Realistically, the average person doesn't even know what an encryption key is and the average tech enthusiast doesn't know anything beyond "Apple handles everything".
> So presumably the blue bubbles have to go. This means that when chatting in Messages now, one will not be able to know whether it's Apple alone protecting the privacy of the conversation
Why can't iMessage to iMessage be blue bubbles with iMessage to anything else being green bubbles? Do you think the average iPhone user understands that green bubbles mean insecure rather than thinking they're "Android bubbles"?
Why are so many people convinced that consumer choice and security are mutually exclusive?
The new law removes that person's ability to even discern this much.
> Why can't iMessage to iMessage be blue bubbles with iMessage to anything else being green bubbles?
This would pretty clearly be Apple preferring its own service over other services, and is prohibited under the new law.
I should be clear here: I think this law is clumsy and will have to be fixed or loosely enforced. But even if one is in favor of these changes, it's fair to acknowledge the reality that the law basically mandates a major change in the security posture of a billion deployed devices. One may still be in favor, but it's important not to lose sight of the fact that there are in fact compromises being made.
> Why are so many people convinced that consumer choice and security are mutually exclusive?
I am 100% not convinced this is true; security and choice can coexist. But this EU law does not aim at the goal of preserving security while increasing consumer choice. Which is strange, given how a consequence of a prior EU Act was the pollution of the Web with cookie banners. (I am aware these banners are not specifically required for many use cases, which is why I said this is a consequence of their Act and not something ordered by their Act.)
I don't agree. Green bubbles indicate that messages travelled 100% within Apple's ecosystem. Indicating interoperability with a 3rd party by using blue bubbles doesn't do anything to prevent those 3rd parties from having their own green bubbles within their own ecosystem.
The entire point of the law is Apple/Google don't get to manage their own ecosystems anymore; EU regulators do that. One read of the intent of the Act is that platforms should not be able to preference their own services over those of third parties. My skim of the Act indicates that it would be in bounds for a regulator to decide that this means no blue/green message distinction, and a direct consequence of that is that anyone in a group chat could be using Facebook Messenger as a client and allowing Facebook to log all the messages.
Engineering decisions henceforth need to weigh what a specific regulator believes the law says, since the law is not very specific about many details. This is not good, especially coming from the people who caused the global cookie disclaimer deluge.
Does it really, though? Is it something that that was explicitly brought up in the drafting of this law? Or is this a doomsday scenario that chooses to interpret the law in its most extreme form?
The legislation has been approved. Let us see how regulators actually enforce it. Until the EU bans green vs. blue bubbles, this is nothing more than FUD.
We're on the same page here: lawyers are now deciding matters of technical import, and that is not a good thing.
I agree with you in general, but it is possible for this evaluation to be done by a simple read of e.g. the iOS marketing page. The Act proposes a regime where it is not possible for a chat participant to determine who holds the encryption keys for the chat. You may consider that better or worse or neither, but it is a significant change in the security posture for billions of deployed devices.
The wording in the Act appears to not place constraints on exactly what services must be able to interop with iMessage, and it says Apple can't preference iMessage. So presumably the blue bubbles have to go. This means that when chatting in Messages now, one will not be able to know whether it's Apple alone protecting the privacy of the conversation, or whether the weakest link is a company of a single person that started this week using an OSS package to spin up a new messaging app on a Linode VM and was able to achieve parity in iOS messaging simply by virtue of this Act.
That's a very different situation than the status quo.
Similar logic applies to the App Store and payment details, but messaging is egregious because other participants in the chat can make (and potentially change) the security posture of the chat without your knowledge.
(Edit, adding reply to this part.)
> Are you arguing that it's impossible for Discord or ICQ to implement the same feature set as the native iMessage client?
No, I am saying that it's going to be trivial to implement the feature set. I fully expect there to be OSS libraries to implement the iMessage client.
The issue is that when people use iMessage and see a blue bubble, they also know something about how the encryption keys are handled & who does the handling, etc. This Act as written appears to allow any person to install an OSS iMessage server on a VM and achieve OS parity with iMessage, and Apple is prevented from indicating that others in the chat may be compromising the security of the chat. I used ICQ and Discord as examples because Apple exchanging my encryption keys with ICQ is definitely compromising a core feature of iMessage.