“It’s time for Apple to fix texting”

Re:“It’s time for Apple to fix texting” by dcow on Wednesday August 10, 2022 @04:07AM (#32409066)

What do you mean Android doesn't have an analog? It has both secure boot and device attestation. It has multiple APIs that can be used to design applications requiring varying levels of trusted computing context.

There's the high-level SafeyNet API which essentially lets you assert that you're running on a non-modified device running non-modified software in the context of a verified boot:

* https://developer.android.com/training/safetynet/attestation

It also has the lower-level Keymaster 3 API (since 2017) which provides HSM-signed certificates with the device attestiation extension, including the system trust level and verified device identifiers:

* https://source.android.com/security/keystore/attestation

* https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at...

Microsoft is the one that's late to party... And your hypothesis seems pretty dependent on an argument that Apple can't build iMessaging on other platforms because they're the only platform with device attestation. That's simply not true.

If Apple wanted iMessage on other platforms, they've had at least 5 years to build it in the way you theorize must be required.

[ Parent | on HN ]

Re:“It’s time for Apple to fix texting” by execveat on Wednesday August 10, 2022 @06:40AM (#32409935)

There are multiple public bypasses for SafetyNet. Many 3rd party roms provide them out-of-the-box. Granted, Apple's attestation is bypassable as well.

Furthermore, others mentioned that a large portion of SMS-spam originates from the FluBot infected Android devices. Well, the only reason FluBot does not infect iPhones is laziness - it is perfectly doable at scale using custom configuration profiles.

[ Parent | on HN ]

Re:“It’s time for Apple to fix texting” by dcow on Wednesday August 10, 2022 @12:44PM (#32414915)

Yep good point. Are there bypasses for the hsm-backed signed attestation?

[ Parent | on HN ]