Hacker News Reader

Comment by chatmasta | Hacker News Reader

No. Reacting to any unwanted contact just moves you further into their funnel. Ideally don’t even open the text.

It used to be, on some mail readers, that "opening" an email message could unleash Pandora's Box, in terms of interpreting HTML, downloading images, attachments or whatever. I sincerely doubt that is even the case for the major providers such as Outlook or Gmail. And yeah, per comments downthread, my Android Messages app has "read/unread" and that's really the only thing that "opening a text" changes. There's no additional execution or activation like opening or executing a file.

Does RCS remove the read receipt?

Back in the day, some systems used to acknowledge the request for a read receipt by default giving them the ability to determine if a number was actively watched.

Hopefully everything has it disabled by default these days.

It's a setting on Android. I don't know about iOS.

Same for SMS read receipts.

Yeah I checked after writing that. They are now all disabled by default, for both Android and iOS.

> It used to be, on some mail readers, that "opening" an email message could unleash Pandora's Box, in terms of interpreting HTML, downloading images, attachments or whatever.

That's still true for both email and text messages.

Just opening text messages can infect your phone too. In one case, iphone users didn't even have to open the message (https://www.bleepingcomputer.com/news/security/apple-zero-cl...).

There have been similar problems with outlook allowing unread email to infect a device (https://www.csoonline.com/article/3486789/microsoft-outlook-...)

It doesn't matter what the platform is, spam is toxic and should be handled carefully and as little as possible.

How does one “open a text”?

Depends on the platform, but generally speaking it requires taking whatever action changes its status from "unread" to "read." But even then, there has been at least one case of iOS malware that infected the system upon delivery of a text (since BlastDoor parsed the payload upon receipt, IIRC). That's one reason why Lockdown Mode rejects any text from unknown numbers.

Text messages don't have an "open" action. Replying STOP will unsubscribe the recipient from future SMS from this number. I have never seen an organization use an unsubscribe as a positive action in their funnel. There are less expensive and less risky ways to confirm that a phone number is valid for sure.

Not really true, if you have an iPhone, at least. URL previews are loaded on message open. A network request to the url they sent you. They know when you opened it

Unless the behavior has changed (maybe it has)?

Previews are generated by the sender. The only network requests for the receiver are to Apple. Quoting from a January 2021 Project Zero blog post⁽¹⁾ on BlastDoor:

As an example, consider what happens when a user sends a link to a website over iMessage. In that case, the sending device will first render a preview of the webpage and collect some metadata about it (such as the title and page description), then pack those fields into an NSKeyedArchiver archive. This archive is then encrypted with a temporary key and uploaded to the iCloud servers. Finally, the link as well as the decryption key are sent to the receiver as part of the iMessage. In order to create a useful user notification about the incoming iMessage, this data has to be processed by the receiver on a 0-click code path. As that again involves a fair amount of complexity, it is also done inside BlastDoor: after receiving the BlastDoor reply from above and realizing that the message contains an attachment, imagent first instructs IMTransferAgent to download and decrypt the iCloud attachment.

⁽¹⁾ https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

Keyword: over iMessage. What about normal SMS messages?

Just tried it. It doesn't render a preview.

I reply STOP (or whatever the capitalization is that the text asks for) to every political spam text I get that says "STOP to unsubscribe" or some such. I've been doing this for years.

I got 7 political spam texts today. I don't think the STOP is working.

How does one “open an email”

Same thing

Your messaging client may helpfully request the url they sent you to show a url preview.

In an email, your client renders the html including img tags (yes, this can be disabled, and may not even be default for most people anymore; it’s still a thing)

I agree. It's also worth noting that people have had their devices compromised just by opening a text message (for that matter iphones have been hacked just by receiving an invisible text) so it's probably best to delete any spam text unread.

Reply on news.ycombinator.com