> any process running under your user can access

You will need to grant that app explicit Full Disk Access permissions in order for it to access that folder.

Okay then let me grant "Full Notification Access permissions" on iPhone and we're good.

None of this comment chain makes sense… how is this relevant when Apple operates across hundreds of jurisdictions?

Most of which don’t allow users to waive rights based on a prompt.

So Apple would still have liability anyways for grandma getting scammed, regardless of how expertly worded the prompts are.

Which entails extra customer service costs, handling lawsuits, etc… that someone has to pay for.

Why would Apple be liable for these things? There are existing phones in every market that allow such things without any liability issues.

In which jurisdictions are there no court cases whatsoever regarding similar and related issues?

Can you point me to any court cases where an OS developer got sued because an idiot clicked through a security prompt and got pwned as a result?

If you answer my question first sincerely, then I will try to answer yours next.

Ok I'll bite. The US is an example of such a jurisdiction.

And why do you expect people to believe that?

There are easily hundreds of cases involving some alleged or actual liability that various groups claim Apple to have in relation to this or that feature/product/service/etc.

The point is that Apple has never been successfully sued because someone clicked through a warning. I don't care if someone files a frivolous lawsuit that fails.

I just want to learn about a single such lawsuit, anywhere, that's actually succeeded. I can't find any.

I didn’t say “successfully sued”?

This doesn’t even make sense in relation to my prior comments… as unsuccessful cases also cost Apple, and various other parties, real money. So it seems entirely irrelevant to the point.

But remember, the whole premise of this discussion is that fools can be duped into clicking yes to anything, so scammers can talk your grandmother into granting an application that permission. In one case iPhones must not permit it because Apple cares very much, but in another MacOS permits it because it doesn't matter or something? Either way, Apple can do no wrong!

In what world is screenshotting an iMessage enough to move them out of the security boundary

World in which I've paired my two devices?

Doesn't the boundary get broken asking messages be read to me into a BT audio device?

I don’t think you understand what the security boundary of iMessage is.

People’s phones got compromised by NSO sending images to them via whatsapp that used an exploit in one of the image libraries to run a malware payload. The security boundary isn’t about whether you can see your own messages, it’s whether bad people can root your phone by getting untrusted code to run. That’s a very different proposition if iMessage is a single codebase that they fully own end to end versus it has a plugin ecosystem. Having such a plugin system widens the security boundary by adding a much larger codebase that would require trust.

It doesn't need to be a plugin ecosystem - no third party code needs to run within the iMessage processes/sandboxes/containers. In fact, no third-party code needs to run at all on the phone - all that's needed is to expose an API over BLE that allows previously authorized external devices to query/send messages.

In defense of the "it's security!" position (which is not mine): I think they mean a similar vulnerability could exist on the client side of the API. As in someone sends manipulated media that targets a vulnerability on the third party device, the media gets forwarded through the API, now that compromised third party device does bad things over the API.

Personally, I think that it's really just a convenient third party lockout excuse, but the argument isn't quite as bad as it may seem at first glance.

Following that line of reasoning, the Apple should ban WhatsApp and other messaging systems because they can add potential vulnerabilities.

Don’t give them ideas!

> People’s phones got compromised by NSO sending images to them via whatsapp

Has this happened on iOS via WhatsApp?

I know Apple's had a view problems with this happening with iMessage, but always been unsure whether third party app sandbox does a good job of containing this?

I believe this was used to install Pegasus yes

No, that’s not true. NSO Group already has the means to send people spicy JPEGs all they want. Adding this would not significantly change their capabilities.

Did you mean to reply to a different comment?