visible on the logged-out device) it could be secure as well as being usable.

I think characterizing RCS as "garbage" because of the issue you describe is a bit of an overreaction.

Regardless, I don't see this as a big deal. The site will send a verification code to the phone before allowing anyone to disable it. If someone has cloned/swapped/stolen my SIM card and can intercept and use that verification code, then I have many many many more things to worry about before I worry about someone disabling RCS for my number.

But, as you point out in your edit, iMessage has the same issue. Potato, potahto.

As much as I detest RCS, those unenroll things are necessary for migration. Because it's for migration it can't be on device (you're migrating so you may no longer have a device).

I would guess that your devices will notify you if someone maliciously disables iMessage for you phone#, and maybe google does the same?

There’s a public site to disable iMessages too. Same exact design.

Apple do the same for [0] https://selfsolve.apple.com/deregister-imessage/

It's interesting that both sites are very similar. Maybe Google copied Apple's site.

Seems like it. My points in that regard about only have this setting be accessible behind a login and 2fa is the way to go. You sold or otherwise deprived yourself of your iPhone and forgot to turn off iMessage? Contact Apple support or go to an Apple store. This functionality disproportionately benefits bad actors and intelligence agencies around the world.

You don't need to login also for Apple.

Why would an intelligence agency not be able to go to an Apple store or contact Apple support? This seems like it would only make things harder for users in good-faith scenarios without providing any real security benefit in others.

I was thinking more of in the field, just in time recon. Some things could be justified as imminent threat situations, at least after the fact.