upvote
> Haven't we learned our lesson on this?

What is the purported lesson we should have learned? Users choose phones with rich messaging features. This was a major selling point for iPhone, first, with iMessage, and later with Android until iOS caught up with RCS.

reply
One of the things Apple's Lockdown mode does is disable previews of images or links that are sent to you.

It seems like the lesson is that you shouldn't be processing data sent to the device by random strangers without the user explicitly choosing to open the file or follow the link.

reply
That should be the default behavior, not a special lock down option that also disables other features.

Why can't they just make it like most email clients? No preview by default, give a banner with an option to explicitly allow a preview for that specific message or conversation?

reply
Well, one could argue that the lesson from CVE-2017-0780[1] should've been "don't automatically decode rich messages from untrusted sources".

[1]: https://www.trendmicro.com/en_us/research/17/i/cve-2017-0780...

reply
Where are users being given an actual choice? There is no option for "iphone without these features", and I would wager that it has 0 bearing on anyone's decision to purchase a new iphone
reply
> What is the purported lesson we should have learned?

Not to automatically execute things within data that we have been sent.

reply
I think it's "don't use parsers written in unsafe languages".
reply
I think it's simpler: don't touch untrusted content unless/until you need to.
reply
Even that's not sufficient. Consider an email client that doesn't parse images until you interact with the message. So you click on it, realize it's dodgy, but it's too late now because all the complex bug prone machinery has already been triggered.

Or my favorite, I marked an extremely suspicious message with what was almost certainly a malicious attachment as junk in a certain BigTech webmail client (the only other option was phishing which it most certainly was not) and it "helpfully" opened the unsubscribe link in my local browser without first asking me for permission. It's difficult to imagine the level of incompetence and dysfunction required to not only write but review, approve, and deploy such a feature in a security and privacy sensitive context.

reply
The email client I use doesn't display images in an email until I explicitly ask it to.
reply
> Don't read and act on my sms messages without me asking you to!

Doesn't that just turn a 0-click exploit into a 1-click exploit? It's unlikely the user can make an informed decision to not process a potentially malicious message, without clicking on the message.

reply
Preferably a two-click exploit. One to view the message and one (if I decide it's safe) to process it through your buggy code.

A 0-click exploit is horrendously worse than even a 1-click one. I often don't even open messages from numbers I don't recognize

reply
Getting users to open a message isn’t a terribly high bar. As a user I would not find it acceptable if needed to be careful with which message I open. We tried putting the responsibility on the user with email attachments and I think it’s fair to say it’s been a disaster. Malicious attachments are probably the most important distribution vector for malware.
reply
This isn't even an exploit if the crappy AI or whatever that's trying to do something fancy never "processes" the message. At least give me a choice before you automatically do that
reply
I don't know if that is the right lesson. It's kind of like "don't click on links"... Err, no. You should be able to click any link without getting hacked.
reply
Wr aren't talking about clicking links even. This is a bug in some stupid code that tries to read your messages for you and act on them. No thank you!
reply
Sure, in an ideal world different from this one. You should be able to do anything on any device and never worry about security.

Unfortunately, since we don't live in that world, we need to not open links, emails, text messages, etc, if they are sketchy.

A better solution may someday exist, but as of yet has not been found.

reply
"Don't click on links" is not a solution, and it's not something people actually do, it's just something they think they do.

Corporate Security will tell you that it's ok to click links to the payroll system or hr or vanta or the 'secure email service' or jira or github or to docusign or the microsoft office document that a partner company sent you or an amazon delivery notification, but not ok to click links in the phishing email that looks exactly like one of those that they sent you.

It's not possible to tell whether a message giving you a link to something is 'sketchy' or not before clicking the link, and any 'security' that relies on people knowing whether a message is malicious or not by magic is broken in the real world.

reply
In my company I regularly see genuine, legitimate emails that carry several huge red flags, like these conveyed to us on trainings.

If I can plausibly claim I wasn't sure it was legit (ie it was sent from the outside form the sketchy looking host), I'd always report it internally as phishing attempt. Just to make the security work with it.

reply
>It's not possible to tell whether a message giving you a link to something is 'sketchy' or not before clicking the link

Sure it is. It's just not something the average user can do. But what makes the situation worse is that most emails now use click tracking, so ALL links are sketchy. For example, emails from my union all link to 2mv.aplink.red and are 200 characters long and look like /dev/urandom output. No fucking idea what or who controls that domain, but it for sure is not my union. I've complained multiple times, including acting dumb and asking if they've been hacked because their email look shady as hell.

Email with the unsubscribe link wrapped in click tracking gets sent straight to SpamCop. I hate tech more and more every day.

reply
> Don't read and act on my sms messages without me asking you to!

Somewhere there's an NSA agent reading this and laughing like a gin addict on payday.

reply
How are they going to make trillions of dollars if not!?
reply
"move fast and break things"
reply
"But the users never know what they want to do! We have to shove suggestions and recommendations at them at every! waking! moment!"
reply