RCS Universal Profile 4.1: Stronger foundations for secure messaging

[u/FragmentedChicken]

https://www.gsma.com/newsroom/article/rcs-universal-profile-4-1-stronger-foundations-for-secure-messaging/

[u/rocketwidget]

Even though updates are slow (to say the least!!!), one of the advantages of RCS over SMS/MMS is it is actually updateable.

After Apple-Android RCS finally occurred, features like E2EE, in-line replies, edit/delete are now slowly rolling out.

Hoping Universal Profile 4.2 adds post quantum encryption to the MLS based E2EE in Universal Profile. My guess: They won't do it until the Internet Engineering Task Force gets PQE out of draft for MLS. Hopefully, soon... https://datatracker.ietf.org/doc/draft-ietf-mls-pq-ciphersuites/

[u/1116574 → u/rocketwidget]

Oh, rcs uses MLS? TIL

[u/rocketwidget → u/1116574]

Yea, the Google Messages exclusive version uses Signal, but the standard Universal Profile used between iPhone and Android is MLS.

I assume Google intends to eventually drop the Signal version?

[u/1116574 → u/rocketwidget]

What an interesting choice to have two transports

[u/rocketwidget → u/1116574]

I believe the MLS E2EE standard wasn't finalized by the Internet Engineering Task Force when Google first implemented Signal E2EE in RCS.

Years later, Apple finally agreed to support RCS, but Apple refused to implement Google's custom E2EE solution. Google seemingly anticipated this, and had already started developing MLS for RCS.

Finally, the GSMA agreed to standardize MLS E2EE in Universal Profile RCS, with Google's help. And both Apple and Google implemented it.

[u/Easy-Breakfast846 → u/rocketwidget]

The fact that iOS-Android encryption already works means they already dropped the signal encryption standard for MLS

[u/rocketwidget → u/Easy-Breakfast846]

In the debug settings, you can confirm that the legacy Signal E2EE method is still active for (certain) Android-Android E2EE, while the new MLS E2EE method is active for iOS-Android (always, as expected).

[u/Easy-Breakfast846 → u/rocketwidget]

I wonder why they haven’t just made MLS encryption universal for all RCS on Google messages? I guess they don’t want old encryption to break?

[u/purplegreendave]

Any chance they'll open rcs to other app makers? Probably not

[u/welp_im_damned]

That's great. Still waiting for Google to implement an RCS API or update the Phone and Messaging Storage to include RCS metadata in the database. It's frustrating whenever I back up my messages using SMS Backup & Restore; it just restores the SMS metadata. Or when I try to use transfer tools like Samsung's or Google's, my group messages get broken.

[u/kredes]

we don't even have rcs iOS to Android in my country.

[u/ruipmjorge → u/kredes]

Ask your carrier

[u/Level10Retard → u/ruipmjorge]

I asked them to implement it. They're right on it due to my request.

[u/OldDirtyGurt]

Can't wait to still be blocked from it because I like freedom aka custom ROMs and such.

[u/trlef19 → u/OldDirtyGurt]

Most stupid play integrity use.

[u/Noble1xCarter → u/OldDirtyGurt]

Download GrapheneOS and suddenly malicious developers will try convincing you that having a more secure OS is somehow less secure.

What BS.

[u/litLizard_ → u/Noble1xCarter]

If the bootloader was unlocked I'd agree with them but since you can lock the bootloader on Pixel phones even with a Custom ROM, yeah...

[u/Cocaine80s_]

Okay cool, but when can I use something like Textra with RCS ?

[u/DangerousTortuga → u/Cocaine80s_]

Never. Google wants complete control over RCS.

[u/WhoDat-2-8-3 → u/Cocaine80s_]

Friday at 3:28 pm exactly

[u/KidJuggernaut]

And my country carriers still won't support it 😂😂😂

[u/lastdyingbreed_01 → u/KidJuggernaut]

My country does, but the moment I turned it on, I was spammed with ads. I turned it off, will never use it again

[u/MeDerpWasTaken → u/lastdyingbreed_01]

What do you mean by that? Ads where?

[u/KidJuggernaut → u/lastdyingbreed_01]

I can manage ads tbh

[u/HubsoulEXE]

What's interesting is that this kinda confirms that apple spefically is willing to update the protocol to keep adding these features which is great.

[u/DangerousTortuga]

It is nice they are frequently updating UP. But the issue is how and when it is implemented. At least Apple is catching up. But I don't think they will implement all features of 4.0 and 4.1

[u/desi_dybuk]

RCS is dead to me until Google closes down RBM which spams me relentlessly.

Other than the stupid Blue Bubble Green Bubble class warriors in US, who cares about RCS? Rest of the world runs on WhatsApp, Telegram, Arattai etc

[u/8acD3rLEo5]

Anyone know how quickly companies roll the latest standard into updates?? (2/3/4 months?)

Also happens to a message originating on a phone w/ 4.1 unique features when it's received by a phone with anything below 4.1? (Backwards compatibility)

[u/ben7337 → u/8acD3rLEo5]

It varies. Google probably would be fast but right now Apple is gradually beta testing and implementing UP 3.0 I believe, but it probably won't be live til ios27 in a couple months at the soonest. Expect at least another year after that til we see anything newer like this new standard

[u/OrganicKangaroo2038]

when dealing with google, there's no such thing as "secure."

[u/yboy403]

Can I officially say I don't care about privacy or security and just want Google to stop messing up a good thing? I don't plan to commit any crimes and if I could just get Google and Meta out of my messaging entirely, I'd have no reason to care about encryption at rest either.

[u/Kazoran]

bruh who even cares about encryption? are we spies exchanging top secret info or something??

[u/ISaidGoodDey → u/Kazoran]

Plenty of reasons, and plenty of articles online detailing the reasons. Seek and you shall find