Live data from Hacker News

iMessage Preview Problems; leak your location by receiving a text message

theantisocialengineer.com

21–30 of 51 posts

Re: iMessage Preview Problems; leak your location by receiving a text message

#21
post #12

imessage won't auto-load previews until you ask it to do it the first time.

But there is no way to disable this once you have accepted it. I do not actually remember having been given the choice but it has been some time so I probably just do not remember.

Ideally one could enable previews only from contacts.

Re: iMessage Preview Problems; leak your location by receiving a text message

#23

What's wrong with web hosts nowadays? a few 100 users and everything dies. Cached: https://webcache.googleusercontent.com/search?q=cache%3Ahttp...

Wordpress with no caching plugin on a $5-a-month droplet, that's what. It's a pleasant enough platform to use, but if you don't cache content and you make the HN frontpage, you're gonna have a bad time.

If you are going to use a out of the box like wordpress why use a VPS instead of a hosting provider? Purely just to store your own data?

Re: iMessage Preview Problems; leak your location by receiving a text message

#24

Sending the requests from the client is probably not the most secure idea. Requests should be proxied through a cloud server on Apple's end to reduce the security risk of these previews.

As has been pointed out below, iMessages are end-to-end encrypted so Apple has no way to read the URL to proxy it.

Re: iMessage Preview Problems; leak your location by receiving a text message

#25
post #15
post #11

Apple should fetch the data via their servers instead of the clients'. It leaks way too much information.

Messages are end-to-end encrypted in iMessage, meaning Apple cannot read the message contents. This solution would require Apple to bypass that encryption for URLs (which are often privacy-sensitive). A good approach would be for the sender to fetch the URL and embed the preview as metadata along with the message. The only downside is that the sender could spoof the preview, but I think that's an acceptable trade-off…

No need to do in transit. I mean iMessage could simply proxy all http/https requests post decryption in iMessage, pre-request.

At the end of the day this privacy trade off (apple gets your browsing info) is probably more secure than an embedded webview that could potentially be exploited and is auto-loaded. Similar to how Chrome alerts of malicious sites...I see this as a long term larger attack vector than privacy leakage.

Re: iMessage Preview Problems; leak your location by receiving a text message

#27

Earlier quoted context omitted.

Wordpress with no caching plugin on a $5-a-month droplet, that's what. It's a pleasant enough platform to use, but if you don't cache content and you make the HN frontpage, you're gonna have a bad time.

If you are going to use a out of the box like wordpress why use a VPS instead of a hosting provider? Purely just to store your own data?

Probably. You can also use a VPS for more things than just Wordpress, and shared web hosting tends to be kind of a crapshoot in any case; if you're up to doing sysadmin work, you really are better off with a VPS, not least because someone else's screwup is a lot less likely to impact your site.

Re: iMessage Preview Problems; leak your location by receiving a text message

#28
post #24

Sending the requests from the client is probably not the most secure idea. Requests should be proxied through a cloud server on Apple's end to reduce the security risk of these previews.

As has been pointed out below, iMessages are end-to-end encrypted so Apple has no way to read the URL to proxy it.

You could still have the client use Apple as a proxy. This would reduce the privacy of the message but only the URL and only exposing it to specific service at Apple. If it is a SOCKS proxy, you could reduce the exposure to just the IP address and some amount of leakage to whatever DNS server the phone is using.

Re: iMessage Preview Problems; leak your location by receiving a text message

#29
post #6

tl;dr iMessage now previews links automatically > The updated iMessage loads the link preview and in essence clicks the link for you! That’s what irks us with this, the choice. OK we might not stop people clicking links anytime soon but Apple have taken this very choice away from us and facilitate the information leakage. The very act of receiving an SMS message can reveal your rough geographic location, your cellula…

What makes this more frustrating is that the link previews are a pretty terrible user experience.

Re: iMessage Preview Problems; leak your location by receiving a text message

#30
post #24

Sending the requests from the client is probably not the most secure idea. Requests should be proxied through a cloud server on Apple's end to reduce the security risk of these previews.

As has been pointed out below, iMessages are end-to-end encrypted so Apple has no way to read the URL to proxy it.

The client could send the request to Apple though, and pass the URL through that way, instead of requesting the actual URL. There's a trade-off there though that Apple gets to see all the links being sent over iMessage.
Post reply on HN