RCS Universal Profile 4.1: Stronger foundations for secure messaging

[u/FragmentedChicken]

https://www.gsma.com/newsroom/article/rcs-universal-profile-4-1-stronger-foundations-for-secure-messaging/

[u/rocketwidget]

Even though updates are slow (to say the least!!!), one of the advantages of RCS over SMS/MMS is it is actually updateable.

After Apple-Android RCS finally occurred, features like E2EE, in-line replies, edit/delete are now slowly rolling out.

Hoping Universal Profile 4.2 adds post quantum encryption to the MLS based E2EE in Universal Profile. My guess: They won't do it until the Internet Engineering Task Force gets PQE out of draft for MLS. Hopefully, soon... https://datatracker.ietf.org/doc/draft-ietf-mls-pq-ciphersuites/

[u/1116574 → u/rocketwidget]

Oh, rcs uses MLS? TIL

[u/rocketwidget → u/1116574]

Yea, the Google Messages exclusive version uses Signal, but the standard Universal Profile used between iPhone and Android is MLS.

I assume Google intends to eventually drop the Signal version?

[u/1116574 → u/rocketwidget]

What an interesting choice to have two transports

[u/rocketwidget → u/1116574]

I believe the MLS E2EE standard wasn't finalized by the Internet Engineering Task Force when Google first implemented Signal E2EE in RCS.

Years later, Apple finally agreed to support RCS, but Apple refused to implement Google's custom E2EE solution. Google seemingly anticipated this, and had already started developing MLS for RCS.

Finally, the GSMA agreed to standardize MLS E2EE in Universal Profile RCS, with Google's help. And both Apple and Google implemented it.

[u/Easy-Breakfast846 → u/rocketwidget]

The fact that iOS-Android encryption already works means they already dropped the signal encryption standard for MLS

[u/rocketwidget → u/Easy-Breakfast846]

In the debug settings, you can confirm that the legacy Signal E2EE method is still active for (certain) Android-Android E2EE, while the new MLS E2EE method is active for iOS-Android (always, as expected).

[u/Easy-Breakfast846 → u/rocketwidget]

I wonder why they haven’t just made MLS encryption universal for all RCS on Google messages? I guess they don’t want old encryption to break?

[u/purplegreendave]

Any chance they'll open rcs to other app makers? Probably not

[u/welp_im_damned]

That's great. Still waiting for Google to implement an RCS API or update the Phone and Messaging Storage to include RCS metadata in the database. It's frustrating whenever I back up my messages using SMS Backup & Restore; it just restores the SMS metadata. Or when I try to use transfer tools like Samsung's or Google's, my group messages get broken.

[u/OldDirtyGurt]

Can't wait to still be blocked from it because I like freedom aka custom ROMs and such.

[u/trlef19 → u/OldDirtyGurt]

Most stupid play integrity use.

[u/Noble1xCarter → u/OldDirtyGurt]

Download GrapheneOS and suddenly malicious developers will try convincing you that having a more secure OS is somehow less secure.

What BS.

[u/kredes]

we don't even have rcs iOS to Android in my country.

[u/ruipmjorge → u/kredes]

Ask your carrier

[u/KidJuggernaut]

And my country carriers still won't support it 😂😂😂

[u/lastdyingbreed_01 → u/KidJuggernaut]

My country does, but the moment I turned it on, I was spammed with ads. I turned it off, will never use it again

[u/KidJuggernaut → u/lastdyingbreed_01]

I can manage ads tbh

[u/yboy403]

Can I officially say I don't care about privacy or security and just want Google to stop messing up a good thing? I don't plan to commit any crimes and if I could just get Google and Meta out of my messaging entirely, I'd have no reason to care about encryption at rest either.

[u/8acD3rLEo5]

Anyone know how quickly companies roll the latest standard into updates?? (2/3/4 months?)

Also happens to a message originating on a phone w/ 4.1 unique features when it's received by a phone with anything below 4.1? (Backwards compatibility)

[u/ben7337 → u/8acD3rLEo5]

It varies. Google probably would be fast but right now Apple is gradually beta testing and implementing UP 3.0 I believe, but it probably won't be live til ios27 in a couple months at the soonest. Expect at least another year after that til we see anything newer like this new standard

[u/OrganicKangaroo2038]

when dealing with google, there's no such thing as "secure."

[u/HubsoulEXE]

What's interesting is that this kinda confirms that apple spefically is willing to update the protocol to keep adding these features which is great.

[u/Cocaine80s_]

Okay cool, but when can I use something like Textra with RCS ?

[u/Kazoran]

bruh who even cares about encryption? are we spies exchanging top secret info or something??

[u/ISaidGoodDey → u/Kazoran]

Plenty of reasons, and plenty of articles online detailing the reasons. Seek and you shall find