Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nothing's iMessage app was a security catastrophe, taken down in 24 hours

arstechnica.com

Post reply on HN
Print view View original

141–147 of 147 posts

Re: Nothing's iMessage app was a security catastrophe, taken down in 24 hours

#141

Post by averageRoyalty »

sofixa wrote: post #122
leoh wrote: post #58

Apple is almost certainly aware of this at the C-Suite level; I wouldn’t even be surprised if Tim Cook were briefed. Had Apple pulled Sunbird’s access to iMessage before information about their shoddy security coming out via third-party, they would have run the risk of playing into Google’s narrative about Apple being petty about their closed standard. Here’s what I think (and hope) will happen: * Apple will revoke S…

> Had Apple pulled Sunbird’s access to iMessage before information about their shoddy security coming out via third-party, they would have run the risk of playing into Google’s narrative about Apple being petty about their closed standard. It's not "Google's narrative" (which makes it sound like it's not true), it's the truth and abusing a monopoly, that is being investigated by the EU. We're expecting an EU decision…

It's a bizare mindset. Facebook, WhatsApp, Signal, Telegram - none of them are forced to be interoperable. If I build a messaging protocol, there's no requirement for it to be interoperable. Apple does not hold a majority market share in most of the world. Where is this monopoly, and why should they be forced to share the fruit of their labours?

Re: Nothing's iMessage app was a security catastrophe, taken down in 24 hours

#142

Post by averageRoyalty »

toyg wrote: post #120
63 wrote: post #76

Earlier quoted context omitted.

iMessage is one of the primary moats keeping a lot of people on iPhone. I'm not necessarily as sure as the parent comment that the c-suite was briefed or anything, but I do think that iMessage exclusivity is pretty important to Apple

iMessage is a relic, most people in Europe use WhatsApp and alternatives in other continents. The whole blue/green thing is just Apple-driven hype to remember folks that iMessage even exists.

As an Australian, you're wrong. The "blue/green" is US media driven clickbait, but iMessage is prevelant in many countries I've been to.

Re: Nothing's iMessage app was a security catastrophe, taken down in 24 hours

#143

Post by jjav »

donkeyd wrote: post #50
FirmwareBurner wrote: post #3

>"Sunbird actually logged and stored messages in plain text on both the error reporting software Sentry and in a Firebase store. Authentication tokens were sent over unencrypted HTTP so this token could be intercepted and used to read your messages" Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every single early a…

I work for a company like this right now. About the same number of employees, same mistakes and same time to market on innovative stuff. Here's my two cents on how this can happen: > Which product manager in his/her right mind There is no product manager. There is a project manager. They steer on deadlines and functionality, nothing more. > How do these managers get jobs in these big name companies? Because they talk…

> Because they talk well and they've delivered before. Have they delivered something good and secure? Nobody cares, deadlines were met and functionality was shipped.

This is exactly it. These product managers are judged on delivering on time, delivering UI glitz and UI functionality. Rarely anything else.

Actual product security is not even in the top-25 factors they are rated on.

One of these PMs once told me "We will put up some text on our website stating how we are extremely secure against all including nation state attackers, and that's the extent we're investing in security. We will not invest any time in implementation work related to this."

Eventually we did get this PM removed, but about a year of damage was done.

(LinkedIn tells me this PM is now at a FAANG)

This is why I assert that silicon valley was ruined by the rise of the PMs. In the 90s I had never met a PM, now I can't throw a twinkie in any direction without hitting at least three.

Re: Nothing's iMessage app was a security catastrophe, taken down in 24 hours

#144

Post by sofixa »

averageRoyalty wrote: post #141
sofixa wrote: post #122

Earlier quoted context omitted.

> Had Apple pulled Sunbird’s access to iMessage before information about their shoddy security coming out via third-party, they would have run the risk of playing into Google’s narrative about Apple being petty about their closed standard. It's not "Google's narrative" (which makes it sound like it's not true), it's the truth and abusing a monopoly, that is being investigated by the EU. We're expecting an EU decision…

It's a bizare mindset. Facebook, WhatsApp, Signal, Telegram - none of them are forced to be interoperable. If I build a messaging protocol, there's no requirement for it to be interoperable. Apple does not hold a majority market share in most of the world. Where is this monopoly, and why should they be forced to share the fruit of their labours?

> Facebook, WhatsApp, Signal, Telegram - none of them are forced to be interoperable

Facebook and WhatsApp probably will be forced to be interoperable too.

> If I build a messaging protocol, there's no requirement for it to be interoperable.

None, but it's the decent thing to do. And since corporations are often incapable of doing the decent thing, they have to be forced.

> Apple does not hold a majority market share in most of the world. Where is this monopoly, and why should they be forced to share the fruit of their labours?

You're approaching this from an American "if it's not an absolute 99.99%+ monopoly it's fine", instead of the EU "do they have a portion of the market so big they can distort it and prevent competition and thus hurt consumers". Apple are absolutely hurting consumers with their abusive practices, regardless if their share of phone sales is 30% of 60%. So they will be forced to adapt common standards (USB C), open up their walled gardens, etc.

Re: Nothing's iMessage app was a security catastrophe, taken down in 24 hours

#146

Post by averageRoyalty »

sofixa wrote: post #144
averageRoyalty wrote: post #141

Earlier quoted context omitted.

It's a bizare mindset. Facebook, WhatsApp, Signal, Telegram - none of them are forced to be interoperable. If I build a messaging protocol, there's no requirement for it to be interoperable. Apple does not hold a majority market share in most of the world. Where is this monopoly, and why should they be forced to share the fruit of their labours?

> Facebook, WhatsApp, Signal, Telegram - none of them are forced to be interoperable Facebook and WhatsApp probably will be forced to be interoperable too. > If I build a messaging protocol, there's no requirement for it to be interoperable. None, but it's the decent thing to do. And since corporations are often incapable of doing the decent thing, they have to be forced. > Apple does not hold a majority market share…

> You're approaching this from an American "if it's not an absolute 99.99%+ monopoly it's fine", instead of the EU "do they have a portion of the market so big they can distort it and prevent competition and thus hurt consumers".

I'm not, but thanks for assuming. Apple is part of an oligopoly, which by definition doesn't hold enough market share to prevent competition.

The facetious "99.99%+" point is masking the actual relevance. A company with 30% market share does not hold the power to impact the market in a monopolistic manner. In fact, the precedent set is worrying - if market share isn't the primary factor in regulating monopolistic behaviour, what is? Arbitrary, hand-wavey 'oh, they seem big enough' decisions from bereaucrats?

I am a fan and supporter of inter-operable protocols. Forcing companies to bend to will around how they can build their software though is inherently stifiling though. I don't see any reason that Apple should be forced to provide iMessage interoperablity any more than Ford should be forced to share transponder information with Audi, so someone who owns both can unlock both cars with a single key.

Post reply on HN