Hacker News Reader

Comment by Syonyk | Hacker News Reader

No, but my point is about complexity.

If all iMessage allowed were ASCII text strings, do you think it would have nearly the same attack surface as it does now, allowing all the various things it supports (including, if I recall properly, some tap based patterns that end up on the watch)?

In a very real sense, complexity (which is what features are) is at odds with security. You increase the attack surface, and you increase the number of pieces you can put together into weird ways that were never intended, but still work and get the attacker something they want.

If there were some toggle to disable parsing everything but ASCII text and images in iMessage, I'd turn it on in a heartbeat.

View on HN

Virtually no one wants to use a messaging platform that just sends ASCII strings.

It's true that if you constrain the problems enough, ratcheting them down to approximately what we were doing with the Internet in 1994 when we were getting access to it from X.25 gateways, you can plausibly ship secure software --- with the engineering budgets of 2021 (we sure as shit couldn't do it in 1994). The problem is that there is no market to support those engineering budgets for the feature set we had in 1994.

> Virtually no one wants to use a messaging platform that just sends ASCII strings.

That's just about all I use for messages. Some images, but it's not critical. And if I had the option to turn off "all advanced gizamawhatchit parsing" in iMessage to reduce the attack surface, I absolutely would - and you can bet any journalist in a hostile country would like the option as well.

The whole "zero click" thing is the concerning bit - if I can remotely compromise someone's phone with just their phone # or email address, well... that's kind of a big deal, and this is hardly the first time it's been the case for iMessage.

If software complexity is at a point that it's considered unreasonable to have a secure device, then it's long past time to put an icepick through the phones and simply stop using them. Though, as I noted above, I feel this way about most of modern computing these days.

I 100% believe that this is all you do with messages. In the 1990s, my cool friends did lots of their work on Wyse dumb terminals hooked up to FreeBSD boxes. Everything they did worked fine on dumb terminals! They were neat, you could have a bunch of them hooked up to one box! But nobody else in the whole world worked that way; even the bank data entry people who were the original market for those stupid terminals had moved on from them.

The issue here is that we aren't saying anything about the real problem. You can radically scope software down. That will indeed make it more secure. But you will stop making money. When you stop making money, you will stop being able to afford the developers who can write secure software (the track record on messaging software written by amateurs for love is not great). Now we're back where we're started, just with shittier software.

It's a hard problem. You aren't wrong to observe it; it's just that you haven't gotten us an inch closer to a solution.

So you speak English? And the rest of the world should do what?

I suppose I should have gone with "Unicode without emoji" instead of ASCII. I don't mind unicode, but I question the emoji parsing engines as they're doing all sorts of crazy stuff with modifiers, and even unicode rendering is oddly complex and likely has bugs in some corner case or another.

From a "I would like it as simple and secure as possible," ASCII does tick quite a few boxes.

I think it's been single-digit months since the last UTF-8 parsing vulnerability.

Syonyk still has a point even though this thread has gone sideways.

Plot twist: extended ASCII?

The "and images" part has historically been a rich source of software exploits. I would guess that chat with full Unicode support but no images would be easier to implement to a high degree of security than ASCII text plus images.

First of all, getting rid of Unicode is not going to happen. Don’t ask.

Getting rid of images might be doable, but still difficult. Talking features away from people is politically difficult.

You know what else is "politically difficult"? Getting journalists and such killed because they're in a hostile nation, and your phone is vulnerable to remote zero-click exploits with full pwnage.

Give users the option. If you're not 100% confident in your parsing (and nobody should be), allow users the option to restrict parsing to something that's limited, tested, fuzzed, and generally trusted. People who care can turn it on. People who want touch memojis on their watch can leave it off.

Reply on news.ycombinator.com