Hacker News Reader

Comment by realusername | Hacker News Reader

The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

View on HN

that is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.

> The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

I'm replying to someone who said the important factor is android is open sourced. I pointed out the relevant android program is not open sourced.

That's a half truth as well because the APIs that Message is using are open source and documented. You can recreate a third-party Message app and that's what is used in some of the android distributions.

I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is

I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.

No it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.

It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app.

That's why most of the exploits are targeting imessage

No. Most exploits target iMessage because everyone has it installed.

There's plenty of normal apps built-in, iOS isn't very modular. But none of those are not as deeply integrated as imessage.

Ok, but you still haven’t explained how this means it is any less secure. Can you point to exploits that take advantage of the system integration it has?

It's less secure because it's not using the same sandbox used by billions of apps.

> Can you point to exploits that take advantage of the system integration it has?

Sure, the last pegasus attack on the image codec would not have worked on Android.

You mean the WebP vulnerability in code that literally everyone shared? That one?

Reply on news.ycombinator.com