Hacker News Reader

Comment by judge2020 | Hacker News Reader

judge2020

Let's imagine it is an engineering problem; how do they solve it? Give a disclaimer that "your communications are not encrypted" and turn the bubbles maybe light green?

View on HN

> how do they solve it?

Release iMessage on Android. If there is a concern that it wouldn't be secure with Google controlling it, then they could put it out on F-Droid, which would simultaneously prove that they're serious and also undermine Google's own efforts at controlling the culture war.

But then they wouldn’t be able to claim that alternative app stores are bad for consumers.

The presupposition was "let's assume it was an engineering problem, how would they solve it". Obviously we can revert it back to a business choice rather than engineering problem rather trivially.

Part of the iMessage security model is that devices are attested. Without this, the service as-is becomes widely open to spam and other forms of abuse.

Yes, there are other solutions to the spam problem. They are nowhere near as effective as what I’ve witnessed as an iMessage user so far. I regularly get spam chats on WhatsApp and Signal.

As we know, the devices are not attested, because beeper works. They're also not attested on old iPhone versions which are valid iMessage parties. Some new devices being bound to the hardware key doesn't change that.

Spam doesn't matter here - same app is used for SMS, which gets spam, so there's nothing new here.

But if Apple wanted to, they'd just sort out a deal that allows hardware signing of iMessage accounts on Android. That's not an unfixable problem.

>As we know, the devices are not attested, because beeper works.

This argument doesn't make any sense.

They managed to figure out a way to create valid attestation data via old Apple binaries. Just because a security (well. "security") measure was circumvented, doesn't mean it doesn't exist at all.

Software attestation of hardware is just pointless anti-competitive behavior.

Hardware Attestation however can have an actual security benefit.

If beeper was able to attest without hardware, Apple isn't doing hardware attestation and it's therefore just anti-competitive.

From the way I see it described here, it's more in-depth hardware attestation on newer models. So they're doing the good security thing here, but also not making millions of users' lives worse by outright blocking old phones that don't have the necessary hardware features to perform this attestation. x (5? 15?) years in the future they'll block super old stuff that doesn't meet these security requirements.

That's not how it works. Beeper uses the old binaries, because those come from older iPhones where the hardware signing was not possible yet. It's not circumventing anything as far as I understand, just connecting the way an older iPhone would connect.

I mean, we're splitting hairs on terminology here I feel like?

Apple does not want you to connect to iMessage with non-Apple hardware and Beeper uses old Apple binaries to let you do just that.

That, to me, does fall under the umbrella term of "circumventing" some measures that Apple put in place to stop you from doing that; but I guess I can see the point where you'd object to use of that word?

That's a different argument. I was responding to you saying "This argument doesn't make any sense." to the attestation not being required. Whether you call that circumvention or not, ¯ \ _ ( ツ ) _ / ¯

The point was that if you can replicate it in software, then they're not requiring hardware attestation.

Sort out a deal with… whom? 500 different Android device OEMs?

Google. The company that defines what can you call "Android". They can define it to include a hardware crypto chip, signed with the right keys for Apple interop.

I've not received a single spam message on Whatsapp or Signal for as long as I can remember.

Same, in years and years of use, never a single spam message.

I got lots spam on WhatsApp, None on signal.

Guess it's local issue?

i've gotten spam on signal

Was it from a number with the same area code as your Signal number? What was the spam for? Care to share the message if you still have it? I research around spam as a hobby.

Email is in my bio if needed. Thanks in advance.

I always delete it, but 100% of it is cryptocurrency scams.

I have not participated in any cryptocurrency-related groups, so I have always assumed it’s just random.

Ditto. Add signal. Never

Same. Travelled all round the world for years using WhatsApp for local comms and Signal for long-term relationships, and never had spam on either.

good point. there are many other people who received more than once spam on whatsapp (to the point it become a meme in some subreddit).

Does f-droid allow non-open source apps?

No, F-Droid builds almost all apps from source. Even some open source apps don't make it to F-Droid if the F-Droid maintainer doesn't manage to build it themselves on their build server.

Additionally, F-Droid signs every app themselves.

[1] https://f-droid.org/docs/Building_Applications/

This make them a nice target for malware injection.

edit: When the signing is in single entity like f-droid, we have single point of failure.

When everybody sign their own app, we have trust scalability issues -- "trust" just can't scale to everybody.

The reason F-Droid does this is reproducible builds. Which is a big advantage because the code you see on GitHub is the binary you get in your device. It also means it's quite obvious when code is being added because you can reproduce it.

Of course the build platform being compromised is possible but that can happen even with binary distribution.

I thought they only allow you to guild/sign your own apps if it is a reproducible build, and they verify that the version they build is identical to the one you supply.

You can add a repository containing whatever apps you want.

Wouldn’t entire thread need to be light green. Wouldn’t android users not see the Tapbacks/threads in same visual UX. It makes sense to turn it off entirely than to deliver a subpar and confusing UX

Actually both tapbacks (for a long time) and reply threads (since the latest iOS release) are both supported in MMS group conversations. The iPhone will send a tapback as an SMS message such as "Liked 'contents of message that was liked'" and other iPhones convert that back into a tapback. Google Messages also does this (and in fact did it before Apple did). iOS does not convert Google Messages style tapback messages into tapbacks though, so iPhone users only have half of the solution.

As for reply threads, when it's used it creates a lot of confusion for non iPhone users and it's not clear how Google Messages and other texting clients can fix it post-hoc. I'm not even sure how iOS reconstitutes it-- perhaps Apple sends some message metadata on the side via iMessage?

I hate all of this. How depressing. As always, the actual people in the system wear all the cost.

Yes but ultimately those people are also responsible for chosing those systems and for electing politicans that allow this kind of behavior.

Well I didn't choose any of this iMessage nonsense, but I'm still paying for it.

Bizarre take. I had no call in electing any politician that has any influence over Apple or Google, nor do I really have the choice to pick beyond the one of the two systems. Neither does the rest of 95% of the world.

iOS does attempt to properly inline Android tapbacks and has done so since IIRC iOS 16. It's not perfect, though: if the tapback isn't one Messages recognizes, then you get it in message form, e.g. ":smile: to 'Have a nice day!'" (only with the actual emoji). It also fails all tapbacks if it's an image, presumably since it can't know which image is reacted to.

Hopefully the experience is improved when they implement RCS, though I'm not sure if tapbacks are part of the spec.

I just tested it in a group MMS with an iPhone user running iOS 17, and alas no, this is incorrect. Neither thumbs up (like) nor heart (love) apply as tapbacks when the tapback originates from android.

Unless there's something I'm missing, only Android users get cross compatible tapbacks.

Apple would prefer you buy an iPhone.

That's not an engineering solution.

They're social engineering your circle of contacts to pressure you to buy an iPhone

This kind of attitude (eventually) gets the government involved.

As it did in Europe.

Ironically, iMessage is not that common in Europe. WhatsApp and Facebook messenger won the game here (but they are also targeted by EU).

Anyway, I hope for Apple that they have numbers proving that this bullshit strategy really makes them sell more iPhones because it makes them look really stupid. In any sane society, nobody cares about the color of a bubble, in fact, as an iPhone user, I blame more Apple for the lack of basic SMS features than of the bubble color. I’d be a stupid friend if I pressured my friends to get a blue bubble, that’s insane.

Reply on news.ycombinator.com