iMessage Preview Problems; leak your location by receiving a text message(theantisocialengineer.com) |
iMessage Preview Problems; leak your location by receiving a text message(theantisocialengineer.com) |
> The updated iMessage loads the link preview and in essence clicks the link for you! That’s what irks us with this, the choice. OK we might not stop people clicking links anytime soon but Apple have taken this very choice away from us and facilitate the information leakage. The very act of receiving an SMS message can reveal your rough geographic location, your cellular operator, your current WiFi network.
We're already on 10.0.2, so we've already had a few updates.
> Early 2016 we were the first company in the UK to offer
> SMShing services. These SMS messages are like phishing
> emails and contain a pretext alongside a link within the
> message. When a mark receives an SMS message and clicks the
> link a host of details are available to us.
A good approach would be for the sender to fetch the URL and embed the preview as metadata along with the message. The only downside is that the sender could spoof the preview, but I think that's an acceptable trade-off here (not much of a phishing vector when you end up loading the original site once you open the link anyway).
At the end of the day this privacy trade off (apple gets your browsing info) is probably more secure than an embedded webview that could potentially be exploited and is auto-loaded. Similar to how Chrome alerts of malicious sites...I see this as a long term larger attack vector than privacy leakage.
Ha. Cute.
Cached: https://webcache.googleusercontent.com/search?q=cache%3Ahttp...
Should of course still be no problem for any server that serves cached content, but somehow that number of requests brings down a fair amount of frontpage posts..
It seems that whenever we try to make software helpful we produce more problems.
Go to settings > messages > and disable iMessage.
That should be a temporary fix right?
Ideally one could enable previews only from contacts.
Exactly, this is what all the other replies saying 'just proxy the client URL call through Apple' are missing. It's not just that the iMessage was encrypted. There's also _why_ it is encrypted in the first place.
So I suppose I should say rather I would expect to see it corrected in iOS 10.1, at latest.
This sort of change (fixing link previews) is similar in scope to changes Apple's made in micro (0.0.1) releases before. Whether it happens in a micro release or wait until 10.1 (or even change anything at all) really depends on how important Apple thinks the issue is.
At any rate, I doubt the feature is going away completely (link previews were a flagship iOS 10 feature): at best, I'd expect a "Automatically preview links" checkbox in Settings, just like external image downloads in Mail.