Earlier quoted context omitted.
That API is not useful for anti-spam purposes, as individual devices cannot be banned for spamming by their serial number. Quoting that page: > The API is not designed to fulfill the following use cases: > Contain signals for app-specific use-cases, such as device identifiers
That can be built trivially using this API. The app stores an identifier, which it knows has not been tampered with because of attestation. Giving apps access to a unique device identifier shared across apps is a privacy leak but can be obtained with the proper scary permission.
Correct: 'Non-heuristic antispam' and 'Private device identifiers' are incompatible requirements, unless you introduce another expensive obstacle to overcome. Spamming depends on cheap/free sock puppet accounts. The cost per account is inversely proportional to the value it holds to spammers. That cost can be in Apple's iMessage terms: $100+ per serial number, all devices must include burned-in serial number attestation in their server communications. Or that cost can be in bureaucracy: $10 per notarized "account signup request with verified citizenship", but now all communications can be associated with the notary's logs of your citizenship ID number.
There is no way to stop spam without incurring one or another cost to each user. Apple's method doesn't care who you are, so long as you possess Apple hardware. The Pluton method wouldn't either. What other methods exist that are unconcerned with the exact identity of the user, but still make spamming unprofitable?