Incorporating RCS messaging for Android on iPhone can compromise my security?

Lawrence Finch wrote:

…SS7 can be eavesdropped with an inexpensive monitoring device, because it was never intended to be used to carry outside messages; it’s purpose is to permit signaling between carriers to set up phone calls, and thus it was assumed it would “always” be internal to carrier’s networks…

Having tapped directly into a switch (with the explicit permission of the switch owner) using SS7 via T1, E1, and faster, all sorts of mayhem is entirely possible.

SS7 mayhem has been the foundation for multiple service breaches, as well.

As for the thread, SMS is absolutely not secure.

Citations:

… https://cacm.acm.org/magazines/2020/12/248798-security-analysis-of-sms-as-a-second-factor-of-authentication/fulltext

… https://www.dekra.com/en/exploring-sms-security-download/

Bog-standard RCS is little better, absent add-on encryption.

Yes, this would be a great thing for Apple to do. SMS is unsecure any messages that you sent over SMS can be read. Apple implementing RCS would secure the communication between iphone and Android devices and also it would also enhance the user experience how many times have you tires to send a pic to a non iphone user the quality drops and bad end user experience this would also fix this. Personally I can't wait to have the option. I use both iphone and android it's time that Apple started supporting this. Kudos to Apple. Thank you!.

wakawaka234 wrote:

I'm curious: Why would you think that RCS is going to compromise your security? Isn't iMessage already using 100% unencrypted messaging protocols (SMS and MMS) when communicating with Android devices? I mean, RCS can't be any less encrypted than an entirely unencrypted protocol like SMS and MMS, can it?

If you're concerned about it, you could always just use iMessage to communicate only with other Apple devices, and then use something else (like Signal or Whatsapp) to communicate with Android users.

You're responding to a post that is six months old. And the topic has been discussed in great detail in this thread by a lot of very knowledgeable people. Have you read the rest of the thread? Or just the first post?

It will be safer than SMS as SMS messages can be easily compromised.

Because I think many of the additional features that RCS can provide (messaging over Internet instead of mobile network, read receipts, better image/video quality, etc) are staples of what iMessage touts as it's advantage over traditional SMS.

RCS still won't provide the same E2E encryption that iMessage provides (or any since that's still held tightly by both Apple and Google for their proprietary clients). But RCS will make the experience of texting people who don't use the same ecosystem you do WAY better for us consumers.

If Apple were to adopt RCS without halfway being forced to, they give up what much of the public believes is what makes iMessage special. iMessage will still be a better standard, but the gap will close by a whole lot for most people's experiences.

Tldr; the comparison of iMessage to SMS is far worse than that of iMessage to RCS.

Something I feel most people skip over is iMessage and the messages app aren’t the same thing. iMessage is a service within the texting app on iPhone.

iOS text messaging app provides SMS/MMS texts between phones as well as iMessages between iOS devices.

Think about Facebook messenger. Until recently you could set it as your default texting app so it could send your SMS/MMS texts to other phone numbers, as well as message other Facebook users. Same as how iMessage could send SMS texts as well as message other iMessage users. Facebook removed that so it’s not comparable anymore but same concept. You do both within the same app.

Think of it this way, iMessage isn’t getting RCS support, the iOS texting app will be getting RCS.

Here-I-Am wrote:

What kind of top secret stuff are you texting over there? Surly your agency has its own super secure texting platform.

You’re seemingly somewhat unfamiliar with the topic? Okay, well, we can hopefully explain some of what has been documented.

“Secrecy is the act of hiding information. Privacy is about being unobserved — being able to have my own experience of life without the eyes of anyone else on me.” — Bruce Muzik

For one publicized example: Target famously detected and exposed a pregnancy.

As unfortunate and problematic as that case was, there are other and far worse examples. Far worse.

Some related reading: https://thecontentauthority.com/blog/privacy-vs-secrecy

This is why I am less than interested in using (unencrypted) RCS, and why I think sharing an Apple ID can be bad, and why I am skeptical about first-few-hops VPNs, among other related concerns. Metadata is immensely valuable, and the actual chat data and email data, more so. And the vendors that want that data will expend immense sums to collect it.

vasile50 wrote:

Hello I would like to tell everyone here as an IT specialist SMS messaging is not insecure. It goes from phone to phone through the tower. It is not stored in the cell phone tower. The only way people can steal an SMS is by getting into your phone. RCS iMessage messaging is not more secure, in fact, all of your messages are stored online in the cloud where the government can read saying or hackers the only difference is SMS doesn’t provide high-quality photos because of the low kilobytes. It can transfer your photos and videos, which is why people have switched to WhatsApp, RCS messaging and iMessage messaging.

When you send an SMS it does not go device to device; if it worked that way you could never get an SMS unless your phone was turned on and connected to the network at the time the sender tapped “send”. Your SMS travels over the voice channel SS7 signaling network to a server for your carrier unencrypted. If the recipient has a different carrier the message is then forwarded unencrypted to the recipient carrier’s server, where it is stored until the recipient’s phone connects to the network.

SS7 can be eavesdropped with an inexpensive monitoring device, because it was never intended to be used to carry outside messages; it’s purpose is to permit signaling between carriers to set up phone calls, and thus it was assumed it would “always” be internal to carrier’s networks. But some brilliant engineer said, “SS7 has all this unused bandwidth; we can monetize it by selling that bandwidth to end users.” As you may recall, when SMS first became available there was a charge for every message.

I'm curious: Why would you think that RCS is going to compromise your security? Isn't iMessage already using 100% unencrypted messaging protocols (SMS and MMS) when communicating with Android devices? I mean, RCS can't be any less encrypted than an entirely unencrypted protocol like SMS and MMS, can it?

If you're concerned about it, you could always just use iMessage to communicate only with other Apple devices, and then use something else (like Signal or Whatsapp) to communicate with Android users.

Considering that when Google flipped the switch on RCS ads in India, they had to turn it off.

Every phone in the country got flooded with 1500 spam messages.

why I would want any ads at all in my messaging service is a mystery.

https://www.theverge.com/2022/6/1/23150243/google-rcs-ads-india-spam-verified-business

If anything it’s more of a security risk now. SMS is old unsecure tech

Saegzz wrote:

I’m an avid iPhone user and having mixed feelings about incorporating RCS messaging for Android on iPhones. Will this compromise security?

iMessages will continue to have the same security they have now.

Saegzz wrote:

So why was there so much reluctance to incorporate RCS messaging?

No one here in this user-to-user forum can answer "why" Apple does or does not do something.

What I have read in the announcements is that Apple will be adding the RCS standard features, not the Google variation. Google appeared to want Apple to adopt their standard and presumably get rid of iMessage. Google was threatening to try to get the EU to bring regulatory action. By adopting the standard RCS, Apple avoids being slapped by the EU for having a closed system but still doesn't give Google what they really wanted. Apparently, some people (read people under the age of 25) fell left out or ostracized for not having blue bubbles so they are not buying Android phones. This hurts Google's bottom line. The idea that the color of the message bubble would matter has to be one of the silliest things I've heard in years

There are lots of articles about what Apple announced. I'm sure some of them explain it better than I can.

I don't think any of this was to placate Android users. It appears to have been a way to avoid another set to with the EU.