Dear Apple: Add "Disappearing Messages" to iMessage
blog.cryptographyengineering.com
blog.cryptographyengineering.com
I’m already quite annoyed apple implemented unsend, and message edit. I’ve always disliked all these features since it puts someone else (the other party), in control of what should be your message.
Is it your message though? Doesn't the copyright belong to who wrote it (the sender)?
One potential real-world issue is that a text message conversation could be used as evidence of domestic abuse or of general harassment or threats. If the perpetrator can edit the message history for both parties at will, that's a problem.
In practice, of course, there are ways to solve this problem, like the device keeping around the history of edits (Signal does this, not sure if others do), and the app can also limit the reach of this sort of nefariousness by disabling the edit function after a certain amount of time.
Disappearing messages can be great for privacy and I applaud them for that use case, but they can also easily be used to hide evidence of abuse and other nasty stuff right from the victim's phone.
I'd suggest a good implementation of this feature should come with a setting to disable disappearing messages by default (a setting which should be off). With the setting on, the sender should see the option to send disappearing messages be disabled, and the other party should be able to turn them back on on a per-chat basis. The setting should probably also allow tracking of edits/deleted messages. That way, people are in control and can know what to expect from their messengers. You won't find yourself lacking evidence of blackmail after the fact because your chat history unexpectedly deleted itself.
Furthermore, I think that most messaging within apps that provide this feature puts too much trust in the remote device. If you enable this feature, apps pretend that it's a sure and done deal, when in reality there are myriad ways of extracting messages before they're deleted.
As someone who bridges most of their chat apps through a (private) Matrix server, I've toyed with the idea of disabling the delete functionality to keep control on my side of the conversation. So far, I haven't needed it, but having the ability to do so if necessary gives a certain amount of comfort.
It depends on where you are. In the US plenty of states require consent from all parties to a conversation to record it. The only function of this rule is to allow people to lie about what the conversation was about, as there is no law that prevents a party to the conversation writing it down and sharing it to the public.
And that's exactly what I think about disappearing messages. The only function of this is to be able to lie about the message. I'm not interested in having a system where someone can set their message retention to 5 minutes and then send a bunch of abusive messages to me. Or some sort of phishing message. If they choose to add this to iMessage they should also include an option that automatically rejects all disappearing messages and reply to the sender indicating that their message was rejected. Or optionally, if I could set my phone to ignore the expiration time and retain the message forever. It's my phone and I'm paying for the phone service. It's up to me how my device is used, not some third party. If they don't like my terms, they should choose not to involve me.
Not everything needs to be the equivalent of a midnight whisper in a dark alley.
I don't own an iPhone so I don't know for sure if old messages clog iPhones too but the article hints that this is the case.
Maybe Apple is happy to sell new phones with more storage to people that run out of space. Maybe iMessage is a tiny storage eater, maybe not. Photos, videos, vocal messages are on the phone forever too?
Has this excuse ever worked?
however, on the client side, you don't cache all that stuff, only what you can see; you have to scroll up and wait for the server to fetch it and show it to you if you wanna see older stuff. You can use the search, too, and that's "relatively" quick, and will scroll back to the correct spot.
But in larger rooms with more media, clicking the result to get the context is hit-or-miss.
It really depends on how much people send you photos and video. Text is not going to be much of an issue.
I have a SMS/MMS/RCS backup that spans ~15 years, and it (uncompressed, with media files base64'd) is 1.6GB. MMS compresses media files to the point of garbage before sending them, so a more modern app would end up with (much) larger media files. My Signal backup file is around 2GB now; I'm not sure if it's compressed (probably?), and I've been using Signal for a much shorter time and with fewer people than SMS/MMS/RCS.
(The irony is not lost on me that I am the kind of "offender" that the article's author talks about, someone who keeps messages forever.)
For a modern decently-high-end smartphone with 128GB of storage (or 2x or 4x that), I don't think this amount of messages would "clog up" anyone's phone. But maybe it could be an issue for people with budget-oriented phones that have less storage.
In any case this feature wouldn’t benefit me, because I don’t think any of my extended family would want to use it.
Apple stopped selling their 64GiB base model yesterday, I believe, and all of their phones are high-end.
In the real world, plenty of people use 64 or even 32GiB phones every day. I've even seen people use 16GiB phones with SD cards. If you have a family member that sends lots of images and video, you can easily fill your phone with messages without the occasional purge.
As for clogging up the phone: I find that the more media there is on my phone, the slower file pickers become over time. The files themselves can be tiny hyper-compressed JPEGs, but the thousands of entries in the cache table and kilobyte previews while scrolling still have an impact. It doesn't need to be about storage alone.
Another issue is having your gallery sync to google's cloud for example. Then you only have at most 10 gigs and you get warnings that you'll stop receiving your email unless you clean up or pay. The cloud sync issue I've seen multiple times on phones of relatives.
Not sure how it works if you save a photo or something, i figure it would get offloaded to iCloud like the rest eventually.
iOS has a built in tool that help you identify and clean up space hogs. It’s first recommendation is usually to remove large messages attachments. It will show you a list of all attachments (descending size), you select the ones you want to remove and hit delete. It also offers to automatically delete messages after some time. It’s a global option though, not per chat, not usable if you only want some to be ephemeral.
WhatsApp takes a different approach of making the message itself self-destruct. Personally, I think that’s a weird approach that doesn’t make sense for what most people want to do.
With “piled” data like messages, you’re better off just having an expiry policy with exceptions. Apple gets the expiry right-ish (the options are 30 days or one year which is constricting imo), but it’s really difficult to make exceptions or even find messages past a few days.
Note that my background is historically in enterprise IT, specifically in large email platforms for several years. My perspective is driven by that. Text messages and email are uniquely well suited to get people fired or worse - written artifacts that are easily used out of context.
I would find that annoying too. What's so hard about periodically hitting "clear messages" on their side?
> I don't own an iPhone so I don't know for sure if old messages clog iPhones too but the article hints that this is the case.
The (otherwise very poor) native "Messages" app on iOS has an explicit feature that locally deletes all messages after a configurable time period.
Why would you want something to be missing for everyone, when the people who don't want it could just not use it?
It’s the same as unsending messages - you can ask people not to do it, but if the option exists, they will do it anyway. I’d rather that options I don’t like don’t exist.
Lost a friend over that, actually. "Well you should have respected my wish to not read those messages" "THEN DON'T SEND THEM"
It's because the discussion is frequently more nuanced than "just don't use it".
Power imbalance is something that exists in the daily life of an individual: an employer, education provider(e.g. school), bank, insurer, government, law enforcer (and more) - are examples of people or systems that can compel you to use software or features that you don't want to use.
Those that can foresee how certain changes can be abused will appear to paradoxically act against their own interests. These people have already weighed the advantages of the change against the pitfalls they bring.
There are also different platforms were we can already see empirically how those changes are being abused - so it's not some hypothetical values discussion.
As always the opposing view isn't a 2-dimensional strawman of convenience.
iMessage isn't an app. It's just the Messages app, and the reason it's that app is because it's the SMS app.
There's zero effort to using Messages. It just works, and it just works to communicate with everyone because it will always fall back to SMS. Every single other app, the receiver has to have installed first.
> As ridiculous as it may sound, my kids have actually been left out of social groups in the past because iMessage doesn't (or didn't?) work very well with Android phones
It's unfortunate but not ridiculous. SMS is bad for sharing media and missing a lot of features that make for better conversation. And group texts in SMS are just kind of broken in a lot of different ways, nothing to do with iMessage.
RCS solves these issues.
Are people even remotely aware? Have they noticed a difference?
I wonder if it might takes years for people to regain trust with carrier-provided messages with group texts...
It's a completely US-centric solution to an US-exclusive problem.
You sound like you're against phone numbers entirely...?!
They're horrible personal identifiers as they're at least tied to a given country; you lose them if you don't have a service contract; you can't really own them in a way you can own TLDs etc.
There's no technical reason for modern instant messaging to still rely on any part of the phone network, except as a dumb pipe to transmit data over.
Using them as a means of contact discovery I can live with, making it the primary and only identifier is a big mistake, in my opinion.
I don't have any issues with also allowing phone numbers as identifiers and most people preferring these, but I don't want to be forced to do so myself.
I understand that the reason Signal, for example, does this is to cut down on spam on the network. You can't use traditional spam filters, since that would negate the privacy aspects of Signal. So instead you have to increase the cost to spam (i.e. by requiring a valid phone number, which can also be banned from the network.)
Non-tech-savvy users or those that want to use their phone number as their primary identifier anyway could still "pay" with SMS verification; others could pay with money and pick their own identifier.
It really is. It would be less ridiculous if the people refusing to install some third-party messaging app would be generally opposed to third-party apps, yet somehow downloading Instagram or TikTok and signing up for an account doesn't seem to be a problem whatsoever for most.
I am opposed to fragmenting my messaging, and having to remember which app to use for each person/group I want to communicate with.
I'm not going to download WhatsApp just for that one person or one group that wants to communicate through it. No thanks.
(If my entire country has chosen WhatsApp instead of SMS+iMessage, then sure no problem.)
I don't have any preferred app. I just only want to use one. I'll happily use whichever one the people in my country have collectively decided upon.
It's a real pain point...
This bizarre attitude is exactly why my phone number is not registered on iMessage on my iPhone. It works great as a meta-filter for people that filter their social contacts based on phone brands.
> iMessage doesn't (or didn't?) work very well with Android phones
It doesn't work with Android phones at all, and iPhones fall back to using clunky legacy protocols such as SMS and RCS.
The protocol itself is a hot mess based on existing telco standards from the early 2000s that makes XMPP including every single extension look like the minimal platonic ideal of an IM protocol.
The message isn't yours anymore after you sent it, it's the other party's now. When you mail someone a letter, it's up to them what to do with it. Why would this be different? If you want to retain control over something, don't give it away on a medium you can't control.
Fortunately you can turn it off on WhatsApp but it’s per contact which is usually too late.
My partner and numerous female friends get this all the time.
So please don’t add it to iMessage. If you don’t want someone to see something or retain it, don’t send it. There isn’t a magic solution. They can just screenshot it anyway.
You don't just ignore it. You deal with it.
The point is to spare the other party the hassle of having to think about their opsec after-the-fact, not to trap them in a setting they don't want.
On the topic of unsolicited messages though, I prefer to tackle the problem at the source - it shouldn't be possible to message me at all if I haven't given you an invitation to do so, and invitations should be individually revocable. (This would be a big departure from the familiar phone number model, of course)
Technical reasons don't trump social and human reasons. There's a compromise somewhere.
Because iMessage frequently falls back to SMS, which means there's zero ability to implement it on the receiver's phone.
I don't know if it's more to do with my phone's reception or the other person's or what, but I have text chains that are full of a mix of blue and green bubbles.
The idea that blue bubbles will get deleted after a period of time but green bubbles won't would be deeply confusing. Especially when you don't even know what color the message is going to turn out to be until after you send it.
There is no disappearing message feature which actually prevents the message from being saved in some form:
1. Many apps with this feature still allow screenshots of the one-time or time-limited message.
2. The apps which block or notify of screenshots, are trivially defeated by using a second device to record the screen.
3. Jail-breaks exist specifically to disable screenshot protection and notification features.
Finally you can set your own messages to auto delete, ans this is the most likely route of probing your message history. (I also understand that the default setting is to delete all messages after 30 days.)
Most customers (especially non engineer) are apathetic to disappearing messages.
Also its kind of 'fake' you can just take screenshots.
That's not the point of disappearing messages. Maybe "expiring messages" would be a better name. The point is that you and your communication partners don't have to clean up your messages manually. If the messages are not stored indefinitely, then they are a lot less likely to be leaked in a data breach.
Just like face-to-face conversations, the discussion can be ephemeral.
good news, you can already do this (been possible for years). Open Settings, find the settings for `Messages`, and change the `Keep Messages` option to 30 days, 1 year, or forever.
I suppose it would be nice if this setting was more granular, for example per thread...but I think the status quo suits most people just fine?
My friends could covertly create voice recordings of in-person meetings as well, but that's very different from everybody by default walking around with a voice recorder that I have to individually ask them to please turn off.
The recipient can tap "Keep" to permanently save the audio. This returns to the sender the prone-to-misinterpretation warning, "So-and-so kept a message from you."
The "Keep" function is actually an important signal here to the user that breaks the expectation that disappearing messages are unassailable. The recipient can always make a copy.
This argument is 1 tiny step away from, "there's no point in encryption in Signal because if the Signal wants to send a message to someone not on Signal they may choose to send the message as an SMS which is not encrypted". I don't think I agree with the author that iMessage needs disappearing messages but man please make arguments which make sense!
On Transparency:
When you send an Apple iMessage to a non Apple device it is sent via SMS - this can be seen since the colour of the message text shows as gray (or is that green) and not blue. In many use cases, it is not sensible to check the device type of the recipient. The transition from Internet to SMS is performed transparently in that you are not aware of it until after it has been done. You are not warned or given the option to agree to this drop down. (There may be a mode for this, but I am referring to the general situation for most users).
Bear in mind that as soon as the drop down to SMS occurs, the message content is sent in the clear over a telco network and that national telco's are required to store all message content for law enforcement.
On Disappearance:
A main benefit of having disappearing message in WhatsApp, Signal and so on - which I assume have proper E2EE (?) is that, after a while, there is no record in the cloud that can legitimately be accessed by law enforcement - even if local law requires me to give up my password. This is true for all parties to the chat - although it requires trust that a counter-party is not screen shotting away.
Summary:
So, the main thrust of my argument is that it would be impossible to deliver the main benefit of disappearance in iMessage since it would only be applied to some of the messages depending on the other users device.
Of course, Apple could disable text messaging and they could offer the iMessage app on other devices (or allow compatible 3rd party apps). However, for Apple iMessage is a tool that suppresses the value of SMS and limits the ability of mobile network operators to extract revenue.
Before you type a message it says “iMessage” or “SMS” or “RCS” in the text field so you know what you are sending.
If a message doesn’t initially go through first as iMessage then it tries to send it as SMS but you can disable the “Send as text message” in the Settings app on your phone if you don’t want your phone to do this.
I feel the same way about the ability to edit messages and the like. Actual antifeatures, and some of the things I'm most upset being forced to accept due to network effects.
Rather, I’d never put something in iMessage I wasn’t comfortable with others knowing. There are way too many ways for it to leak.
If I really need to share something sensitive, then actually encrypt it and send in as a secure channel as you can.
Having the option doesn't mean much if people don't use it.
Shockingly, most people believe that snapchat actually deletes the content the end-user can no longer see themselves via the app, which for me sounds like an absolutely bananas assumption. But it makes it clear how far the disconnect is between people with tech-know-how vs "normal" people.
That's the entire point. This isn't about deleting other people's messages on your phone, this is about deleting your messages on other people's phones.
Settings -> Apps -> Messages -> Message History: Keep messages: 30 Days, 1 Year, or Forever.